Merge pull request #232369 from AbhishekMallick01/Mar-28-2023-ReportAlert

Backup report and alert - GA

Author: v-regandowner

articles/backup/backup-azure-diagnostic-events.md

@@ -2,7 +2,7 @@
 title: Use diagnostics settings for Recovery Services vaults
 description: 'This article describes how to use the old and new diagnostics events for Azure Backup.'
 ms.topic: conceptual
-ms.date: 10/30/2019
+ms.date: 03/31/2023
 author: jyothisuri
 ms.author: jsuri
 ---
@@ -20,7 +20,6 @@ You can configure diagnostics settings for a Recovery Services vault via the Azu
 Azure Backup provides the following diagnostics events. Each event provides detailed data on a specific set of backup-related artifacts:
 
 * CoreAzureBackup
-* AddonAzureBackupAlerts
 * AddonAzureBackupProtectedInstance
 * AddonAzureBackupJobs
 * AddonAzureBackupPolicy
@@ -38,31 +37,54 @@ You can now use Azure Backup to send vault diagnostics data to dedicated Log Ana
 
 To send your vault diagnostics data to Log Analytics:
 
-1. Go to your vault, and select **Diagnostic Settings**. Select **+ Add Diagnostic Setting**.
-1. Give a name to the diagnostics setting.
-1. Select the **Send to Log Analytics** check box, and select a Log Analytics workspace.
-1. Select **Resource specific** in the toggle, and select the following six events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupAlerts**, **AddonAzureBackupPolicy**, **AddonAzureBackupStorage**, and **AddonAzureBackupProtectedInstance**.
+**Choose a vault type**:
+
+# [Recovery Services vaults](#tab/recovery-services-vaults)
+
+1. Go to your *vault*, and then select **Diagnostic Settings** > **+ Add Diagnostic Setting**.
+1. Provide a name to the *diagnostics setting*.
+1. Select the **Send to Log Analytics** checkbox, and then select a *Log Analytics workspace*.
+1. Select **Resource specific** in the toggle, and select the following five events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupPolicy**, **AddonAzureBackupStorage**, and **AddonAzureBackupProtectedInstance**.
 1. Select **Save**.
 
-   ![Resource-specific mode](./media/backup-azure-diagnostics-events/resource-specific-blade.png)
+   
+
+# [Backup vaults](#tab/backup-vaults)
+
+1. Go to your *vault*, and then select **Diagnostic Settings** > **+ Add Diagnostic Setting**.
+2. Provide a name to the *diagnostics setting*.
+3. Select the **Send to Log Analytics** checkbox, and then select a *Log Analytics workspace*.
+4. Select the following events: **CoreAzureBackup**, **AddonAzureBackupJobs**, **AddonAzureBackupPolicy**, and **AddonAzureBackupProtectedInstance**.
+5. Select **Save**.
+
+   
+
+---
 
 After data flows into the Log Analytics workspace, dedicated tables for each of these events are created in your workspace. You can query any of these tables directly. You can also perform joins or unions between these tables if necessary.
 
 > [!IMPORTANT]
-> The six events, namely, CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupAlerts, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance, are supported *only* in the resource-specific mode in [Backup reports](./configure-reports.md). *If you try to send data for these six events in Azure diagnostics mode, no data will be visible in Backup reports.*
+> The six events, namely, *CoreAzureBackup*, *AddonAzureBackupJobs*, *AddonAzureBackupAlerts*, *AddonAzureBackupPolicy*, *AddonAzureBackupStorage*, and *AddonAzureBackupProtectedInstance*, are supported *only* in the resource-specific mode for Recovery Services vaults in [Backup reports](configure-reports.md). *If you try to send data for these six events in Azure diagnostics mode, no data will appear in Backup reports.*
+>
+> *AddonAzureBackupAlerts* refers to the alerts being generated by the classic alerts solution. As classic alerts solution is on deprecation path in favour of Azure Monitor-based alers, we recommend you not to select the event *AddonAzureBackupAlerts* when configuring diagnostics settings. To send the fired Azure Monitor-based alerts to a destination of your choice, you can create an alert processing rule and action group that routes these alerts to a logic app, webhook, or runbook that in turn sends these alerts to the required destination.
+>
+> For Backup vaults, since information on the frontend size and backup storage consumed are already included in the *CoreAzureBackup* and *AddonAzureBackupProtectedInstances* events (to aid query performance), the *AddonAzureBackupStorage event* isn't applicable for Backup vault, to avoid creation of redundant tables.
 
 ## Legacy event
 
-Traditionally, all backup-related diagnostics data for a vault was contained in a single event called AzureBackupReport. The six events described here are, in essence, a decomposition of all the data contained in AzureBackupReport.
+Traditionally, for Recovery Services vaults, all backup-related diagnostics data for a vault was contained in a single event called AzureBackupReport. The six events described here are, in essence, a decomposition of all the data contained in AzureBackupReport.
 
