{"id":5801,"date":"2020-04-02T23:29:15","date_gmt":"2020-04-02T22:29:15","guid":{"rendered":"https:\/\/www.n-able.com\/?p=5801"},"modified":"2021-07-13T13:16:29","modified_gmt":"2021-07-13T12:16:29","slug":"backup-monitoring-part-2-defining-success","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/backup-monitoring-part-2-defining-success","title":{"rendered":"Backup Monitoring: Part 2\u2014Defining Success"},"content":{"rendered":"

In part one of this blog series, I discussed backup monitoring and the ability to manage by exception (if you haven\u2019t read it yet, you can find it\u00a0here<\/a>). In this installment we\u2019ll start to build out custom filters using the Advanced Search query language so you can truly define your own measure of success or failure. If you\u2019re wondering why, both MSPs and IT departments looking to reduce costs and improve efficiency can benefit from the inherent flexibility. It can mean the difference between creating and working a service ticket or not\u2014saving both time and resources. So, launch your browser, log into\u00a0https:\/\/backup.management<\/a>, and follow along as we dive in.<\/p>\n

Advanced search<\/h3>\n

We\u2019ve previously covered some basic backup console navigation including interactive\u00a0doughnut widgets<\/a>, built-in\u00a0dashboard views<\/a>, turning on filters, adding columns, saving views, and emailing views. Now, we\u2019re going to expand on this by looking at how you can use the Advanced Search query language to build even more specific filters based on statistics\u2014like date, time, duration, size, error count, etc. This makes it possible to review performance, usage, deduplication ratios, and under-protected devices. This and future blogs will walk you through creating basic and advanced search queries you can string together later to get a view of the exact devices you want to manage.<\/p>\n

Building advanced search queries<\/h3>\n

To\u00a0enable<\/a>\u00a0Advanced Search, click the right drop-down arrow in the Normal Search bar (it\u2019s situated to the left of the Select Filter dialog). Then select Advanced Search. You can easily build Advanced Search expressions one at a time by selecting and editing a filter and then toggling between Normal Search and Advanced Search to see how the filter expression is constructed.<\/p>\n

You can find reference documentation on the\u00a0Advanced Search filter expressions<\/a>\u00a0here. It includes the short code and data type for the columns in the management console. This will be useful to you later as we build our first expressions. It will give you a sneak peek at the type of data you can work with. You can also reference the Columns drop-down to search for a column name and see the short code.<\/p>\n

You can interact with individual expressions, filter them by time and size, group them together in parentheses, or separate them with AND\/OR conditions to fine tune your results. You can access reference documentation on the Advanced Search filter syntax\u00a0here<\/a>.<\/p>\n

Last successful session time<\/strong><\/h3>\n

Filtering by the Last Successful Session time of a data source or device lets you know if you\u2019re operating within the SLAs you established with your customers. It also lets you set priority for resolving issues. For example, a device that hasn\u2019t backed up in the past 24 hours may not be as critical as a device that hasn\u2019t backed up in more than 48 hours. While these default time-based filters may be good enough thresholds during the work week, they can generate false positives when it comes to devices that are purposely offline over holidays, long weekends, or employee vacations. Let\u2019s start to build out some basic time-based expressions.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Expression<\/i><\/b><\/td>\nDescription<\/i><\/b><\/td>\n<\/tr>\n
TL == 0<\/i><\/td>\n(Total last successful session Equal to Never)<\/i><\/td>\n<\/tr>\n
TL < 72.hours().ago()<\/i><\/td>\n(Total last successful session Prior to Last 72 hours)<\/i><\/td>\n<\/tr>\n
TL < 4.days().ago()<\/i><\/td>\n(Total last successful session Prior to Last 4 days)<\/i><\/td>\n<\/tr>\n
TL > 2.weeks().ago()<\/i><\/td>\n(Total last successful session During the Last 2 weeks)<\/i><\/td>\n<\/tr>\n
TL == 0 OR TL < 48.hours().ago()<\/i><\/td>\n(Total last successful session Equal to Never OR Prior to Last 48 hours)<\/i><\/td>\n<\/tr>\n
XL < 3.days().ago()\u00a0<\/i><\/td>\n(Total last successful Exchange session Prior to Last 3 days)<\/i><\/td>\n<\/tr>\n
RFL > 24.hours().ago()<\/i><\/td>\n(Restore Total last successful File and folders session During the Last 24 hours)<\/i><\/td>\n<\/tr>\n
CD < 2.weeks().ago() AND TL == 0<\/i><\/td>\n(Creation date Prior to Last 2 weeks AND Total last successful session time Equal to Never)<\/i><\/td>\n<\/tr>\n
TS > 1.days().ago()<\/i><\/td>\n(Timestamp During the Last 1 days)<\/i><\/td>\n<\/tr>\n
TS < 2.days().ago()<\/i><\/td>\n(Timestamp Prior to Last 2 days)<\/i><\/td>\n<\/tr>\n
TS > 36.hours().since(TL) AND TS < 2.days().ago()<\/i><\/td>\n(Timestamp More than 36 hours Since Total last successful session AND Timestamp Prior to Last 2 days)<\/i><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

