SOLVED
Home

Alert on Backup Jobs

%3CLINGO-SUB%20id%3D%22lingo-sub-268165%22%20slang%3D%22en-US%22%3EAlert%20on%20Backup%20Jobs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-268165%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20want%20to%20generate%20alert%20when%20backup%20job%20is%20running%20more%20than%203%20hours.%20But%20not%20sure%20how%20to%20Create%20this%20but%20I%20am%20sure%20we%20can%20create%20this%20since%20when%20I%20are%20running%20below%20query.%20We%20have%26nbsp%3B%3CEM%3E%3CSTRONG%3EJobDurationInSecs_s%3C%2FSTRONG%3E%3C%2FEM%3E%26nbsp%3B(in%20seconds)%20in%20output.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20tried%20to%20generate%20alert%20using%20below%20query%20but%20not%20able%20to%20run%20this.%20Pleas%20let%20me%20know%20how%20I%20can%20do%20this%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAzureDiagnostics%3CBR%20%2F%3E%7C%20where%20Category%20%3D%3D%20%22AzureBackupReport%22%3C%2FP%3E%3CP%3E%7C%20where%26nbsp%3BJobDurationInSecs_s%20%26gt%3B%3D%20140000%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance%20for%20the%20help%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-268165%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-269601%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20on%20Backup%20Jobs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-269601%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20see%20by%20the%20name%20of%20the%20column%20that%20it%20is%20a%20string.%26nbsp%3B%20The%20%22_s%22%20suffix%20tells%20you%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eto%20convert%20it%20to%20a%20double%20for%20comparison%20call%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Ftodoublefunction%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Etodouble%20%3C%2FA%3Efunction.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3EAzureDiagnostics%20%7C%20where%20Category%20%3D%3D%20'AzureBackupReport'%20%7C%20where%20OperationName%20%3D%3D%20'Job'%3CBR%20%2F%3E%7C%20where%20%3CSTRONG%3Etodouble%3C%2FSTRONG%3E(JobDurationInSecs_s)%20%26gt%3B%3D%2033641.4%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-268584%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20on%20Backup%20Jobs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-268584%22%20slang%3D%22en-US%22%3E%3CP%3Eohhh..Sorry%20Sir%2C%20It%20was%20a%20typo.%20My%20Bad%20%3Ap%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20tried%20two%20queries.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFirst%20is%20%3A-%3C%2FP%3E%3CP%3E%3CEM%3E%3CSTRONG%3EAzureDiagnostics%20%7C%20where%20Category%20%3D%3D%20'AzureBackupReport'%20%7C%20where%20OperationName%20%3D%3D%20'Job'%20%7C%20where%20JobDurationInSecs_s%20%3D%3D%2033641.4431761%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20is%20running%20and%20generating%20output.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20when%20i%20am%20using%20below%20query%20to%20generate%20alert%20then%20it%20is%20throwing%20an%20error%20message%3C%2FP%3E%3CP%3E%3CEM%3E%3CU%3E%3CSTRONG%3ECannot%20compare%20values%20of%20types%20string%20and%20real.%20Try%20adding%20explicit%20casts.%3C%2FSTRONG%3E%3C%2FU%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3E%3CSTRONG%3EAzureDiagnostics%20%7C%20where%20Category%20%3D%3D%20'AzureBackupReport'%20%7C%20where%20OperationName%20%3D%3D%20'Job'%20%7C%20where%20JobDurationInSecs_s%20%3CU%3E%26gt%3B%3D%3C%2FU%3E33641.4431761%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3E%3CSTRONG%3EI%20used%20%26gt%3B%2C%20gt%2C%20in%20place%20of%20%26gt%3B%3D%20but%20no%20luck%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-268352%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20on%20Backup%20Jobs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-268352%22%20slang%3D%22en-US%22%3E%3CP%3Ethere%20are%2010%2C800%20seconds%20in%203%20hours...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E140%2C000sec%20is%26nbsp%3B%3C%2FSPAN%3E38.89%20days...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Gourav Kumar
Contributor

Hi Team,

 

I want to generate alert when backup job is running more than 3 hours. But not sure how to Create this but I am sure we can create this since when I are running below query. We have JobDurationInSecs_s (in seconds) in output.

 

I tried to generate alert using below query but not able to run this. Pleas let me know how I can do this

 

AzureDiagnostics
| where Category == "AzureBackupReport"

| where JobDurationInSecs_s >= 140000

 

Thanks in advance for the help :)

 

3 Replies

there are 10,800 seconds in 3 hours...

 

140,000sec is 38.89 days...

ohhh..Sorry Sir, It was a typo. My Bad :p

 

I tried two queries.

 

First is :-

AzureDiagnostics | where Category == 'AzureBackupReport' | where OperationName == 'Job' | where JobDurationInSecs_s == 33641.4431761

 

It is running and generating output. 

 

But when i am using below query to generate alert then it is throwing an error message

Cannot compare values of types string and real. Try adding explicit casts.

 

AzureDiagnostics | where Category == 'AzureBackupReport' | where OperationName == 'Job' | where JobDurationInSecs_s >= 33641.4431761

 

I used >, gt, in place of >= but no luck

 

Solution

You can see by the name of the column that it is a string.  The "_s" suffix tells you this.

 

to convert it to a double for comparison call the todouble function.

 

AzureDiagnostics | where Category == 'AzureBackupReport' | where OperationName == 'Job'
| where todouble(JobDurationInSecs_s) >= 33641.4