Fix MARS collector against a real agent's object model

Checked with Get-MarsCollectorDiagnostics.ps1 output from MARS agent
2.0.9274 (VA-FS-01):

- JobStatus.StartTime/EndTime are UTC values not marked as UTC
  (DisplayTime is the local one); they were read as local, putting
  runs 6 hours off. Lookback filtering now compares in UTC too
- ErrorInfo is always present with ErrorCode 0 on success; every
  completed backup would have been a warning. Only non-zero error
  codes count
- Schedule times are TimeSpans; casting them to DateTime failed, so
  next_run_at was always empty
- DatasourceStatus.Datasource is an object; use its DataSourceName
- Also report FileProgress.Failed file counts and FailedFileLog
- Mock rebuilt on the real shapes; diagnostics handle no System State
  policy

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -12,7 +12,7 @@ browser ──nginx (basic auth, TLS)──▶ /api/* ─▶│ SQLite       │
 - `public/`: static frontend (no build step). Add `?mock=1` to the URL to use built-in sample data.
 - `backend/`: FastAPI API backed by a single SQLite file.
 - `deploy/`: nginx site and systemd unit.
-- `collectors/`: scripts that report results from backup products ([Veeam B&R](collectors/veeam/README.md)).
+- `collectors/`: scripts that report results from backup products ([Veeam B&R](collectors/veeam/README.md), [Azure Backup / MARS](collectors/mars/README.md)).
 
 ## Data model
 

backend/app/settings.py

@@ -5,6 +5,9 @@ from pathlib import Path
 # The modal shows this many days of run history; retention can never be shorter.
 HISTORY_DAYS = 30
 
+# Shared by the systemd service (EnvironmentFile=) and manage.py, so both always use the same DB.
+DEFAULT_ENV_FILE = "/etc/backup-dashboard/backup-dashboard.env"
+
 
 @dataclass(frozen=True)
 class Settings:
@@ -14,9 +17,27 @@ class Settings:
     serve_static: bool = False
 
 
+def read_env_file(path: Path) -> dict[str, str]:
+    """Parse simple KEY=VALUE lines (the subset systemd's EnvironmentFile accepts)."""
+    values = {}
+    try:
+        lines = path.read_text().splitlines()
+    except FileNotFoundError:
+        return values
+    for line in lines:
+        line = line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        key, _, value = line.partition("=")
+        values[key.strip()] = value.strip().strip("\"'")
+    return values
+
+
 def load_settings() -> Settings:
+    # Real environment variables win over the env file; the env file wins over dev defaults.
+    env = read_env_file(Path(os.environ.get("BACKUP_DASH_ENV_FILE", DEFAULT_ENV_FILE))) | os.environ
     return Settings(
-        db_path=Path(os.environ.get("BACKUP_DASH_DB", "backup-dashboard.db")),
-        retention_days=max(HISTORY_DAYS, int(os.environ.get("BACKUP_DASH_RETENTION_DAYS", "90"))),
-        serve_static=os.environ.get("BACKUP_DASH_SERVE_STATIC") == "1",
+        db_path=Path(env.get("BACKUP_DASH_DB", "backup-dashboard.db")),
+        retention_days=max(HISTORY_DAYS, int(env.get("BACKUP_DASH_RETENTION_DAYS", "90"))),
+        serve_static=env.get("BACKUP_DASH_SERVE_STATIC") == "1",
     )

backend/tests/test_manage.py

@@ -0,0 +1,52 @@
+import subprocess
+import sys
+from pathlib import Path
+
+from app.settings import load_settings
+
+BACKEND = Path(__file__).resolve().parents[1]
+
+
+def run_manage(*args, env, cwd):
+    return subprocess.run([sys.executable, str(BACKEND / "manage.py"), *args],
+                          capture_output=True, text=True, env=env, cwd=cwd)
+
+
+def base_env(tmp_path, monkeypatch):
+    env_file = tmp_path / "backup-dashboard.env"
+    monkeypatch.setenv("BACKUP_DASH_ENV_FILE", str(env_file))
+    monkeypatch.delenv("BACKUP_DASH_DB", raising=False)
+    return env_file, {"BACKUP_DASH_ENV_FILE": str(env_file), "PYTHONPATH": str(BACKEND), "PATH": "/usr/bin:/bin"}
+
+
+def test_env_file_supplies_db_path_and_real_env_wins(tmp_path, monkeypatch):
+    env_file, _ = base_env(tmp_path, monkeypatch)
+    env_file.write_text('# comment\nBACKUP_DASH_DB="/srv/from-file.db"\nBACKUP_DASH_RETENTION_DAYS=120\n')
+    assert load_settings().db_path == Path("/srv/from-file.db")
+    assert load_settings().retention_days == 120
+    monkeypatch.setenv("BACKUP_DASH_DB", "/srv/from-env.db")
+    assert load_settings().db_path == Path("/srv/from-env.db")
+
+
+def test_manage_refuses_to_create_db_implicitly(tmp_path, monkeypatch):
+    _, env = base_env(tmp_path, monkeypatch)
+    workdir = tmp_path / "somewhere-else"
+    workdir.mkdir()
+    r = run_manage("create-key", "k", env=env, cwd=workdir)
+    assert r.returncode != 0
+    assert "Database not found" in r.stderr
+    assert not (workdir / "backup-dashboard.db").exists()
+
+
+def test_manage_uses_db_from_env_file(tmp_path, monkeypatch):
+    env_file, env = base_env(tmp_path, monkeypatch)
+    service_db = tmp_path / "service.db"
+    env_file.write_text(f"BACKUP_DASH_DB={service_db}\n")
+    assert run_manage("--create", "list-keys", env=env, cwd=tmp_path).returncode == 0  # service's first start
+    workdir = tmp_path / "somewhere-else"
+    workdir.mkdir()
+    r = run_manage("create-key", "veeam-acme", env=env, cwd=workdir)
+    assert r.returncode == 0, r.stderr
+    assert str(service_db) in r.stderr
+    assert "veeam-acme" in run_manage("list-keys", env=env, cwd=tmp_path).stdout
+    assert not (workdir / "backup-dashboard.db").exists()

