Monitor all Azure Backup protected workloads using Log Analytics

Occasional Visitor

Using this article to generate backup reports for all customers


I am receiving syntax error when search logs with this query-


let Events = AzureDiagnostics
| where Category == "AzureBackupReport" ;
| where OperationName == "Job" and JobOperation_s == "Backup"
| project ProtectedServerUniqueId_s, JobStatus_s, Resource, TenantId
| join kind=inner
| where OperationName == "ProtectedServer"
| where ProtectedServerFriendlyName_s != ""
| distinct ProtectedServerUniqueId_s, ProtectedServerFriendlyName_s
| project ProtectedServerUniqueId_s, ProtectedServerFriendlyName_s
on ProtectedServerUniqueId_s
| project ProtectedServerFriendlyName_s, JobStatus_s, Resource, TenantId
| extend Vault= Resource
| summarize count() by ProtectedServerFriendlyName_s, JobStatus_s, Vault, TenantId





'where' operator: Failed to resolve column or scalar expression named 'ProtectedServerFriendlyName_s' Support id: e2537bf6-0bcc-473c-88bd-f9a0769d7dc8
For some tenants it is working fine. How can I get it to send all diagnostic information in the query to the log analytic workspace?
2 Replies

This error will occur for customers that haven't reported this kind of log in AzureDiagnostic in the past. This is a unique table in the sense that columns are created only upon getting such data.

For this reason and for other reasons, we are moving workloads off AzureDiagnostics. Backup will offer new dedicated tables soon.


Meir :>

hello @isaac_B ,


It depends on the workloads protected using AzureBackup.

Protected Server table will not be present for subscriptions if it has ONLY DPM and AzureSQL.

I would suggest to look at the link for monitoring azure backup workloads. The link also has details about template which shows basic widgets on monitoring jobs, alerts, active backup items.