Examkin

Question

Difficulty: Very hardAzure Backup Reports and Monitoring

You have an Azure subscription that contains a Log Analytics workspace named Workspace1 and two Recovery Services vaults named Vault1 and Vault2.

You configure diagnostic settings for both vaults to send logs to Workspace1. The configurations are as follows:
* For Vault1, you select the Azure diagnostics (legacy) option.
* For Vault2, you select the Resource specific option.

For both vaults, you enable the AddonAzureBackupJobs log category.

You need to write a Kusto Query Language (KQL) query that returns a consolidated list of all failed backup jobs from both vaults.

Which KQL query should you run?

  1. union
    (AzureDiagnostics
    | where Category == "AddonAzureBackupJobs" and JobStatus_s == "Failed"
    | project TimeGenerated, VaultName = VaultName_s, JobStatus = JobStatus_s),
    (AddonAzureBackupJobs
    | where JobStatus == "Failed"
    | project TimeGenerated, VaultName, JobStatus)    Answer
  2. B
    union
    (AzureDiagnostics
    | where Category == "AddonAzureBackupJobs" and JobStatus == "Failed"
    | project TimeGenerated, VaultName, JobStatus),
    (AddonAzureBackupJobs
    | where JobStatus == "Failed"
    | project TimeGenerated, VaultName, JobStatus)
  3. C
    AddonAzureBackupJobs
    | where JobStatus == "Failed"
    | project TimeGenerated, VaultName, JobStatus
  4. D
    AzureDiagnostics
    | where Category == "AddonAzureBackupJobs" and JobStatus_s == "Failed"
    | project TimeGenerated, VaultName = VaultName_s, JobStatus = JobStatus_s

Answer

The correct query combines the legacy AzureDiagnostics table (using suffixed columns like JobStatus_s and VaultName_s for Vault1) and the dedicated AddonAzureBackupJobs table (using standard column names for Vault2) using a union operator.
The correct answer accurately queries both tables where the logs reside. Vault1 logs are stored in the AzureDiagnostics table because it uses the legacy diagnostics setting. Within this table, the columns have suffixes (JobStatus_s and VaultName_s). Vault2 logs are stored in the AddonAzureBackupJobs table because it uses the Resource-specific setting, and its columns are unsuffixed. The query merges them using a union and projects the columns to align their schemas.

Step-by-Step Solution

1
Determine the destination table for Vault1 logs
Vault1 uses legacy Azure diagnostics, so its diagnostic logs are sent to the central AzureDiagnostics table. Within this table, the logs are filtered by Category == "AddonAzureBackupJobs".
Legacy mode routes all diagnostic categories to the single AzureDiagnostics table.
2
Identify the column naming convention for Vault1 logs in AzureDiagnostics
Fields in the legacy AzureDiagnostics table are appended with data type suffixes. The string fields JobStatus and VaultName become JobStatus_s and VaultName_s respectively.
Azure Diagnostics dynamically types and suffixes columns during ingestion.
3
Determine the destination table and schema for Vault2 logs
Vault2 uses Resource specific destination, so its logs are sent directly to the dedicated AddonAzureBackupJobs table. The schema columns do not have type suffixes (JobStatus and VaultName are used).
Resource-specific mode creates structured, dedicated tables for each log category.
4
Merge and align schemas using KQL operators
Use the union operator to combine both tables. Use the project operator on the legacy dataset to rename VaultName_s to VaultName and JobStatus_s to JobStatus so the schemas match.
Aligning schemas ensures a clean, unified dataset output for reporting.

Key Concept

Azure Backup diagnostic logging modes (Azure diagnostics vs Resource specific) and their impact on Log Analytics table routing and column schemas.
Estimated Time:3m 0s
Rate this question

Topics

Azure Backup Reports and Monitoring

More questions from this topic