Home

Monitor all Azure Backup protected workloads using Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-661518%22%20slang%3D%22en-US%22%3EMonitor%20all%20Azure%20Backup%20protected%20workloads%20using%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-661518%22%20slang%3D%22en-US%22%3E%3CP%3EUsing%20this%20article%20to%20generate%20backup%20reports%20for%20all%20customers%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fcloud-solution-provider%2Fsupport%2Fmonitor-multiple-customers%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fcloud-solution-provider%2Fsupport%2Fmonitor-multiple-customers%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20receiving%20syntax%20error%20when%20search%20logs%20with%20this%20query-%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20Events%20%3D%20AzureDiagnostics%3CBR%20%2F%3E%7C%20where%20Category%20%3D%3D%20%22AzureBackupReport%22%20%3B%3CBR%20%2F%3EEvents%3CBR%20%2F%3E%7C%20where%20OperationName%20%3D%3D%20%22Job%22%20and%20JobOperation_s%20%3D%3D%20%22Backup%22%3CBR%20%2F%3E%7C%20project%20ProtectedServerUniqueId_s%2C%20JobStatus_s%2C%20Resource%2C%20TenantId%3CBR%20%2F%3E%7C%20join%20kind%3Dinner%3CBR%20%2F%3E(%3CBR%20%2F%3EEvents%3CBR%20%2F%3E%7C%20where%20OperationName%20%3D%3D%20%22ProtectedServer%22%3CBR%20%2F%3E%7C%20where%20ProtectedServerFriendlyName_s%20!%3D%20%22%22%3CBR%20%2F%3E%7C%20distinct%20ProtectedServerUniqueId_s%2C%20ProtectedServerFriendlyName_s%3CBR%20%2F%3E%7C%20project%20ProtectedServerUniqueId_s%2C%20ProtectedServerFriendlyName_s%3CBR%20%2F%3E)%3CBR%20%2F%3Eon%20ProtectedServerUniqueId_s%3CBR%20%2F%3E%7C%20project%20ProtectedServerFriendlyName_s%2C%20JobStatus_s%2C%20Resource%2C%20TenantId%3CBR%20%2F%3E%7C%20extend%20Vault%3D%20Resource%3CBR%20%2F%3E%7C%20summarize%20count()%20by%20ProtectedServerFriendlyName_s%2C%20JobStatus_s%2C%20Vault%2C%20TenantId%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EERROR%20MESSAGE%3A%3C%2FP%3E%3CDIV%20class%3D%22header-block%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22ai-tip-tests-error-message%20ng-binding%22%3ESYNTAX%20ERROR%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3E'where'%20operator%3A%20Failed%20to%20resolve%20column%20or%20scalar%20expression%20named%20'ProtectedServerFriendlyName_s'%20Support%20id%3A%20e2537bf6-0bcc-473c-88bd-f9a0769d7dc8%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3EFor%20some%20tenants%20it%20is%20working%20fine.%20How%20can%20I%20get%20it%20to%20send%20all%20diagnostic%20information%20in%20the%20query%20to%20the%20log%20analytic%20workspace%3F%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-661518%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Backup%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-663351%22%20slang%3D%22en-US%22%3ERe%3A%20Monitor%20all%20Azure%20Backup%20protected%20workloads%20using%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-663351%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3EThis%20error%20will%20occur%20for%20customers%20that%20haven't%20reported%20this%20kind%20of%20log%20in%20AzureDiagnostic%20in%20the%20past.%20This%20is%20a%20unique%20table%20in%20the%20sense%20that%20columns%20are%20created%20only%20upon%20getting%20such%20data.%3CBR%20%2F%3E%3CBR%20%2F%3EFor%20this%20reason%20and%20for%20other%20reasons%2C%20we%20are%20moving%20workloads%20off%20AzureDiagnostics.%20Backup%20will%20offer%20new%20dedicated%20tables%20soon.%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%2C%3CBR%20%2F%3E%3CBR%20%2F%3EMeir%20%3A%26gt%3B%3C%2Fimg%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-663667%22%20slang%3D%22en-US%22%3ERe%3A%20Monitor%20all%20Azure%20Backup%20protected%20workloads%20using%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-663667%22%20slang%3D%22en-US%22%3E%3CP%3Ehello%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F352798%22%20target%3D%22_blank%22%3E%40isaac_B%3C%2FA%3E%20%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20depends%20on%20the%20workloads%20protected%20using%20AzureBackup.%3C%2FP%3E%0A%3CP%3EProtected%20Server%20table%20will%20not%20be%20present%20for%20subscriptions%20if%20it%20has%20ONLY%20DPM%20and%20AzureSQL.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20would%20suggest%20to%20look%20at%20the%20link%20for%20monitoring%20azure%20backup%20workloads.%20The%20link%20also%20has%20details%20about%20template%20which%20shows%20basic%20widgets%20on%20monitoring%20jobs%2C%20alerts%2C%20active%20backup%20items.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fbackup%2Fbackup-azure-monitoring-use-azuremonitor%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fbackup%2Fbackup-azure-monitoring-use-azuremonitor%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EThanks.%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
isaac_B
Occasional Visitor

Using this article to generate backup reports for all customers

 

https://docs.microsoft.com/en-us/azure/cloud-solution-provider/support/monitor-multiple-customers

 

I am receiving syntax error when search logs with this query-

 

let Events = AzureDiagnostics
| where Category == "AzureBackupReport" ;
Events
| where OperationName == "Job" and JobOperation_s == "Backup"
| project ProtectedServerUniqueId_s, JobStatus_s, Resource, TenantId
| join kind=inner
(
Events
| where OperationName == "ProtectedServer"
| where ProtectedServerFriendlyName_s != ""
| distinct ProtectedServerUniqueId_s, ProtectedServerFriendlyName_s
| project ProtectedServerUniqueId_s, ProtectedServerFriendlyName_s
)
on ProtectedServerUniqueId_s
| project ProtectedServerFriendlyName_s, JobStatus_s, Resource, TenantId
| extend Vault= Resource
| summarize count() by ProtectedServerFriendlyName_s, JobStatus_s, Vault, TenantId

 

 

 

ERROR MESSAGE:

 SYNTAX ERROR
'where' operator: Failed to resolve column or scalar expression named 'ProtectedServerFriendlyName_s' Support id: e2537bf6-0bcc-473c-88bd-f9a0769d7dc8
 
 
 
 
For some tenants it is working fine. How can I get it to send all diagnostic information in the query to the log analytic workspace?
2 Replies
Hi,

This error will occur for customers that haven't reported this kind of log in AzureDiagnostic in the past. This is a unique table in the sense that columns are created only upon getting such data.

For this reason and for other reasons, we are moving workloads off AzureDiagnostics. Backup will offer new dedicated tables soon.

Thanks,

Meir :>

hello @isaac_B ,

 

It depends on the workloads protected using AzureBackup.

Protected Server table will not be present for subscriptions if it has ONLY DPM and AzureSQL.

I would suggest to look at the link for monitoring azure backup workloads. The link also has details about template which shows basic widgets on monitoring jobs, alerts, active backup items.

 

https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor

 

Thanks.