@poddingue Thanks for looking into this! I checked the bulk "Reconnect to all hosts" action as well, and you're right — it doesn't work either. It only works if I select a single SR, open its page, and use the "Reconnect to all hosts" action from there.

FWIW it seems to be the same VMs and same VDIs each day. I'm doing some additional experimentation and testing.

To add some context on our own use case: our standard xo-server logs already go to syslog through [logs.transport.syslog] and on to our central log server, and that works fine. The problem is that a lot of the useful information only exists in the audit log: who did what, which API calls were made, from which IP. Right now that data stays inside XO and we can't correlate it with the rest of our infrastructure. For us it is also a compliance issue. We are subject to PCI-DSS, and Requirement 10 expects administrative actions to be logged, promptly sent to a central log server and reviewed, ideally with automated tools. XO is where our virtualization admin actions happen, so its audit log is exactly the data an auditor wants to see in the SIEM. Having the audit records go through the existing pipeline, as this PR does, would make life much easier: no polling script, no long-lived admin token, and everything ends up in our SIEM in real time. @Team-XO-Backend, a review would be much appreciated.

@zorro So with purge off, Veeam stayed clean for a few nights, which fits what I saw in the lab test. If I read the docs right, the cost is that XO's reference snapshot keeps its data on the SR again, which you'd notice more on thick-provisioned storage: https://docs.xen-orchestra.com/backups-and-dr/backup-types/incremental_backups#purge-snapshot-data-cbt. Storage hasn't said yet whether purge breaking another tool's chain is expected, so I'd still call this a workaround rather than the answer. If a CBT warning comes back when you add the other VMs, the Veeam task id and the time would probably help them. And keeping both makes sense to me, since Veeam doesn't do the cross-site replication you need XO for.

@yannsionneau I don't use Ubuntu, but I have a few linux vm's ranging from Debian 13-14 to RHEL 10 and in all of them the passthrough works fine.