-Currently, we continue to support the AzureBackupReport event for backward compatibility in cases where users have existing custom queries on this event. Examples are custom log alerts and custom visualizations. *We recommend that you move to the [new events](#diagnostics-events-available-for-azure-backup-users) as early as possible*. The new events:
+Currently, we continue to support the *AzureBackupReport* event for Recovery Services vaults, backward compatibility in cases where you've existing custom queries on this event. For example, custom log alerts and custom visualizations. *We recommend that you move to the [new events](#diagnostics-events-available-for-azure-backup-users) as early as possible*. The new events:
 
 * Make the data much easier to work with in log queries.
 * Provide better discoverability of schemas and their structure.
 * Improve performance across both ingestion latency and query times.
 
 *The legacy event in Azure diagnostics mode will eventually be deprecated. Choosing the new events might help you to avoid complex migrations at a later date*. Our [reporting solution](./configure-reports.md) that uses Log Analytics will also stop supporting data from the legacy event.
 
+> [!NOTE]
+> For Backup vaults, all diagnostics events are sent to the resource-specific tables only; so, you don't need to do any migration for Backup vaults. The following section is specific to Recovery services vaults.
+
 ### Steps to move to new diagnostics settings for a Log Analytics workspace
 
 1. Identify which vaults are sending data to the Log Analytics workspaces by using the legacy event and the subscriptions they belong to. Run the following query in each of your workspaces to identify these vaults and subscriptions.

articles/backup/backup-azure-monitoring-use-azuremonitor.md

@@ -2,7 +2,7 @@
 title: Monitor Azure Backup with Azure Monitor
 description: Monitor Azure Backup workloads and create custom alerts by using Azure Monitor.
 ms.topic: conceptual
-ms.date: 06/04/2019
+ms.date: 04/18/2023
 ms.assetid: 01169af5-7eb0-4cb0-bbdb-c58ac71bf48b
 author: jyothisuri
 ms.author: jsuri
@@ -57,7 +57,11 @@ For more information, see [Create, view, and manage log alerts by using Azure Mo
 
 ### Sample Kusto queries
 
-The default graphs give you Kusto queries for basic scenarios on which you can build alerts. You can also modify the queries to get the data you want to be alerted on. Paste the following sample Kusto queries in the **Logs** page and then create alerts on the queries:
+The default graphs give you Kusto queries for basic scenarios on which you can build alerts. You can also modify the queries to fetch the data you want to be alerted on. Paste the following sample Kusto queries on the **Logs** page, and then create alerts on the queries.
+
+Recovery Services vaults and Backup vaults send data to a common set of tables that are listed in this article. However, there are slight differences in the schema for Recovery Services vaults and Backup vaults ([learn more](backup-azure-monitoring-built-in-monitor.md)). So, this section is split into multiple sub-sections that helps you to use the right queries depending on which workload or vault types you want to query.
+
+#### Queries common across Recovery Services vaults and Backup vaults 
 
 - All successful backup jobs
 
@@ -77,6 +81,8 @@ The default graphs give you Kusto queries for basic scenarios on which you can b
     | where JobStatus=="Failed"
     ````
 
+#### Queries specific to Recovery Services vault workloads
+
 - All successful Azure VM backup jobs
 
     ````Kusto
@@ -147,6 +153,37 @@ The default graphs give you Kusto queries for basic scenarios on which you can b
     | sort by StorageConsumedInMBs desc
     ````
 
+#### Queries specific to Backup vault workloads
+
+- All successful Azure PostgreSQL backup jobs
+
+    ````Kusto
+    AddonAzureBackupJobs
+    | where JobOperation=="Backup"
+    | summarize arg_max(TimeGenerated,*) by JobUniqueId
+	| where DatasourceType == "Microsoft.DBforPostgreSQL/servers/databases"
+    | where JobStatus=="Completed"	
+    ````
+
+- All successful Azure Disk restore jobs
+
+    ````Kusto
+    AddonAzureBackupJobs
+    | where JobOperation == "Restore"
+    | summarize arg_max(TimeGenerated,*) by JobUniqueId
+	| where DatasourceType == "Microsoft.Compute/disks"
+    | where JobStatus=="Completed"	
+    ````
+
+- Backup Storage Consumed per Backup Item
+
+    ````Kusto
+    CoreAzureBackup
+	| where OperationName == "BackupItem"
+	| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId
+	| project BackupItemUniqueId, BackupItemFriendlyName, StorageConsumedInMBs
+	````
+
 ### Diagnostic data update frequency
 
 The diagnostic data from the vault is pumped to the Log Analytics workspace with some lag. Every event arrives at the Log Analytics workspace *20 to 30 minutes* after it's pushed from the Recovery Services vault. Here are further details about the lag: