{"id":7318,"date":"2020-05-01T07:30:11","date_gmt":"2020-05-01T07:30:11","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/create-alerts-for-long-running-backups-on-azure\/"},"modified":"2026-11-03T19:28:36","modified_gmt":"2026-11-03T19:28:36","slug":"create-alerts-for-long-running-backups-on-azure","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/create-alerts-for-long-running-backups-on-azure\/","title":{"rendered":"Create alerts for long-running backups on Azure"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

This post explores how to monitor Microsoft\u00ae Azure\u00ae server backups and, if the backups run long, use Log Analytics to trigger an alert on the servers.<\/p>\n

\nTeaser: The post unveils new features of Azure **Backup Report** and Azure Monitor and offers some fancy Kusto Query Language (KQL) operations.<\/strong><\/em><\/p>\n

Why should you set an alert for long-running server backups?<\/p>\n

DevOps and Azure admin engineers have many virtual machines to manage, routine tasks to perform, and troubleshooting efforts to undertake. You can’t manually check every function on every VM, so you might miss unexpected behavior such as a long-running Azure backup, which can be serious. Automated alerts call problems to your attention.<\/p>\n

To make this topic easy to understand, I am dividing the process into the following three parts:<\/p>\n

    \n
  1. Enable Backup Report<\/strong>.<\/li>\n
  2. Write a KQL query to check long-running server backups.<\/li>\n
  3. Configure an alert for long-running server backups.<\/li>\n<\/ol>\n

    Enable Backup Report<\/strong><\/p>\n

    Note: <\/strong>This post assumes you already use Recovery Services<\/strong> vaults to back up your Azure infrastructure.<\/p>\n

    Use the following steps to enable an Azure Backup report:
    \n <\/p>\n

    1. Log in to the portal <\/strong><\/p>\n

    Log in to the Azure portal, click the All Services blade<\/strong>, and search for Recovery Services vaults<\/strong><\/p>\n

    \"Azure<\/p>\n

    2. Select a vault<\/strong><\/p>\n

    Select one of the recovery service vaults on which to enable the Backup Report <\/strong>and monitor the backup duration.<\/p>\n

    \"azure<\/p>\n

    3. Choose Backup Report<\/strong><\/p>\n

    Click the recovery vault blade, Backup Reports<\/strong>, and click Diagnostics Settings<\/strong>.<\/p>\n

    Note:<\/strong> The preview Backup Reports<\/strong> feature might not be available in some regions.
    \n <\/p>\n

    \"azure<\/p>\n

    4. Configure Backup Report<\/strong><\/p>\n

    To configure the Backup Report<\/strong>, click on Add diagnostic setting<\/strong>.<\/p>\n

     <\/p>\n

    \"azure<\/p>\n

    5. Enable log streaming <\/strong><\/p>\n

    You can stream backup logs to Azure Event Hubs, a storage account, or Log Analytics<\/strong>. In this example, I chose Log Analytics<\/strong>.<\/p>\n

    To enable backup log streaming, fill in the name of the report, check Send to Log Analytics<\/strong>, check AzureBackupReport<\/strong> in the Log<\/strong> section, and click Save<\/strong><\/p>\n

    \"azure<\/p>\n

    .The portal displays your report, as shown in the following image:<\/p>\n

    \"azure<\/p>\n

     KQL query to monitor server backups<\/strong><\/p>\n

    This section introduces the following KQL query for long-running Azure server backups:<\/p>\n

      AzureDiagnostics
    \n    | where TimeGenerated > ago(1d)
    \n    | where Category == \u201cAzureBackupReport\u201d
    \n    | where OperationName == \u201cJob\u201d
    \n    | where todouble(DataTransferredInMB_s)>1
    \n    | extend Report_Running_Time_UTC= TimeGenerated
    \n    | extend Backup_Job_Start_Time = JobStartDateTime_s<\/p>\n

        \/\/ If you want time in AM or PM format and want to make more readable, uncomment the following line by removing \/\/<\/p>\n

        \/\/| where (Backup_Job_Start_Time contains \u201cAM\u201d or Backup_Job_Start_Time contains \u201cPM\u201d)<\/p>\n

     | extend DataTransferedGB = todouble(DataTransferredInMB_s)\/1024
    \n    | extend JobDurationHour = todouble(JobDurationInSecs_s)\/3600
    \n    | where JobDurationHour > 3
    \n    | extend Vault_Name = split(ResourceId, \u2018\/\u2019)[-1]
    \n    | extend Server_Name = split(BackupItemUniqueId_s, \u2018;\u2019)[-1]
    \n    | project Report_Running_Time_UTC, Backup_Job_Start_Time, SubscriptionId, JobOperation_s, JobStatus_s, DataTransferedGB, JobDurationHour, ResourceGroup, Server_Name, Vault_Name, Level<\/p>\n

    In case you’re not familiar with KQL, let me explain the important elements of this query.<\/p>\n

    The query examines the last day of Azure backup data (`where TimeGenerated > ago(1d)`) to find jobs that took longer than three hours to complete (`where JobDurationHour > 3`).<\/p>\n

    You can change the number of hours, which is three in this case, to whatever number you consider to be too long.<\/p>\n

    Configure an alert<\/strong><\/p>\n

    Glad you made it this far…read on for the best part!<\/p>\n

    Use the following steps to set an alert for long-running backups:<\/p>\n

    1. Open Log Search<\/strong>
    \nOpen the Log Search<\/strong> section of the Log Analytics workspace that you selected during the report configuration.<\/p>\n

    2. Paste the KQL query<\/strong><\/p>\n

    Copy and paste the preceding KQL query in the Query<\/strong> tab and click Run<\/strong>.<\/p>\n

    \"Azure<\/p>\n

     Servers that took longer than three hours to complete display, as shown in the following output:<\/p>\n

    \"azure<\/p>\n

    3. Create a new alert <\/strong><\/p>\n

    To set an alert for these servers, click New Alert Rule<\/strong>.<\/p>\n

    \"azure<\/p>\n

    4. Configure the new alert<\/strong><\/p>\n

    Under Condition<\/strong>, enter the threshold value with the count. I chose 1<\/strong> because I want to create an alert on every server and result.<\/p>\n

    Note<\/strong>: You can also change the Period<\/strong> and Frequency<\/strong> of the alert, as needed.<\/p>\n

    \"azure<\/p>\n

    Configure other alert requirements, such as alert name, action group (email, recipient), webhooks, and other conditions. <\/p>\n

    Conclusion<\/strong><\/p>\n

    That\u2019s all there is to it. This post showed you how to configure an alert on Azure VM backups that take longer than three hours. The alert sends a notification email with all the details. With that information, you can take the appropriate action.<\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Create alerts for long-running backups on Azure<\/p>\n","protected":false},"author":2,"featured_media":7320,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26390","content_type":"blog","created_by":"10130","authored_on":"2023-12-18T08:30:11+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Monitor Azure server backups and optimize operations with Log Analytics alerts, ensuring data availability and reliability.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26390-insights_image-microsoft-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Microsoft Azure","product":"","publisheddate":"2020-05-01T07:30:11","rxt_solutions":"Cloud Adoption & Migration, Cloud Management & Operations, Cloud Optimization, Multicloud, Public Cloud","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Long-Running Backups Azure Alerts | Rackspace Technology","field_topics":"","field_slug":"create-alerts-for-long-running-backups-on-Azure","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7318","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7318"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7318\/revisions"}],"predecessor-version":[{"id":9401,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7318\/revisions\/9401"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7320"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}