collectors/mars/Get-MarsCollectorDiagnostics.ps1

@@ -0,0 +1,102 @@
+<#
+.SYNOPSIS
+    Read-only dump of what the MARS agent's cmdlets return, for troubleshooting the collector.
+
+.DESCRIPTION
+    The collector reads properties of Get-OBJob / Get-OBPolicy / Get-OBSchedule results whose names
+    aren't documented. This prints those objects' real structure (property names, types and values,
+    a few levels deep) so mismatches can be fixed. Nothing is changed. Output is also saved to a
+    text file.
+
+.EXAMPLE
+    .\Get-MarsCollectorDiagnostics.ps1
+#>
+[CmdletBinding()]
+param(
+    [int]$Jobs = 3,
+    [string]$OutFile = (Join-Path $env:TEMP 'mars-collector-diagnostics.txt')
+)
+
+$ErrorActionPreference = 'Stop'
+$MaxDepth = 6
+
+if (-not (Get-Command Get-OBJob -ErrorAction SilentlyContinue)) {
+    if (Get-Module -ListAvailable -Name MSOnlineBackup) {
+        Import-Module MSOnlineBackup
+    } else {
+        Import-Module (Join-Path $env:ProgramFiles 'Microsoft Azure Recovery Services Agent\bin\Modules\MSOnlineBackup')
+    }
+}
+
+function Test-Scalar($Value) {
+    return $null -eq $Value -or $Value -is [string] -or $Value -is [ValueType] -or $Value -is [guid]
+}
+
+# Recursive "name (type) = value" listing. Collections show their first 3 items.
+function Show-Object($Value, [string]$Indent = '  ', [int]$Depth = 0) {
+    if (Test-Scalar $Value) { return }
+    if ($Depth -ge $MaxDepth) { "$Indent..."; return }
+    if ($Value -is [Collections.IEnumerable]) {
+        $items = @($Value)
+        "$Indent[$($items.Count) item(s)]"
+        $i = 0
+        foreach ($item in $items | Select-Object -First 3) {
+            "$Indent[$i] ($($item.GetType().FullName))$(if (Test-Scalar $item) { " = $item" })"
+            Show-Object $item "$Indent    " ($Depth + 1)
+            $i++
+        }
+        return
+    }
+    foreach ($p in $Value.PSObject.Properties) {
+        try { $v = $p.Value } catch { "$Indent$($p.Name) = <error: $($_.Exception.Message)>"; continue }
+        $type = if ($null -eq $v) { 'null' } else { $v.GetType().FullName }
+        if (Test-Scalar $v) {
+            "$Indent$($p.Name) ($type) = $v"
+        } else {
+            $text = [string]$v
+            if ($text.Length -gt 100) { $text = $text.Substring(0, 97) + '...' }
+            "$Indent$($p.Name) ($type) = $text"
+            Show-Object $v "$Indent    " ($Depth + 1)
+        }
+    }
+}
+
+function Show-Section([string]$Title, [scriptblock]$Get) {
+    "== $Title"
+    try {
+        $result = @(& $Get)
+        if ($result.Count -eq 0 -or ($result.Count -eq 1 -and $null -eq $result[0])) { '  (nothing returned)' }
+        $n = 0
+        foreach ($item in $result) {
+            if ($null -eq $item) { continue }
+            "  [$n] ($($item.GetType().FullName))"
+            Show-Object $item '      '
+            $n++
+        }
+    } catch {
+        "  error: $($_.Exception.Message)"
+    }
+    ''
+}
+
+$report = & {
+    $agent = try {
+        (Get-Item (Join-Path $env:ProgramFiles 'Microsoft Azure Recovery Services Agent\bin\cbengine.exe')).VersionInfo.ProductVersion
+    } catch { 'unknown' }
+    "Generated $(Get-Date -Format o) on $env:COMPUTERNAME, MARS agent $agent, PowerShell $($PSVersionTable.PSVersion)"
+    ''
+    Show-Section 'Get-OBJob (in progress)' { Get-OBJob }
+    Show-Section "Get-OBJob -Previous $Jobs" { Get-OBJob -Previous $Jobs }
+    Show-Section 'Get-OBPolicy' { Get-OBPolicy }
+    Show-Section 'Get-OBPolicy | Get-OBSchedule' { Get-OBSchedule -Policy (Get-OBPolicy) }
+    if (Get-Command Get-OBSystemStatePolicy -ErrorAction SilentlyContinue) {
+        Show-Section 'Get-OBSystemStatePolicy | Get-OBSchedule' {
+            $ssPolicy = Get-OBSystemStatePolicy
+            if ($ssPolicy) { Get-OBSchedule -Policy $ssPolicy } else { '(no System State policy configured)' }
+        }
+    }
+} | Out-String -Width 300
+
+$report
+$report | Set-Content -Path $OutFile -Encoding UTF8
+Write-Host "Saved to $OutFile"

