Forum Discussion

isaac_B's avatar
isaac_B
Copper Contributor
May 31, 2019

Monitor all Azure Backup protected workloads using Log Analytics

Using this article to generate backup reports for all customers

 

https://docs.microsoft.com/en-us/azure/cloud-solution-provider/support/monitor-multiple-customers

 

I am receiving syntax error when search logs with this query-

 

let Events = AzureDiagnostics
| where Category == "AzureBackupReport" ;
Events
| where OperationName == "Job" and JobOperation_s == "Backup"
| project ProtectedServerUniqueId_s, JobStatus_s, Resource, TenantId
| join kind=inner
(
Events
| where OperationName == "ProtectedServer"
| where ProtectedServerFriendlyName_s != ""
| distinct ProtectedServerUniqueId_s, ProtectedServerFriendlyName_s
| project ProtectedServerUniqueId_s, ProtectedServerFriendlyName_s
)
on ProtectedServerUniqueId_s
| project ProtectedServerFriendlyName_s, JobStatus_s, Resource, TenantId
| extend Vault= Resource
| summarize count() by ProtectedServerFriendlyName_s, JobStatus_s, Vault, TenantId

 

 

 

ERROR MESSAGE:

 SYNTAX ERROR
'where' operator: Failed to resolve column or scalar expression named 'ProtectedServerFriendlyName_s' Support id: e2537bf6-0bcc-473c-88bd-f9a0769d7dc8
 
 
 
 
For some tenants it is working fine. How can I get it to send all diagnostic information in the query to the log analytic workspace?
azure monitor
Query Language

2 Replies

  • Meir_Mendelovich's avatar
    Meir_Mendelovich
    Icon for Microsoft rankMicrosoft
    Jun 02, 2019
    Hi,

    This error will occur for customers that haven't reported this kind of log in AzureDiagnostic in the past. This is a unique table in the sense that columns are created only upon getting such data.

    For this reason and for other reasons, we are moving workloads off AzureDiagnostics. Backup will offer new dedicated tables soon.

    Thanks,

    Meir :->