Forum Discussion
Azure Backup Report
I think you need to add the filter later:
let Events = AzureDiagnostics | where Category == "AzureBackupReport"; Events | where OperationName == "Job" | where TimeGenerated > ago(30d) | project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s | join kind=inner ( Events | where OperationName == "BackupItem" | distinct BackupItemUniqueId_s, BackupItemFriendlyName_s | project BackupItemUniqueId_s, BackupItemFriendlyName_s ) on BackupItemUniqueId_s | where BackupItemFriendlyName_s in ("CH-DCVM10","FAKEVM0001","FAKE1111") | summarize count() by BackupItemFriendlyName_s, JobStatus_s, JobStartDateTime_s
Azure Backup example queries are here: https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor
Enable the logging here:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-diagnostic-events
Then use the first links to create the reports you need
Thanks
let Events = AzureDiagnostics | where Category == "AzureBackupReport"; Events
| where OperationName == "Job"
| where TimeGenerated > ago(30d)
| where * has "VT-PRD-CA02"
| project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s
| join kind=inner (Events | where OperationName == "BackupItem"
| distinct BackupItemUniqueId_s, BackupItemFriendlyName_s
| project BackupItemUniqueId_s, BackupItemFriendlyName_s ) on BackupItemUniqueId_s
| project BackupItemFriendlyName_s , JobStatus_s, JobStartDateTime_s
a) Need it for multiple servers
where * has "VT-PRD-CA02" provides me the result for one.
I tried various combinations eg | where BackupItemFriendlyName_s in ("Client1","Client2") etc but that is not giving me any result.
b) need failed and completed status for single report for one server
I think you need to add the filter later:
let Events = AzureDiagnostics | where Category == "AzureBackupReport"; Events | where OperationName == "Job" | where TimeGenerated > ago(30d) | project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s | join kind=inner ( Events | where OperationName == "BackupItem" | distinct BackupItemUniqueId_s, BackupItemFriendlyName_s | project BackupItemUniqueId_s, BackupItemFriendlyName_s ) on BackupItemUniqueId_s | where BackupItemFriendlyName_s in ("CH-DCVM10","FAKEVM0001","FAKE1111") | summarize count() by BackupItemFriendlyName_s, JobStatus_s, JobStartDateTime_sCliveWatson Thanks Dear, I really appreciate your response.
is there any possibility to send the failed backup report to email.
For this I'd typically suggest a Playbook to automate the report. Here I show an example of a report that runs at the sane time each week. You could also do a similar task, but creating a Azure Monitor Alert using your query and sending that, when the job finishes. https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview
Step1 – establish a schedule/recurrence (this is a weekly example, runs on Friday)
Step2 – run the KQL (I'm running two separate queries and sending to two different emails - so you can ignore the right-hand parallel branch)
Step 3, email the chart (this will be a JPG)