collectors/mars/Install-MarsCollector.ps1

@@ -0,0 +1,90 @@
+<#
+.SYNOPSIS
+    Installs the MARS (Azure Backup agent) collector as a SYSTEM scheduled task.
+
+.DESCRIPTION
+    - Copies Send-MarsBackupStatus.ps1 to Program Files (only admins can modify it, which
+      matters because it runs as SYSTEM).
+    - Writes the config to ProgramData\BackupDashboard and restricts that folder to SYSTEM and
+      Administrators, since it contains the API key.
+    - Registers a scheduled task that runs every IntervalMinutes under Windows PowerShell 5.1
+      (powershell.exe), which the agent's MSOnlineBackup module targets.
+    Safe to re-run to change settings or update the script. Can sit alongside the Veeam collector.
+
+.EXAMPLE
+    .\Install-MarsCollector.ps1 -ApiUrl https://backups.example.com -Tenant "Acme Corp"
+    (prompts for the API key)
+#>
+#Requires -RunAsAdministrator
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$ApiUrl,
+    [Parameter(Mandatory)][string]$Tenant,
+    # Name shown on the dashboard; defaults to "<server> - Azure Backup"
+    [string]$JobName,
+    [string]$SourceSystem = 'Azure Backup (MARS)',
+    [ValidateRange(5, 1440)][int]$IntervalMinutes = 60,
+    [ValidateRange(1, 720)][int]$LookbackHours = 48,
+    [string]$InstallDir = (Join-Path $env:ProgramFiles 'BackupDashboard')
+)
+
+$ErrorActionPreference = 'Stop'
+$TaskName = 'Backup Dashboard - MARS collector'
+$DataDir = Join-Path $env:ProgramData 'BackupDashboard'
+$ConfigPath = Join-Path $DataDir 'mars-collector.json'
+$WindowsPowerShell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+
+# Check the agent is here before changing anything
+$agentModule = Join-Path $env:ProgramFiles 'Microsoft Azure Recovery Services Agent\bin\Modules\MSOnlineBackup'
+if (-not (Get-Module -ListAvailable -Name MSOnlineBackup) -and -not (Test-Path $agentModule)) {
+    throw 'The MARS agent (MSOnlineBackup PowerShell module) is not installed on this server.'
+}
+
+if ($ApiUrl -notmatch '^https://') {
+    Write-Warning 'ApiUrl is not HTTPS: the API key would be sent in clear text.'
+}
+
+# Read the key as a SecureString so it isn't echoed to the console or kept in shell history
+$secure = Read-Host -AsSecureString 'API key (from: python manage.py create-key <name>)'
+$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
+try { $apiKey = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr) }
+finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr) }
+if (-not $apiKey.StartsWith('bdk_')) { throw "That doesn't look like a dashboard API key (expected 'bdk_...')." }
+
+# Config folder: SYSTEM + Administrators only (SIDs so this works on non-English Windows)
+New-Item -ItemType Directory -Path $DataDir -Force | Out-Null
+& icacls.exe $DataDir /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+if ($LASTEXITCODE) { throw "icacls failed on $DataDir" }
+
+$config = [ordered]@{
+    ApiUrl        = $ApiUrl.TrimEnd('/')
+    ApiKey        = $apiKey
+    Tenant        = $Tenant
+    SourceSystem  = $SourceSystem
+    LookbackHours = $LookbackHours
+}
+if ($JobName) { $config.JobName = $JobName }
+$config | ConvertTo-Json | Set-Content -Path $ConfigPath -Encoding UTF8
+
+New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null
+$scriptPath = Join-Path $InstallDir 'Send-MarsBackupStatus.ps1'
+Copy-Item -Path (Join-Path $PSScriptRoot 'Send-MarsBackupStatus.ps1') -Destination $scriptPath -Force
+Unblock-File -Path $scriptPath
+
+$action = New-ScheduledTaskAction -Execute $WindowsPowerShell `
+    -Argument "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$scriptPath`""
+$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) `
+    -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes)
+$principal = New-ScheduledTaskPrincipal -UserId 'S-1-5-18' -LogonType ServiceAccount -RunLevel Highest
+$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 30) `
+    -MultipleInstances IgnoreNew -StartWhenAvailable
+Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal `
+    -Settings $settings -Description 'Sends Azure Backup (MARS) results to the Backup Dashboard' -Force | Out-Null
+
+Write-Host "Installed. Config: $ConfigPath"
+Write-Host "Task '$TaskName' runs every $IntervalMinutes minutes as SYSTEM, using Windows PowerShell."
+Write-Host ''
+Write-Host 'Next steps:'
+Write-Host "  1. Preview what will be sent:   & '$WindowsPowerShell' -File '$scriptPath' -DryRun"
+Write-Host "  2. Backfill 30 days of history: & '$WindowsPowerShell' -File '$scriptPath' -LookbackHours 720"
+Write-Host "  3. Check the log:               Get-Content '$DataDir\mars-collector.log' -Tail 20"

collectors/mars/README.md

@@ -0,0 +1,66 @@
+# Azure Backup (MARS agent) collector
+
+A PowerShell script that runs on each server with the Microsoft Azure Recovery Services (MARS)
+agent and reports its backups to the dashboard. Each server appears as one job,
+named `<SERVER> - Azure Backup` by default.
+
+> **Checked against:** MARS agent 2.0.9274, a Files & Folders policy with completed backups only.
+> Not yet seen on a real agent: a failed backup, a backup in progress, or a System State policy.
+> Those paths are written to the same object model, but if one looks wrong, run
+> `Get-MarsCollectorDiagnostics.ps1` while it's in that state and send the output.
+
+## Install (on the server, as an administrator)
+
+Runs under Windows PowerShell 5.1 (`powershell.exe`), which the agent's `MSOnlineBackup` module
+targets and which every supported Windows Server has.
+
+1. On the dashboard host, create a key for this server:
+   ```bash
+   python manage.py create-key mars-acme-fs01
+   ```
+2. Copy this folder to the server and run:
+   ```powershell
+   .\Install-MarsCollector.ps1 -ApiUrl https://backups.example.com -Tenant "Acme Corp"
+   ```
+   Add `-JobName "File Server"` to choose the name shown on the dashboard. It prompts for the
+   key, then:
+   - writes `C:\ProgramData\BackupDashboard\mars-collector.json` (readable only by SYSTEM and Administrators)
+   - copies the script to `C:\Program Files\BackupDashboard\`
+   - registers the scheduled task **Backup Dashboard - MARS collector** (SYSTEM, every 60 minutes)
+3. Preview the payloads, then backfill 30 days so the history view is populated straight away:
+   ```powershell
+   powershell.exe -File 'C:\Program Files\BackupDashboard\Send-MarsBackupStatus.ps1' -DryRun
+   powershell.exe -File 'C:\Program Files\BackupDashboard\Send-MarsBackupStatus.ps1' -LookbackHours 720
+   ```
+
+It can be installed alongside the Veeam collector: it uses its own config, state, log and task.
+Re-run the installer to change settings or update the script.
+
+## What it sends
+
+| Dashboard | MARS |
+|---|---|
+| Company | `Tenant` from the config |
+| Job | One per server, ID `mars:<computer name>`, so changing `JobName` renames rather than duplicates it |
+| Status | Backup job state: Failed → **Failed**. Completed with failed bytes or an error → **Warning**. Aborted/cancelled or unrecognised → **Warning**. In progress → **Running**. Restore jobs are ignored |
+| Started / finished | Job start / end time. MARS reports these in UTC without marking them as UTC; the collector handles that |
+| Next scheduled | Next slot from the backup policy schedule, or the System State policy's if that's sooner. Empty (so never Overdue) for schedules that run every 2+ weeks, since which week is next can't be told |
+| Message | Job and per-datasource errors (non-zero error codes), failed file counts, and the failed-file log path |
+| Size | Bytes transferred, summed across datasources |
+
+Each run covers the last 48 hours (`LookbackHours`). Jobs already delivered are recorded in
+`mars-collector.state.json`.
+
+## Troubleshooting
+
+- Log: `C:\ProgramData\BackupDashboard\mars-collector.log`. Exit codes: `0` OK, `1` some runs
+  failed to send (retried next run), `2` setup failed (config or MARS module).
+- Wrong status, sizes or messages: run `.\Get-MarsCollectorDiagnostics.ps1` (read-only). It prints
+  the real structure of the objects the agent's cmdlets return.
+
+## Testing without MARS
+
+```powershell
+. ./tests/MockMars.ps1
+./Send-MarsBackupStatus.ps1 -ConfigPath ./my-test-config.json -DryRun
+```

