Forum Discussion
Azure Backup Report
I think you need to add the filter later:
let Events = AzureDiagnostics | where Category == "AzureBackupReport"; Events | where OperationName == "Job" | where TimeGenerated > ago(30d) | project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s | join kind=inner ( Events | where OperationName == "BackupItem" | distinct BackupItemUniqueId_s, BackupItemFriendlyName_s | project BackupItemUniqueId_s, BackupItemFriendlyName_s ) on BackupItemUniqueId_s | where BackupItemFriendlyName_s in ("CH-DCVM10","FAKEVM0001","FAKE1111") | summarize count() by BackupItemFriendlyName_s, JobStatus_s, JobStartDateTime_s
let Events = AzureDiagnostics | where Category == "AzureBackupReport"; Events
| where OperationName == "Job"
| where TimeGenerated > ago(30d)
| where * has "VT-PRD-CA02"
| project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s
| join kind=inner (Events | where OperationName == "BackupItem"
| distinct BackupItemUniqueId_s, BackupItemFriendlyName_s
| project BackupItemUniqueId_s, BackupItemFriendlyName_s ) on BackupItemUniqueId_s
| project BackupItemFriendlyName_s , JobStatus_s, JobStartDateTime_s
a) Need it for multiple servers
where * has "VT-PRD-CA02" provides me the result for one.
I tried various combinations eg | where BackupItemFriendlyName_s in ("Client1","Client2") etc but that is not giving me any result.
b) need failed and completed status for single report for one server
I think you need to add the filter later:
let Events = AzureDiagnostics | where Category == "AzureBackupReport";
Events
| where OperationName == "Job"
| where TimeGenerated > ago(30d)
| project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s
| join kind=inner
(
Events
| where OperationName == "BackupItem"
| distinct BackupItemUniqueId_s, BackupItemFriendlyName_s
| project BackupItemUniqueId_s, BackupItemFriendlyName_s
) on BackupItemUniqueId_s
| where BackupItemFriendlyName_s in ("CH-DCVM10","FAKEVM0001","FAKE1111")
| summarize count() by BackupItemFriendlyName_s, JobStatus_s, JobStartDateTime_s
CliveWatson Thanks Dear, I really appreciate your response.
is there any possibility to send the failed backup report to email.
For this I'd typically suggest a Playbook to automate the report. Here I show an example of a report that runs at the sane time each week. You could also do a similar task, but creating a Azure Monitor Alert using your query and sending that, when the job finishes. https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview
Step1 – establish a schedule/recurrence (this is a weekly example, runs on Friday)
Step2 – run the KQL (I'm running two separate queries and sending to two different emails - so you can ignore the right-hand parallel branch)
Step 3, email the chart (this will be a JPG)
Kalaimani - adding my reply back to the thread (from a private) so its useful to others. This change displays a column "NewDateTime" which is in the UTC format
let Events = AzureDiagnostics | where Category == "AzureBackupReport"; Events | extend JobOperationSubType_s = columnifexists("JobOperationSubType_s", "") | where OperationName == "Job" and JobOperation_s == "Backup" and JobOperationSubType_s != "Log" and JobOperationSubType_s != "Recovery point_Log" | distinct JobUniqueId_g, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s | project BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s | join kind=leftouter ( Events | where OperationName == "BackupItem" | distinct BackupItemUniqueId_s, BackupItemFriendlyName_s | project BackupItemUniqueId_s , BackupItemFriendlyName_s ) on BackupItemUniqueId_s | project BackupItemFriendlyName_s, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s | extend Vault= Resource | extend dt = todatetime(JobStartDateTime_s) | summarize count() by BackupItemFriendlyName_s, JobStatus_s, Vault, BackupItemUniqueId_s, JobFailureCode_s, NewDateTime=dt, JobStartDateTime_s