Forum Discussion
amk_19238
Oct 08, 2020Copper Contributor
I need to report on Azure Backup products (MABS, Azure Backup Agent, Azure VM Backup)
I'm having real difficulty with the Kusto language and the relatively undocumented fields used in Azure Monitor. Here is what I'd like to do: I need a simple dashboard that can tell me if I have my ...
Noa Kuperberg
Microsoft
Nov 01, 2020Hi amk_19238,
It depends on how you monitor your backups.
If you're sending logs of Recovery services vaults to Log Analytics, you can analyze them with the queries shared on our GitHub repo.
Another option is to review the AzureDiagnostics table. This query will return all failed jobs:
// Failed backup jobs
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.RECOVERYSERVICES" and Category == "AzureBackupReport"
| where OperationName == "Job" and JobOperation_s == "Backup" and JobStatus_s == "Failed"
| project TimeGenerated, JobUniqueId_g, JobStartDateTime_s, JobOperation_s, JobOperationSubType_s, JobStatus_s , JobFailureCode_s, JobDurationInSecs_s , AdHocOrScheduledJob_s
But since you don't want to spam your teams, this query can list resources that had successful backups over the last 3 days, but not on the last 24 hours:
let LastSuccessfulBackup=
AzureDiagnostics
| where TimeGenerated > ago(3d)
| where ResourceProvider == "MICROSOFT.RECOVERYSERVICES" and Category == "AzureBackupReport"
| where OperationName == "Job" and JobOperation_s == "Backup" and JobStatus_s == "Completed"
| summarize arg_max(TimeGenerated, *) by _ResourceId
| project TimeGenerated, _ResourceId, JobUniqueId_g, JobStartDateTime_s, JobOperation_s, JobOperationSubType_s, JobStatus_s , JobFailureCode_s, JobDurationInSecs_s , AdHocOrScheduledJob_s;
LastSuccessfulBackup
| where TimeGenerated > ago(24h)
| summarize by _ResourceId