collectors/mars/Send-MarsBackupStatus.ps1

@@ -0,0 +1,413 @@
+<#
+.SYNOPSIS
+    Reports Microsoft Azure Recovery Services (MARS) agent backups to the Backup Dashboard.
+
+.DESCRIPTION
+    Runs on a server with the MARS agent, normally as a SYSTEM scheduled task every 60 minutes
+    (see Install-MarsCollector.ps1). The server appears on the dashboard as one job. Each run sends:
+      - the next scheduled backup, worked out from the backup (and System State) policy schedules,
+        which drives the dashboard's Overdue flag, and
+      - every backup job from the last LookbackHours that the dashboard hasn't already received in
+        its final state. A backup in progress is sent as Running until it finishes.
+
+    Already-reported jobs are tracked in a state file, and the ingest API is idempotent, so a
+    failed or repeated run is harmless: anything not confirmed is retried next time.
+
+    Written for Windows PowerShell 5.1, which the MARS agent's MSOnlineBackup module targets.
+
+.PARAMETER ConfigPath
+    JSON config with ApiUrl, ApiKey and Tenant (optional: JobName, SourceSystem, LookbackHours).
+
+.PARAMETER LookbackHours
+    Overrides the config value. Use 720 once to backfill 30 days of history.
+
+.PARAMETER DryRun
+    Print the payloads instead of sending them. Doesn't touch the state or log files.
+
+.EXAMPLE
+    .\Send-MarsBackupStatus.ps1 -DryRun
+.EXAMPLE
+    .\Send-MarsBackupStatus.ps1 -LookbackHours 720
+#>
+[CmdletBinding()]
+param(
+    [string]$ConfigPath = (Join-Path $env:ProgramData 'BackupDashboard\mars-collector.json'),
+    [int]$LookbackHours = 0,
+    [switch]$DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+
+$DataDir = Split-Path -Parent $ConfigPath
+$LogPath = Join-Path $DataDir 'mars-collector.log'
+$StatePath = Join-Path $DataDir 'mars-collector.state.json'
+$MaxLogBytes = 5MB
+# MARS keeps a limited job history; this comfortably covers 30 days at 3 backups a day
+$MaxPreviousJobs = 200
+$Invariant = [Globalization.CultureInfo]::InvariantCulture
+
+# ---------- Helpers ----------
+
+function Write-Log {
+    param([string]$Message, [string]$Level = 'INFO')
+    $line = '{0} [{1}] {2}' -f (Get-Date).ToString('yyyy-MM-dd HH:mm:ss'), $Level, $Message
+    Write-Host $line
+    if ($DryRun) { return }
+    if ((Test-Path $LogPath) -and (Get-Item $LogPath).Length -gt $MaxLogBytes) {
+        Move-Item $LogPath "$LogPath.1" -Force
+    }
+    Add-Content -Path $LogPath -Value $line -Encoding UTF8
+}
+
+function Get-ErrorText($ErrorRecord) {
+    # Windows PowerShell puts the HTTP response body (e.g. the API's 422 explanation) here
+    if ($ErrorRecord.ErrorDetails -and $ErrorRecord.ErrorDetails.Message) {
+        return "$($ErrorRecord.Exception.Message) $($ErrorRecord.ErrorDetails.Message)"
+    }
+    return $ErrorRecord.Exception.Message
+}
+
+# The API needs an explicit UTC offset. DateTimeOffset keeps a Local/Unspecified time as local and a
+# Utc time as +00:00.
+function ConvertTo-IsoTime($Value) {
+    if ($null -eq $Value) { return $null }
+    $dt = [datetime]$Value
+    if ($dt.Year -le 1900) { return $null }  # "not set" (MARS uses 1601-01-01)
+    return ([DateTimeOffset]$dt).ToString("yyyy-MM-dd'T'HH:mm:sszzz", $Invariant)
+}
+
+# First property of $Object, out of $Names, that exists and isn't empty. MARS object property names
+# aren't documented, so reads go through this rather than assuming one spelling.
+function Get-FirstValue($Object, [string[]]$Names) {
+    if ($null -eq $Object) { return $null }
+    foreach ($name in $Names) {
+        try {
+            $prop = $Object.PSObject.Properties[$name]
+            if (-not $prop) { continue }
+            $value = $prop.Value
+            # Check emptiness by type: casting to [string] would make a one-item list of objects ''
+            if ($null -eq $value) { continue }
+            if ($value -is [string] -and $value -eq '') { continue }
+            if ($value -is [Collections.ICollection] -and $value.Count -eq 0) { continue }
+            return $value
+        } catch { }
+    }
+    return $null
+}
+
+function Import-Mars {
+    if (Get-Command Get-OBJob -ErrorAction SilentlyContinue) { return }  # already loaded
+    if (Get-Module -ListAvailable -Name MSOnlineBackup) {
+        Import-Module MSOnlineBackup
+        return
+    }
+    # The agent normally adds its module folder to PSModulePath; fall back to the default install path
+    $agentModule = Join-Path $env:ProgramFiles 'Microsoft Azure Recovery Services Agent\bin\Modules\MSOnlineBackup'
+    Import-Module $agentModule
+}
+
+# ---------- Schedule ----------
+
+# Next slot strictly after $After for a MARS schedule (days of week + times of day).
+# Returns $null when there's no schedule, or when it runs every N>1 weeks: we can't tell which
+# week is next, and a wrong guess would raise a false Overdue alarm.
+function Get-NextSlot($Schedule, [datetime]$After) {
+    if ($null -eq $Schedule) { return $null }
+    $weeks = Get-FirstValue $Schedule @('ScheduleWeeklyFrequency', 'WeeksInterval')
+    if ($weeks -and [int]$weeks -gt 1) { return $null }
+
+    $days = @(Get-FirstValue $Schedule @('ScheduleRunDays', 'DaysOfWeek') | ForEach-Object { [string]$_ })
+    # TimeSpans (time of day, local) on real agents; accept DateTimes too
+    $times = @(Get-FirstValue $Schedule @('ScheduleRunTimes', 'TimesOfDay') | ForEach-Object {
+        if ($_ -is [timespan]) { $_ } else { ([datetime]$_).TimeOfDay }
+    } | Sort-Object)
+    if ($days.Count -eq 0 -or $times.Count -eq 0) { return $null }
+
+    for ($offset = 0; $offset -le 7; $offset++) {
+        $date = $After.Date.AddDays($offset)
+        if ($days -notcontains [string]$date.DayOfWeek) { continue }
+        foreach ($time in $times) {
+            $candidate = $date + $time
+            if ($candidate -gt $After) { return $candidate }
+        }
+    }
+    return $null
+}
+
+function Get-NextRun {
