You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Using diagnostics settings for Recovery Services Vaults
3
-
description: 'An article describing how to use the old and new diagnostics events for Azure Backup'
2
+
title: Use diagnostics settings for Recovery Services vaults
3
+
description: 'This article describes how to use the old and new diagnostics events for Azure Backup.'
4
4
ms.topic: conceptual
5
5
ms.date: 10/30/2019
6
6
---
7
7
8
-
# Using Diagnostics Settings for Recovery Services Vaults
8
+
# Use diagnostics settings for Recovery Services vaults
9
9
10
-
Azure Backup sends diagnostics events that can be collected and used for the purposes of analysis, alerting and reporting.
10
+
Azure Backup sends diagnostics events that can be collected and used for the purposes of analysis, alerting, and reporting.
11
11
12
-
You can configure diagnostics settings for a Recovery Services Vault via the Azure portal, by navigating to the vault and clicking the **Diagnostic Settings** menu item. Clicking on **+ Add Diagnostic Setting** lets you send one or more diagnostics events to a Storage Account, Event Hub, or a Log Analytics (LA) Workspace.
12
+
You can configure diagnostics settings for a Recovery Services vault via the Azure portal by going to the vault and selecting **Diagnostics settings**. Selecting **+ Add Diagnostic Setting** lets you send one or more diagnostic events to a storage account, an event hub, or a Log Analytics workspace.
## Diagnostics Events Available for Azure Backup Users
16
+
## Diagnostics events available for Azure Backup users
17
17
18
-
Azure Backup provides the following diagnostic events, each of which provides detailed data on a specific set of backup-related artifacts:
18
+
Azure Backup provides the following diagnostics events. Each event provides detailed data on a specific set of backup-related artifacts:
19
19
20
20
* CoreAzureBackup
21
21
* AddonAzureBackupAlerts
@@ -24,40 +24,44 @@ Azure Backup provides the following diagnostic events, each of which provides de
24
24
* AddonAzureBackupPolicy
25
25
* AddonAzureBackupStorage
26
26
27
-
[Data Model for Azure Backup Diagnostics Events](https://docs.microsoft.com/azure/backup/backup-azure-reports-data-model)
27
+
For more information, see [Data model for Azure Backup diagnostics events](https://docs.microsoft.com/azure/backup/backup-azure-reports-data-model).
28
28
29
-
Data for these events can be sent to either a storage account, LA workspace, or an Event Hub. If you are sending this data to an LA Workspace, you need to select the **Resource Specific** toggle in the **Diagnostics Setting** screen (see more information in the sections below).
29
+
Data for these events can be sent to either a storage account, a Log Analytics workspace, or an event hub. If you're sending this data to a Log Analytics workspace, select the **Resource specific** toggle on the **Diagnostics settings** screen. For more information, see the following sections.
30
30
31
-
## Using Diagnostics Settings with Log Analytics (LA)
31
+
## Use diagnostics settings with Log Analytics
32
32
33
-
Aligning with the Azure Log Analytics roadmap, Azure Backup now allows you to send vault diagnostics data to dedicated LA tables for Backup. These are referred to as [Resource Specific tables](https://docs.microsoft.com/azure/azure-monitor/platform/resource-logs-collect-workspace#resource-specific).
33
+
You can now use Azure Backup to send vault diagnostics data to dedicated Log Analytics tables for backup. These tables are called [resource-specific tables](https://docs.microsoft.com/azure/azure-monitor/platform/resource-logs-collect-workspace#resource-specific).
34
34
35
-
To send your vault diagnostics data to LA:
35
+
To send your vault diagnostics data to Log Analytics:
36
36
37
-
1. Navigate to your vault and click on **Diagnostic Settings**. Click**+ Add Diagnostic Setting**.
38
-
2.Give a name to the Diagnostics setting.
39
-
3. Check the box **Send to Log Analytics** and select a Log Analytics Workspace.
40
-
4.Select **Resource Specific** in the toggle and check the following six events - **CoreAzureBackup**, **AddonAzureBackupAlerts**, **AddonAzureBackupProtectedInstance**, **AddonAzureBackupJobs**, **AddonAzureBackupPolicy**, and **AddonAzureBackupStorage**.
41
-
5. Click on**Save**.
37
+
1.Go to your vault, and select **Diagnostic Settings**. Select**+ Add Diagnostic Setting**.
38
+
1.Give a name to the diagnostics setting.
39
+
1. Select the **Send to Log Analytics**check box, and select a Log Analytics workspace.
40
+
1.Select **Resource specific** in the toggle, and select the following six events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupAlerts**, **AddonAzureBackupPolicy**, **AddonAzureBackupStorage**, and **AddonAzureBackupProtectedInstance**.
41
+
1. Select**Save**.
42
42
43
-
Once data flows into the LA Workspace, dedicated tables for each of these events are created in your workspace. You can query any of these tables directly and also perform joins or unions between these tables if necessary.
