Forum Discussion

Copper Contributor

Jul 20, 2020

Solved

Query for Azure Backup

Hello All, I'm using the below script to get the backup information, but in this script I can't found were or how can I get the error message, error code and the recommendations message. Can any...

Azure Log Analytics

azure monitor

Lewis-H
Jul 24, 2020
AddonAzureBackupJobs
| where JobOperation=="Backup"
| summarize arg_max(TimeGenerated,*) by JobUniqueId
| where JobStatus=="Completed"
| join kind=inner
(
CoreAzureBackup
| where OperationName == "BackupItem"
| where BackupItemType=="VM" and BackupManagementType=="IaaSVM"
| distinct BackupItemUniqueId, BackupItemFriendlyName
)
on BackupItemUniqueId

I hope this code helps you out.

Lucas Chies

Copper Contributor

Jul 20, 2020

Hello CliveWatson

Tks for your help.

So, all scripts doesn't show the recommendation. I'm trying to find this message on the below screen:

I'm trying use the "RecommendedAction_s", but doesn't show any information.

let Events = AzureDiagnostics 
| where Category == "AzureBackupReport"; Events 
| extend JobOperationSubType_s = columnifexists("JobOperationSubType_s", "") 
| where OperationName == "Job" and JobOperation_s == "Backup" and JobStatus_s == "Failed" and JobOperationSubType_s != "Log" and JobOperationSubType_s != "Recovery point_Log"
| distinct JobUniqueId_g, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s, RecommendedAction_s
| project BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s, RecommendedAction_s

CliveWatson

Former Employee

Jul 22, 2020

Lucas Chies

That is an "Alert" operation so you need to add that. ie.

| where OperationName == "Alert"

Amended query:

let Events = AzureDiagnostics 
| where Category == "AzureBackupReport";
 Events 
| extend JobOperationSubType_s = columnifexists("JobOperationSubType_s", "") 
| where OperationName == "Alert" or  OperationName == "Job" 
        and JobOperation_s == "Backup" and JobStatus_s == "Failed"
        and JobOperationSubType_s !in ("Log","Recovery point_Log")
| distinct JobUniqueId_g, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s, RecommendedAction_s
| project BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s, RecommendedAction_s

GBADARO
Copper Contributor
Jul 24, 2020
CliveWatson

Hi Clive,
I´m trying to achieve the same here. Tested the amended query, but no luck on getting the Error Message or the Recommended Action yet.
Quest continues...