+    $next = $null
+    $policies = @()
+    try { $policies += @(Get-OBPolicy) } catch { Write-Log "Couldn't read the backup policy: $(Get-ErrorText $_)" 'WARN' }
+    # Windows Server can have a separate System State policy with its own schedule
+    if (Get-Command Get-OBSystemStatePolicy -ErrorAction SilentlyContinue) {
+        try { $policies += @(Get-OBSystemStatePolicy) } catch { }
+    }
+    foreach ($policy in $policies) {
+        if ($null -eq $policy) { continue }
+        try {
+            $slot = Get-NextSlot (Get-OBSchedule -Policy $policy) (Get-Date)
+            if ($slot -and (-not $next -or $slot -lt $next)) { $next = $slot }
+        } catch {
+            Write-Log "Couldn't read a policy schedule: $(Get-ErrorText $_)" 'WARN'
+        }
+    }
+    return ConvertTo-IsoTime $next
+}
+
+# ---------- Jobs ----------
+
+# A job's StartTime/EndTime are UTC values, though not necessarily marked as UTC: on a real agent
+# StartTime matched the "StartTimeUTC" in the status text, while DisplayTime held local time.
+# Returns $null for "not set" (1601-01-01), e.g. EndTime while a backup is running.
+function Get-JobTimeUtc($Job, [string]$Field) {
+    $value = Get-FirstValue $Job.JobStatus @($Field)
+    if ($null -eq $value) { return $null }
+    $dt = [datetime]$value
+    if ($dt.Year -le 1900) { return $null }
+    return [datetime]::SpecifyKind($dt, [DateTimeKind]::Utc)
+}
+
+# MARS always includes an ErrorInfo; ErrorCode 0 means no error
+function Test-HasError($ErrorInfo) {
+    if (-not $ErrorInfo) { return $false }
+    $code = Get-FirstValue $ErrorInfo @('ErrorCode')
+    $detailed = Get-FirstValue $ErrorInfo @('DetailedErrorCode')
+    return ($code -and [long]$code -ne 0) -or ($detailed -and [long]$detailed -ne 0)
+}
+
+# DatasourceStatus.Datasource is an object whose DataSourceName is e.g. "E:\" or "System State"
+function Get-DatasourceName($DatasourceStatus) {
+    $ds = Get-FirstValue $DatasourceStatus @('Datasource', 'DataSource')
+    $name = Get-FirstValue $ds @('DataSourceName', 'FriendlyNameDSPS', 'Name')
+    if ($name) { return [string]$name }
+    if ($ds -is [string]) { return $ds }
+    return 'Datasource'
+}
+
+function Get-FailedFiles($Job) {
+    $sum = [long]0
+    foreach ($ds in Get-DatasourceStatuses $Job) {
+        $value = Get-FirstValue (Get-FirstValue $ds @('FileProgress')) @('Failed')
+        if ($value) { $sum += [long]$value }
+    }
+    return $sum
+}
+
+function Get-JobStatus($Job) {
+    $status = $Job.JobStatus
+    $state = [string](Get-FirstValue $status @('JobState', 'State'))
+    if (-not (Get-JobTimeUtc $Job 'EndTime') -and $state -notmatch 'Fail|Abort|Cancel|Complete|Success|Succeed|Warn') {
+        return 'running'
+    }
+    if ($state -match 'Fail') { return 'failed' }
+    if ($state -match 'Warn|Abort|Cancel|Stop') { return 'warning' }
+    if ($state -match 'Complete|Success|Succeed') {
+        # MARS can report Completed while individual files failed or an error was recorded
+        if ((Get-FailedBytes $Job) -gt 0 -or (Get-FailedFiles $Job) -gt 0 -or
+            (Test-HasError (Get-FirstValue $status @('ErrorInfo')))) { return 'warning' }
+        return 'success'
+    }
+    return 'warning'  # finished in a state we don't recognise: surface it rather than hide it
+}
+
+function Get-DatasourceStatuses($Job) {
+    return @(Get-FirstValue $Job.JobStatus @('DatasourceStatus', 'DataSourceStatus') | Where-Object { $_ })
+}
+
+function Get-ByteTotal($Job, [string]$Field) {
+    $sum = [long]0
+    foreach ($ds in Get-DatasourceStatuses $Job) {
+        $progress = Get-FirstValue $ds @('ByteProgress')
+        $value = Get-FirstValue $progress @($Field)
+        if ($value) { $sum += [long]$value }
+    }
+    return $sum
+}
+
+function Get-FailedBytes($Job) { return Get-ByteTotal $Job 'Failed' }
+
+function Format-ErrorInfo($ErrorInfo) {
+    if (-not (Test-HasError $ErrorInfo)) { return $null }
+    $text = Get-FirstValue $ErrorInfo @('ErrorMessage', 'Message', 'Description')
+    if ($text) { return ([string]$text).Trim() }
+    $code = Get-FirstValue $ErrorInfo @('ErrorCode', 'DetailedErrorCode')
+    $params = @(Get-FirstValue $ErrorInfo @('ErrorParamList') | Where-Object { $_ } | ForEach-Object {
+        $name = Get-FirstValue $_ @('Name')
+        $value = Get-FirstValue $_ @('Value')
+        if ($name) { "$name=$value" } else { [string]$_ }
+    } | Where-Object { $_ })
+    $line = if ($code) { "Error code $code" } else { [string]$ErrorInfo }
+    if ($params.Count) { $line += " ($($params -join ', '))" }
+    return $line
+}
+
+function Get-RunMessage($Job, [string]$Status) {
+    $lines = New-Object 'System.Collections.Generic.List[string]'
+    $state = [string](Get-FirstValue $Job.JobStatus @('JobState', 'State'))
+    $jobError = Format-ErrorInfo (Get-FirstValue $Job.JobStatus @('ErrorInfo'))
+    if ($jobError) { $lines.Add($jobError) }
+
+    foreach ($ds in Get-DatasourceStatuses $Job) {
+        $name = Get-DatasourceName $ds
+        $dsError = Format-ErrorInfo (Get-FirstValue $ds @('ErrorInfo'))
+        $failedFiles = Get-FirstValue (Get-FirstValue $ds @('FileProgress')) @('Failed')
+        $failedBytes = Get-FirstValue (Get-FirstValue $ds @('ByteProgress')) @('Failed')
+        if ($dsError) { $lines.Add("${name}: $dsError") }
+        if ($failedFiles -and [long]$failedFiles -gt 0) { $lines.Add("${name}: $failedFiles file(s) failed to back up") }
+        elseif ($failedBytes -and [long]$failedBytes -gt 0) { $lines.Add("${name}: $failedBytes bytes failed to back up") }
+    }
+    $failedLog = Get-FirstValue $Job.JobStatus @('FailedFileLog')
+    if ($failedLog -and $lines.Count) { $lines.Add("Failed file log: $failedLog") }
+
+    if ($lines.Count -eq 0) {
+        switch ($Status) {
+            'success' { return 'Backup completed successfully.' }
+            'running' { return '' }
+            default   { return "Backup finished with state '$state'." }