45
+
After data flows into the Log Analytics workspace, dedicated tables for each of these events are created in your workspace. You can query any of these tables directly. You can also perform joins or unions between these tables if necessary.
46
46
47
47
> [!IMPORTANT]
48
-
> The above six events, namely, CoreAzureBackup, AddonAzureBackupAlerts, AddonAzureBackupProtectedInstance, AddonAzureBackupJobs, AddonAzureBackupPolicy, and AddonAzureBackupStorage, are supported **only** in Resource Specific Mode in [Backup Reports](https://docs.microsoft.com/azure/backup/configure-reports). **Please note that if you try to send data for these six events in Azure Diagnostics Mode, no data will be visible in Backup Reports.**
48
+
> The six events, namely, CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupAlerts, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance, are supported *only* in the resource-specific mode in [Backup reports](https://docs.microsoft.com/azure/backup/configure-reports). *If you try to send data for these six events in Azure diagnostics mode, no data will be visible in Backup reports.*
49
49
50
-
## Legacy Event
50
+
## Legacy event
51
51
52
-
Traditionally, all backup-related diagnostics data for a vault has been contained in a single event called 'AzureBackupReport'. The six events described above are, in essence, a decomposition of all the data contained in AzureBackupReport.
52
+
Traditionally, all backup-related diagnostics data for a vault was contained in a single event called AzureBackupReport. The six events described here are, in essence, a decomposition of all the data contained in AzureBackupReport.
53
53
54
-
Currently, we continue to support the AzureBackupReport event for backward-compatibility, in cases where users have existing custom queries on this event, for example, custom log alerts, custom visualizations etc. However, **we recommend moving to the [new events](https://docs.microsoft.com/azure/backup/backup-azure-diagnostic-events#diagnostics-events-available-for-azure-backup-users) as early as possible**, since this makes the data much easier to work with in log queries, provides better discoverability of schemas and their structure, improves performance across both ingestion latency and query times.
54
+
Currently, we continue to support the AzureBackupReport event for backwardcompatibility in cases where users have existing custom queries on this event. Examples are custom log alerts and custom visualizations. *We recommend that you move to the [new events](https://docs.microsoft.com/azure/backup/backup-azure-diagnostic-events#diagnostics-events-available-for-azure-backup-users) as early as possible*. The new events:
55
55
56
-
**The legacy event in Azure Diagnostics mode will eventually be deprecated and hence choosing the new events may help you to avoid complex migrations at a later date**. Our [reporting solution](https://docs.microsoft.com/azure/backup/configure-reports) that leverages Log Analytics will also stop supporting data from the legacy event.
56
+
- Make the data much easier to work with in log queries.
57
+
- Provide better discoverability of schemas and their structure.
58
+
- Improve performance across both ingestion latency and query times.
57
59
58
-
### Steps to move to new diagnostics settings (to Log Analytics workspace)
60
+
*The legacy event in Azure diagnostics mode will eventually be deprecated. Choosing the new events might help you to avoid complex migrations at a later date*. Our [reporting solution](https://docs.microsoft.com/azure/backup/configure-reports) that uses Log Analytics will also stop supporting data from the legacy event.
59
61
60
-
1. Identify which vaults are sending data to the Log Analytics Workspace(s) using the legacy event, and the subscriptions they belong to. Run the below workspaces to identify these vaults and subscriptions:
62
+
### Steps to move to new diagnostics settings for a Log Analytics workspace
63
+
64
+
1. Identify which vaults are sending data to the Log Analytics workspaces by using the legacy event and the subscriptions they belong to. Run the following workspaces to identify these vaults and subscriptions.
61
65
62
66
````Kusto
63
67
let RangeStart = startofday(ago(3d));
@@ -85,34 +89,34 @@ Currently, we continue to support the AzureBackupReport event for backward-compa
85
89
| project ResourceId, SubscriptionId, VaultName
86
90
````
87
91
88
-
2. Use Azure Backup's [built-in Azure Policy](https://docs.microsoft.com/azure/backup/azure-policy-configure-diagnostics) to add a new diagnostics setting for all vaults in a specified scope. This policy adds a new diagnostics setting to those vaults that either do not have a diagnostics setting (or) have only a legacy diagnostics setting. This policy can be assigned to an entire subscription or resource group at a time. Note that you will need 'Owner' access to each subscription for which the policy is assigned.
92
+
1. Use the [built-in Azure policy](https://docs.microsoft.com/azure/backup/azure-policy-configure-diagnostics) in Azure Backup to add a new diagnostics setting for all vaults in a specified scope. This policy adds a new diagnostics setting to vaults that either don't have a diagnostics setting or have only a legacy diagnostics setting. This policy can be assigned to an entire subscription or resource group at a time. You must have Owner access to each subscription for which the policy is assigned.
