Monitor disaster Recovery Critical errors for Azure VM

Question

Hello Team,

I'm looking KQL Query to Monitor Disaster Recovery Critical Errors. I'm not found any Existing Metric or Signal in Azure monitor Alert for the same. I enabled Diagnostics Settings under Recovery Vault to send Disaster Recovery logs to the Log Analytics workspace. Sometimes the Agent Status shows me a Red flag Critical due to Agent Version Upgrade.

Can we track DR health using KQL? How would be KQL Query?

Thanks

Rahul

Answer 1

Hello Rahul,

You can use Kusto Query Language (KQL) to monitor disaster recovery critical errors. You can use the Azure Site Recovery logs that are sent to the Log Analytics workspace to create a query that will alert you when critical errors occur. Here is an example KQL query that you can use to monitor disaster recovery critical errors:

AzureDiagnostics
| where Category == "AzureSiteRecoveryEvents"
| where Level == "Critical"
| where TimeGenerated > ago(1d)

This query will return all critical events from the last 24 hours. You can modify the query to fit your specific needs by changing the time range or adding additional filters. You can also use this query to create an alert in Azure Monitor that will notify you when critical errors occur.

You can also use KQL to monitor the agent status of your disaster recovery. Here's an example query:

AzureDiagnostics
| where Category == "AzureSiteRecovery"
| where Level == "Critical"
| where Message contains "Agent Status"

<If the above details are helpful, please don't forget to accept answer to help others in the community>