+        }
+    }
+    if ($state -and $Status -ne 'success') { $lines.Insert(0, "Job state: $state") }
+    return ($lines -join "`n")
+}
+
+function ConvertTo-Run($Job) {
+    $status = Get-JobStatus $Job
+    $datasources = @(Get-DatasourceStatuses $Job | ForEach-Object { Get-DatasourceName $_ })
+
+    $details = [ordered]@{ server = $env:COMPUTERNAME }
+    if ($datasources.Count) { $details.datasources = $datasources }
+    $agentState = Get-FirstValue $Job.JobStatus @('JobState', 'State')
+    if ($agentState) { $details.mars_state = [string]$agentState }
+
+    $run = [ordered]@{
+        external_id = [string]$Job.JobId
+        status      = $status
+        started_at  = ConvertTo-IsoTime (Get-JobTimeUtc $Job 'StartTime')
+        message     = Get-RunMessage $Job $status
+        details     = $details
+    }
+    if ($status -ne 'running') {
+        $finished = ConvertTo-IsoTime (Get-JobTimeUtc $Job 'EndTime')
+        if ($finished) { $run.finished_at = $finished }  # otherwise the API uses receipt time
+        $transferred = Get-ByteTotal $Job 'Progress'
+        if ($transferred -gt 0) { $run.size_bytes = $transferred }
+        $failedBytes = Get-FailedBytes $Job
+        if ($failedBytes -gt 0) { $details.failed_bytes = $failedBytes }
+        $failedFiles = Get-FailedFiles $Job
+        if ($failedFiles -gt 0) { $details.failed_files = $failedFiles }
+    }
+    return $run
+}
+
+function Test-IsBackupJob($Job) {
+    # Get-OBJob also lists restores (JobType Recovery); only backups belong on the dashboard
+    $type = [string](Get-FirstValue $Job @('JobType', 'Type'))
+    return (-not $type) -or $type -match 'Backup'
+}
+
+function Send-Report($Body) {
+    $json = $Body | ConvertTo-Json -Depth 6 -Compress
+    if ($DryRun) {
+        Write-Host $json
+        return
+    }
+    # Send bytes: Windows PowerShell would otherwise encode a string body as Latin-1
+    $params = @{
+        Uri         = "$($Config.ApiUrl.TrimEnd('/'))/api/v1/ingest"
+        Method      = 'Post'
+        Headers     = @{ Authorization = "Bearer $($Config.ApiKey)" }
+        ContentType = 'application/json; charset=utf-8'
+        Body        = [Text.Encoding]::UTF8.GetBytes($json)
+        TimeoutSec  = 30
+    }
+    Invoke-RestMethod @params | Out-Null
+}
+
+# ---------- Main ----------
+
+try {
+    $Config = Get-Content -Path $ConfigPath -Raw | ConvertFrom-Json
+    foreach ($key in 'ApiUrl', 'ApiKey', 'Tenant') {
+        if (-not $Config.$key) { throw "Config $ConfigPath is missing '$key'" }
+    }
+    $SourceSystem = if ($Config.SourceSystem) { [string]$Config.SourceSystem } else { 'Azure Backup (MARS)' }
+    $JobName = if ($Config.JobName) { [string]$Config.JobName } else { "$env:COMPUTERNAME - Azure Backup" }
+    if ($LookbackHours -le 0) {
+        $LookbackHours = if ($Config.LookbackHours) { [int]$Config.LookbackHours } else { 48 }
+    }
+
+    # Windows PowerShell 5.1 may default to TLS 1.0
+    [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+
+    Import-Mars
+
+    # Job ID -> start time (Unix seconds), for jobs already delivered in their final state
+    $sent = @{}
+    if (Test-Path $StatePath) {
+        $saved = Get-Content -Path $StatePath -Raw | ConvertFrom-Json
+        if ($saved) { foreach ($p in $saved.PSObject.Properties) { $sent[$p.Name] = [long]$p.Value } }
+    }
+
+    $sinceUtc = (Get-Date).ToUniversalTime().AddHours(-$LookbackHours)
+    # Get-OBJob with no arguments lists jobs in progress; -Previous lists finished ones
+    $jobs = @(@(Get-OBJob) + @(Get-OBJob -Previous $MaxPreviousJobs) | Where-Object {
+        $_ -and (Test-IsBackupJob $_)
+    })
+    $byId = [ordered]@{}
+    foreach ($job in $jobs) {
+        $start = Get-JobTimeUtc $job 'StartTime'
+        if (-not $start -or $start -lt $sinceUtc) { continue }
+        $byId[[string]$job.JobId] = $job  # a job in both lists: the finished entry (later) wins
+    }
+    $pending = @($byId.Values |
+        Where-Object { -not $sent.ContainsKey([string]$_.JobId) } |
+        Sort-Object { Get-JobTimeUtc $_ 'StartTime' })
+
+    $jobInfo = [ordered]@{
+        # Stable per server, so renaming the dashboard job via JobName doesn't create a new one
+        external_id = "mars:$($env:COMPUTERNAME.ToLowerInvariant())"
+        name        = $JobName
+        # Always sent (null when unscheduled) so the dashboard's value tracks the agent's
+        next_run_at = Get-NextRun
+    }
+} catch {
+    Write-Log "Collector setup failed: $(Get-ErrorText $_)" 'ERROR'
+    exit 2
+}
+
+$failures = 0
+$runsSent = 0
+try {
+    if ($pending.Count -eq 0) {
+        # Keep next_run_at fresh even when nothing new ran
+        Send-Report ([ordered]@{ tenant = $Config.Tenant; source_system = $SourceSystem; job = $jobInfo })
+    }
+    foreach ($job in $pending) {
+        $run = ConvertTo-Run $job
+        Send-Report ([ordered]@{ tenant = $Config.Tenant; source_system = $SourceSystem; job = $jobInfo; run = $run })
+        $runsSent++
+        if ($run.status -ne 'running') {
+            $sent[$run.external_id] = ([DateTimeOffset](Get-JobTimeUtc $job 'StartTime')).ToUnixTimeSeconds()
+        }
+    }
+} catch {
+    $failures++
+    Write-Log "Failed to report: $(Get-ErrorText $_)" 'ERROR'
+}
+
+if (-not $DryRun) {
+    # Forget jobs that have aged out of the lookback window (plus a day of slack)
+    $cutoff = [DateTimeOffset]::Now.AddHours(-$LookbackHours - 24).ToUnixTimeSeconds()
+    $keep = [ordered]@{}
+    foreach ($id in $sent.Keys) {
+        if ($sent[$id] -ge $cutoff) { $keep[$id] = $sent[$id] }
+    }
+    try {
+        $keep | ConvertTo-Json -Compress | Set-Content -Path $StatePath -Encoding UTF8
+    } catch {
+        Write-Log "Couldn't save state file: $(Get-ErrorText $_)" 'WARN'
+    }
+}
+
+Write-Log ("Reported {0} runs, {1} failures" -f $runsSent, $failures)
+if ($failures) { exit 1 }

