Backup report and alert - GA

Author: AbhishekMallick01

articles/backup/backup-azure-diagnostic-events.md

@@ -2,7 +2,7 @@
 title: Use diagnostics settings for Recovery Services vaults
 description: 'This article describes how to use the old and new diagnostics events for Azure Backup.'
 ms.topic: conceptual
-ms.date: 10/30/2019
+ms.date: 03/31/2023
 author: jyothisuri
 ms.author: jsuri
 ---
@@ -20,7 +20,6 @@ You can configure diagnostics settings for a Recovery Services vault via the Azu
 Azure Backup provides the following diagnostics events. Each event provides detailed data on a specific set of backup-related artifacts:
 
 * CoreAzureBackup
-* AddonAzureBackupAlerts
 * AddonAzureBackupProtectedInstance
 * AddonAzureBackupJobs
 * AddonAzureBackupPolicy
@@ -38,31 +37,50 @@ You can now use Azure Backup to send vault diagnostics data to dedicated Log Ana
 
 To send your vault diagnostics data to Log Analytics:
 
+**Choose a vault type**:
+
+# [Recovery Services vaults](#tab/recovery-services-vaults)
+
+1. Go to your vault, and select **Diagnostic Settings**. Select **+ Add Diagnostic Setting**.
+2. Give a name to the diagnostics setting.
+3. Select the **Send to Log Analytics** check box, and select a Log Analytics workspace.
+4. Select **Resource specific** in the toggle, and select the following five events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupPolicy**, **AddonAzureBackupStorage**, and **AddonAzureBackupProtectedInstance**.
+5. Select **Save**.
+
+   ![Resource-specific mode](./media/backup-azure-configure-backup-reports/recovery-services-vault-diagnostics-settings.png)
+
+# [Backup vaults](#tab/backup-vaults)
+
 1. Go to your vault, and select **Diagnostic Settings**. Select **+ Add Diagnostic Setting**.
-1. Give a name to the diagnostics setting.
-1. Select the **Send to Log Analytics** check box, and select a Log Analytics workspace.
-1. Select **Resource specific** in the toggle, and select the following six events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupAlerts**, **AddonAzureBackupPolicy**, **AddonAzureBackupStorage**, and **AddonAzureBackupProtectedInstance**.
-1. Select **Save**.
+2. Give a name to the diagnostics setting.
+3. Select the **Send to Log Analytics** check box, and select a Log Analytics workspace.
+4. Select the following events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupPolicy** and **AddonAzureBackupProtectedInstance**.
+5. Select **Save**.
 
-   ![Resource-specific mode](./media/backup-azure-diagnostics-events/resource-specific-blade.png)
+   ![Backup vault diagnostics settings](./media/backup-azure-configure-backup-reports/backup-vault-diagnostics-settings.png)
 
 After data flows into the Log Analytics workspace, dedicated tables for each of these events are created in your workspace. You can query any of these tables directly. You can also perform joins or unions between these tables if necessary.
 
 > [!IMPORTANT]
-> The six events, namely, CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupAlerts, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance, are supported *only* in the resource-specific mode in [Backup reports](./configure-reports.md). *If you try to send data for these six events in Azure diagnostics mode, no data will be visible in Backup reports.*
+> The six events, namely, CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupAlerts, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance, are supported *only* in the resource-specific mode for Recovery Services vaults in [Backup reports](./configure-reports.md). *If you try to send data for these six events in Azure diagnostics mode, no data will be visible in Backup reports.*
+> AddonAzureBackupAlerts refers to the alerts being generated by the classic alerts solution. As classic alerts solution is on deprecation path in favour of Azure Monitor based alers, we recommend you not to select this event AddonAzureBackupAlerts when configuring diagnostics settings. To send the fired Azure Monitor based alerts to a destination of your choice, you can create an alert processing rule and action group that routes these alerts to a logic app, webhook, or runbook that in turn sends these alerts to the required destination.
+> For Backup vaults, since information on the frontend size and backup storage consumed is already included in the CoreAzureBackup and AddonAzureBackupProtectedInstances events (to aid query performance), the AddonAzureBackupStorage event is not applicable for Backup vault, to avoid creation of redundant tables.
 
 ## Legacy event
 
-Traditionally, all backup-related diagnostics data for a vault was contained in a single event called AzureBackupReport. The six events described here are, in essence, a decomposition of all the data contained in AzureBackupReport.
+Traditionally, for Recovery Services vaults, all backup-related diagnostics data for a vault was contained in a single event called AzureBackupReport. The six events described here are, in essence, a decomposition of all the data contained in AzureBackupReport.
 