89
93
90
-
You may choose to have separate diagnostics settings for AzureBackupReport and the six new events, until you have migrated all of your custom queries to use data from the new tables. The below image shows an example of a vault having two diagnostic settings. The first setting, named **Setting1** sends data of AzureBackupReport event to an LA Workspace in AzureDiagnostics mode. The second setting, named **Setting2** sends data of the six new Azure Backup events to an LA Workspace in Resource Specific mode.
94
+
You might choose to have separate diagnostics settings for AzureBackupReport and the six new events until you have migrated all of your custom queries to use data from the new tables. The following image shows an example of a vault that has two diagnostic settings. The first setting, named **Setting1**, sends data of an AzureBackupReport event to a Log Analytics workspace in Azure diagnostics mode. The second setting, named **Setting2**, sends data of the six new Azure Backup events to a Log Analytics workspace in the resource-specific mode.
> The AzureBackupReport event is supported **only** in Azure Diagnostics Mode. **Please note that if you try to send data for this event in Resource Specific Mode, no data will flow to the LA Workspace.**
99
+
> The AzureBackupReport event is supported *only* in Azure diagnostics mode. *If you try to send data for this event in the resource-specific mode, no data will flow to the Log Analytics workspace.*
96
100
97
101
> [!NOTE]
98
-
> The toggle for Azure Diagnostics / Resource Specific appears only if the user checks **Send to Log Analytics**. To send data to a Storage Account or an Event Hub, a user can simply select the required destination and check any of the desired events, without any additional inputs. Again, it is recommended not to choose the legacy event AzureBackupReport, going forward.
102
+
> The toggle for **Azure diagnostics** or **Resource specific** appears only if the user selects **Send to Log Analytics**. To send data to a storage account or an event hub, a user selects the required destination and selects the check boxes for any of the desired events, without any additional inputs. Again, we recommend that you do not choose the legacy event AzureBackupReport going forward.
99
103
100
-
## Users sending Azure Site Recovery Events to Log Analytics (LA)
104
+
## Send Azure Site Recovery events to Log Analytics
101
105
102
-
Azure Backup and Azure Site Recovery Events are sent from the same Recovery Services Vault. As Azure Site Recovery is currently not onboarded onto Resource Specific tables, users wanting to send Azure Site Recovery Events to LA are directed to use Azure Diagnostics Mode **only** (see image below). **Choosing Resource Specific Mode for the Azure Site Recovery Events will prevent the required data from being sent to the LA Workspace**.
106
+
Azure Backup and Azure Site Recovery events are sent from the same Recovery Services vault. Azure Site Recovery is currently not available for resource-specific tables. Users who want to send Azure Site Recovery events to Log Analytics are directed to use Azure diagnostics mode *only*, as shown in the image. *Choosing the resource-specific mode for Azure Site Recovery events will prevent the required data from being sent to the Log Analytics workspace*.
* If you already have LA diagnostics set up with Azure Diagnostics and have written custom queries on top of it, keep that setting **intact**, until you migrate your queries to use data from the new events.
109
-
* If you also want to onboard onto new tables (as recommended), create a **new** diagnostics setting, choose **Resource Specific** and select the six new events as specified above.
110
-
* If you are currently sending Azure Site Recovery Events to LA, **do not** choose Resource Specific mode for these events, otherwise data for these events will not flow into your LA Workspace. Instead, create an **additional diagnostic setting**, select **Azure Diagnostics**, and choose the relevant Azure Site Recovery events.
112
+
* If you already have Log Analytics diagnostics set up with Azure Diagnostics and have written custom queries on top of it, keep that setting *intact* until you migrate your queries to use data from the new events.
113
+
* If you also want to onboard onto new tables, as we recommend, create a **new** diagnostics setting, select **Resource specific**, and select the six new events.
114
+
* If you're currently sending Azure Site Recovery events to Log Analytics, *do not* choose the resource-specific mode for these events. Otherwise, data for these events won't flow into your Log Analytics workspace. Instead, create an additional diagnostic setting, select **Azure diagnostics**, and select the relevant Azure Site Recovery events.
111
115
112
-
The below image shows an example of a user having three diagnostic settings for a vault. The first setting, named **Setting1** sends data from AzureBackupReport event to an LA Workspace in AzureDiagnostics mode. The second setting, named **Setting2** sends data from the six new Azure Backup events to an LA Workspace in Resource Specific mode. The third setting, named **Setting3**, sends data from the Azure Site Recovery events to an LA Workspace in Azure Diagnostics Mode.
116
+
The following image shows an example of a user who has three diagnostics settings for a vault. The first setting, named **Setting1**, sends data from an AzureBackupReport event to a Log Analytics workspace in Azure diagnostics mode. The second setting, named **Setting2**, sends data from the six new Azure Backup events to a Log Analytics workspace in the resource-specific mode. The third setting, named **Setting3**, sends data from the Azure Site Recovery events to a Log Analytics workspace in Azure diagnostics mode.
0 commit comments