collectors/mars/tests/MockMars.ps1

@@ -0,0 +1,78 @@
+# Stand-ins for the MARS agent cmdlets. Object shapes follow Get-MarsCollectorDiagnostics.ps1
+# output from a real agent (2.0.9274): job times are UTC values with no UTC marking, "not set" is
+# 1601-01-01, ErrorInfo is always present (ErrorCode 0 = no error), Datasource is an object, and
+# schedule times are TimeSpans.
+#
+#   . ./tests/MockMars.ps1
+#   ./Send-MarsBackupStatus.ps1 -ConfigPath ./my-test-config.json -DryRun
+
+# Fixed to the top of the hour, and IDs derived from times, so repeated runs see the same jobs
+$now = Get-Date -Minute 0 -Second 0 -Millisecond 0
+$notSet = [datetime]::new(1601, 1, 1)
+function New-StableGuid([string]$Seed) {
+    [guid]::new([Security.Cryptography.MD5]::Create().ComputeHash([Text.Encoding]::UTF8.GetBytes($Seed)))
+}
+
+# Local time -> the UTC value MARS reports, with Kind Unspecified like the real objects
+function ConvertTo-MarsTime([datetime]$Local) {
+    [datetime]::SpecifyKind($Local.ToUniversalTime(), [DateTimeKind]::Unspecified)
+}
+
+function New-MockErrorInfo([int]$Code = 0, $Params = @()) {
+    [pscustomobject]@{ DetailedErrorCode = 0; DetailedErrorSource = $null; ErrorCode = $Code; ErrorParamList = $Params }
+}
+
+function New-MockDatasource($Name, [uint64]$Done, [uint64]$FailedBytes = 0, [uint64]$FailedFiles = 0, $ErrorInfo = (New-MockErrorInfo)) {
+    [pscustomobject]@{
+        ByteProgress = [pscustomobject]@{ Changed = $Done; Failed = $FailedBytes; Progress = $Done; Total = 2TB }
+        Datasource   = [pscustomobject]@{ DataSourceName = $Name; DataSourceId = 6310158806455554328 }
+        ErrorInfo    = $ErrorInfo
+        FileProgress = [pscustomobject]@{ Changed = 100; CurrentFile = ''; Failed = $FailedFiles; Progress = 100; Total = 100 }
+        JobState     = 'Completed'
+    }
+}
+
+function New-MockJob($Type, [datetime]$Start, $End, $State, $Datasources = @(), $ErrorInfo = (New-MockErrorInfo), $FailedFileLog = '') {
+    $endValue = if ($End) { ConvertTo-MarsTime $End } else { $notSet }
+    [pscustomobject]@{
+        IsRetried   = $false
+        JobId       = New-StableGuid "$Type|$($Start.Ticks)"
+        JobType     = $Type
+        DisplayTime = $Start  # the only local time on the object
+        JobStatus   = [pscustomobject]@{
+            DatasourceStatus = $Datasources
+            EndTime          = $endValue
+            ErrorInfo        = $ErrorInfo
+            FailedFileLog    = $FailedFileLog
+            JobState         = $State
+            StartTime        = ConvertTo-MarsTime $Start
+        }
+    }
+}
+
+$global:MockMarsRunning = @(
+    (New-MockJob 'Backup' $now.AddMinutes(-10) $null 'InProgress' @((New-MockDatasource 'E:\' 2GB)))
+)
+$global:MockMarsPrevious = @(
+    (New-MockJob 'Backup' $now.AddHours(-12) $now.AddHours(-11.5) 'Completed' @((New-MockDatasource 'E:\' 523407872))),
+    # Completed, but some files failed
+    (New-MockJob 'Backup' $now.AddHours(-36) $now.AddHours(-35) 'Completed' @(
+        (New-MockDatasource 'E:\' 3GB 40MB 12)) -FailedFileLog 'C:\Program Files\Microsoft Azure Recovery Services Agent\Temp\Errors.log'),
+    (New-MockJob 'Backup' $now.AddHours(-30) $now.AddHours(-29.5) 'Failed' @() `
+        (New-MockErrorInfo 100050 @([pscustomobject]@{ Name = 'Volume'; Value = 'E:' }))),
+    (New-MockJob 'Recovery' $now.AddHours(-5) $now.AddHours(-4) 'Completed'),  # a restore: must be ignored
+    (New-MockJob 'Backup' $now.AddDays(-5) $now.AddDays(-5).AddHours(1) 'Completed')  # outside 48h lookback
+)
+
+# Every day at 21:00 local, as on the real server
+$global:MockMarsSchedule = [pscustomobject]@{
+    ScheduleRunDays         = [DayOfWeek[]](0..6)
+    ScheduleRunTimes        = [timespan[]]@([timespan]::FromHours(21))
+    ScheduleWeeklyFrequency = 1
+    TypeOfBackupSchedule    = 'Daily'
+}
+
+function Get-OBJob { param([int]$Previous) if ($PSBoundParameters.ContainsKey('Previous')) { $global:MockMarsPrevious } else { $global:MockMarsRunning } }
+function Get-OBPolicy { [pscustomobject]@{ PolicyName = 'policy'; BackupSchedule = $global:MockMarsSchedule } }
+function Get-OBSchedule { param($Policy) $global:MockMarsSchedule }
+function Get-OBSystemStatePolicy { $null }  # none configured, as on the real server