-Currently, we continue to support the AzureBackupReport event for backward compatibility in cases where users have existing custom queries on this event. Examples are custom log alerts and custom visualizations. *We recommend that you move to the [new events](#diagnostics-events-available-for-azure-backup-users) as early as possible*. The new events:
+Currently, we continue to support the AzureBackupReport event for Recovery Services vaults, backward compatibility in cases where users have existing custom queries on this event. Examples are custom log alerts and custom visualizations. *We recommend that you move to the [new events](#diagnostics-events-available-for-azure-backup-users) as early as possible*. The new events:
 
 * Make the data much easier to work with in log queries.
 * Provide better discoverability of schemas and their structure.
 * Improve performance across both ingestion latency and query times.
 
 *The legacy event in Azure diagnostics mode will eventually be deprecated. Choosing the new events might help you to avoid complex migrations at a later date*. Our [reporting solution](./configure-reports.md) that uses Log Analytics will also stop supporting data from the legacy event.
 
+> [!NOTE]
+> For Backup vaults, all diagnostics events are sent to the resource-specific tables only, and hence you don't need to do any migration for Backup vaults. The below section is specific to Recovery services vaults.
+
 ### Steps to move to new diagnostics settings for a Log Analytics workspace
 
 1. Identify which vaults are sending data to the Log Analytics workspaces by using the legacy event and the subscriptions they belong to. Run the following query in each of your workspaces to identify these vaults and subscriptions.

articles/backup/backup-azure-monitoring-use-azuremonitor.md

@@ -2,7 +2,7 @@
 title: Monitor Azure Backup with Azure Monitor
 description: Monitor Azure Backup workloads and create custom alerts by using Azure Monitor.
 ms.topic: conceptual
-ms.date: 06/04/2019
+ms.date: 03/31/2023
 ms.assetid: 01169af5-7eb0-4cb0-bbdb-c58ac71bf48b
 author: jyothisuri
 ms.author: jsuri
@@ -57,7 +57,11 @@ For more information, see [Create, view, and manage log alerts by using Azure Mo
 
 ### Sample Kusto queries
 
-The default graphs give you Kusto queries for basic scenarios on which you can build alerts. You can also modify the queries to get the data you want to be alerted on. Paste the following sample Kusto queries in the **Logs** page and then create alerts on the queries:
+The default graphs give you Kusto queries for basic scenarios on which you can build alerts. You can also modify the queries to get the data you want to be alerted on. Paste the following sample Kusto queries in the **Logs** page and then create alerts on the queries.
+
+Recovery Services vaults and Backup vaults send data to a common set of tables that are listed in this article. However, there are slight differences in the schema for Recovery Services vaults and Backup vaults (refer [this page](backup-azure-monitoring-built-in-monitor.md) for more details). Hence this section is split into multiple sub-sections, so that you can use the right queries depending on which workload or vault types you are looking to query.
+
+#### Queries common across Recovery Services vaults and Backup vaults 
 
 - All successful backup jobs
 
@@ -77,6 +81,8 @@ The default graphs give you Kusto queries for basic scenarios on which you can b
     | where JobStatus=="Failed"
     ````
 
+#### Queries specific to Recovery Services vault worklods
+
 - All successful Azure VM backup jobs
 
     ````Kusto
@@ -147,6 +153,37 @@ The default graphs give you Kusto queries for basic scenarios on which you can b
     | sort by StorageConsumedInMBs desc
     ````
 
+#### Queries specific to Backup vault worklods
+
+- All successful Azure PostgreSQL backup jobs
+
+    ````Kusto
+    AddonAzureBackupJobs
+    | where JobOperation=="Backup"
+    | summarize arg_max(TimeGenerated,*) by JobUniqueId
+	| where DatasourceType == "Microsoft.DBforPostgreSQL/servers/databases"
+    | where JobStatus=="Completed"	
+    ````
+
+- All successful Azure Disk restore jobs
+
+    ````Kusto
+    AddonAzureBackupJobs
+    | where JobOperation == "Restore"
+    | summarize arg_max(TimeGenerated,*) by JobUniqueId
+	| where DatasourceType == "Microsoft.Compute/disks"
+    | where JobStatus=="Completed"	
+    ````
+
+- Backup Storage Consumed per Backup Item
+
+    ````Kusto
+    CoreAzureBackup
+	| where OperationName == "BackupItem"
+	| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId
+	| project BackupItemUniqueId, BackupItemFriendlyName, StorageConsumedInMBs
+	````
+
 ### Diagnostic data update frequency
 
 The diagnostic data from the vault is pumped to the Log Analytics workspace with some lag. Every event arrives at the Log Analytics workspace *20 to 30 minutes* after it's pushed from the Recovery Services vault. Here are further details about the lag: