question

VictorEpure-3473 avatar image
0 Votes"
VictorEpure-3473 asked SadiqhAhmed-MSFT commented

How can you find out who initiated an Azure Backup MARS restore

I need to find a way to audit the restore jobs for MARS agent. Any ideas?

azure-backup
· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.


Hi anonymous user
I have setup Log analytics and I can see logs but can't find anything related to user name/id. Any ideas?

0 Votes 0 ·

@VictorEpure-3473 Do you see any entries in the activity logs?
Activity logs are stored for 90 days. You can send this data to log analytics workspace to configure alerts.
https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

0 Votes 0 ·

I'm sorry I think I did not provide the entire requirement in my first post.

I need to be able to see who initiated the restore, the userid/name etc.

I can see the restore log entries in the log analytics workspace but they do not provide any fields that would say the user the initiated the restore.

Victor

0 Votes 0 ·
Show more comments

1 Answer

SadiqhAhmed-MSFT avatar image
0 Votes"
SadiqhAhmed-MSFT answered

Hello @VictorEpure-3473 Thank you for your post and welcome Microsoft Q&A community forum!

Activity Logs should contain information on user triggered operations like creation/deletion/restoration of backup data. The logs are created by default in activity logs. If you want alerts on top of activity log, then you will need to write some alert rule.

Reference links:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/backup/backup-azure-monitoring-use-azuremonitor.md
https://azure.microsoft.com/en-in/blog/monitor-all-azure-backup-protected-workloads-using-log-analytics/


If the response helped, do "Accept Answer" and up-vote it

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.