collectors/veeam/Install-VeeamCollector.ps1

@@ -22,7 +22,7 @@ param(
     [Parameter(Mandatory)][string]$ApiUrl,
     [Parameter(Mandatory)][string]$Tenant,
     [string]$SourceSystem = 'Veeam B&R',
-    [ValidateRange(5, 1440)][int]$IntervalMinutes = 15,
+    [ValidateRange(5, 1440)][int]$IntervalMinutes = 60,
     [ValidateRange(1, 720)][int]$LookbackHours = 48,
     [string]$InstallDir = (Join-Path $env:ProgramFiles 'BackupDashboard'),
     # Defaults to the machine-wide PowerShell 7 install

collectors/veeam/README.md

@@ -5,19 +5,25 @@ It covers jobs returned by `Get-VBRJob`: VM backup, replication and backup copy
 
 ## Install (on the VBR server, as an administrator)
 
+Requires PowerShell 7 installed machine-wide (`winget install Microsoft.PowerShell` or the MSI),
+which VBR 13's Veeam module expects. The Microsoft Store version won't work, because the SYSTEM
+account can't run it. The installer checks for this before changing anything.
+
 1. On the dashboard host, create a key for this server:
    ```bash
    python manage.py create-key veeam-acme
    ```
-2. Copy this folder to the VBR server and run:
+2. Copy this folder to the VBR server and run, from PowerShell 7 (`pwsh`):
    ```powershell
    .\Install-VeeamCollector.ps1 -ApiUrl https://backups.example.com -Tenant "Acme Corp"
    ```
    It prompts for the key, then:
    - writes `C:\ProgramData\BackupDashboard\veeam-collector.json` (readable only by SYSTEM and Administrators)
    - copies the script to `C:\Program Files\BackupDashboard\`
-   - registers the scheduled task **Backup Dashboard - Veeam collector** (SYSTEM, every 15 minutes)
-3. Preview the payloads, then backfill 30 days so the history view is populated straight away:
+   - registers the scheduled task **Backup Dashboard - Veeam collector** (SYSTEM, every 60 minutes,
+     run by `C:\Program Files\PowerShell\7\pwsh.exe`; use `-PwshPath` if it's installed elsewhere)
+3. Preview the payloads, then backfill 30 days so the history view is populated straight away
+   (from `pwsh`):
    ```powershell
    & 'C:\Program Files\BackupDashboard\Send-VeeamBackupStatus.ps1' -DryRun
    & 'C:\Program Files\BackupDashboard\Send-VeeamBackupStatus.ps1' -LookbackHours 720
@@ -38,6 +44,10 @@ delete the scheduled task and both `BackupDashboard` folders.
 | Message | Session reason, each VM or object that didn't succeed, and warning/error lines from the session log |
 | Size | `BackupStats.BackupSize` |
 
+**Backup copy jobs (VBR 12+):** Veeam records their sessions under hidden per-source "worker" jobs.
+The collector files each worker session under its copy job (via the worker's `PolicyJobId`), so a
+copy job gets one run per source job it copies, with the source in `copied_from`.
+
 Each run covers the last 48 hours (`LookbackHours`), so a few missed runs (server rebooting, API
 down) fill in automatically. Sessions already delivered are recorded in
 `veeam-collector.state.json`. Running sessions are re-sent until they finish.
@@ -48,6 +58,9 @@ down) fill in automatically. Sessions already delivered are recorded in
 - Exit codes: `0` OK, `1` some jobs failed to send (they're retried next run), `2` setup failed
   (config, Veeam module, or Veeam connection).
 - `API key rejected`: the key was revoked or mistyped. Re-run the installer with a new key.
+- A job shows **Unknown** on the dashboard: the collector sent the job but matched no sessions to it.
+  Run `.\Get-VeeamCollectorDiagnostics.ps1` (read-only). It lists sessions whose job ID matches no
+  job, plus the type and link properties of the jobs left without sessions.
 - `Get-VBRBackupSession` loads every session in the VBR database. On a server with years of history,
   this can make each run take a minute or more. The task's 30-minute limit and "don't start if
   already running" setting keep that safe.

collectors/veeam/Send-VeeamBackupStatus.ps1

@@ -3,7 +3,7 @@
     Reports Veeam Backup & Replication job results to the Backup Dashboard.
 
 .DESCRIPTION
-    Runs on the VBR server, normally as a SYSTEM scheduled task every 15 minutes
+    Runs on the VBR server, normally as a SYSTEM scheduled task every 60 minutes
     (see Install-VeeamCollector.ps1). For every backup, replica and backup copy job it sends:
       - the job's next scheduled run (drives the dashboard's Overdue flag), and
       - every session from the last LookbackHours that the dashboard hasn't already received

deploy/backup-dashboard-api.service

@@ -6,8 +6,8 @@ After=network.target
 User=backupdash
 Group=backupdash
 WorkingDirectory=/opt/backup-dashboard/backend
-Environment=BACKUP_DASH_DB=/var/lib/backup-dashboard/backup-dashboard.db
-Environment=BACKUP_DASH_RETENTION_DAYS=90
+# Settings live in this file so manage.py reads exactly the same ones (see deploy/backup-dashboard.env)
+EnvironmentFile=/etc/backup-dashboard/backup-dashboard.env
 # Bound to localhost: only nginx can reach it, so nginx's auth can't be bypassed from outside.
 # One worker is plenty at this scale and keeps SQLite writes simple.
 ExecStart=/opt/backup-dashboard/venv/bin/uvicorn --factory app.main:create_app --host 127.0.0.1 --port 8000 --proxy-headers

deploy/backup-dashboard.env

@@ -0,0 +1,4 @@
+# Install as /etc/backup-dashboard/backup-dashboard.env
+# Read by both the API service and manage.py, so they always use the same database.
+BACKUP_DASH_DB=/var/lib/backup-dashboard/backup-dashboard.db
+BACKUP_DASH_RETENTION_DAYS=90