In addition to Total Last Successful Session backup time\u00a0(TL),<\/b>\u00a0you also have individual expressions for each of the supported backup and restore data sources. This way you can also filter by Exchange Last Successful Session backup time\u00a0(XL)<\/b>\u00a0or Files and Folders Last Successful Session Restore time\u00a0(RFL)<\/b>, by swapping out the appropriate short name expression for the desired data source.<\/p>\n

Another useful time-based expression is Creation Date\u00a0(CD)<\/b>\u00a0which you can use to determine the amount of time since initial deployment. One possible use case is ignoring warnings from new deployed devices until they\u2019re older than two weeks without a successful backup to the cloud. \u00a0 Next, Timestamp\u00a0(TS)<\/b>\u00a0provides visibility into when the backup client last checked in with the cloud service, allowing you to monitor backup success in relation to the device being on and connected to the internet.<\/p>\n

Note, that while it may seem like the < > symbols are incorrect in some of these examples, they\u2019re not. For expressions using the\u00a0.ago()<\/b>\u00a0function, we count backwards from the current time to set a reference and then compare the number of elapsed seconds since January 1, 1970 (Epoch time) to see which happened first. In the second example above we are only viewing devices where the (Last successful session) time stamp is (a smaller number of elapsed seconds) Prior to 72 hours before the current time.<\/p>\n

Total status<\/h3>\n

While SolarWinds\u00ae<\/sup>\u00a0Backup considers a status of (Completed with errors) as a successful backup job, you and your end customers may not. It often depends on the type and importance of the backup device\u2014for example, is it a workstation or server, is it one error or 500, is it a temp file or a SQL database, is it an old file server or a CEO\u2019s laptop, etc.? All of these may make you want to look a little closer as that Backup status column and start to build expressions that help you differentiate.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Expression<\/i><\/b><\/td>\nDescription<\/i><\/b><\/td>\n<\/tr>\n
T0 == 0<\/i><\/td>\n(Total status Equal to No backup)<\/i><\/td>\n<\/tr>\n
T0 == 1<\/i><\/td>\n(Total status Equal to In process)<\/i><\/td>\n<\/tr>\n
T0 == 5 OR T0 == 8<\/i><\/td>\n(Total status Equal to Completed OR Total status Equal to Completed with errors)<\/i><\/td>\n<\/tr>\n
T0 == 11<\/i><\/td>\n(Total status Equal to No selection)<\/i><\/td>\n<\/tr>\n
T0 != 1 AND T0 != 5 AND T0 != 8<\/i><\/td>\n(Total status Not Equal to In process AND Completed AND Completed with errors)<\/i><\/td>\n<\/tr>\n
T0 == 2 OR T0 == 3 OR T0 == 6 OR T0 == 7 OR T0 == 13 OR T0 == 10 OR T0 == 12 OR T0 == 9<\/i><\/td>\n(Total Status Equal to Failed OR Aborted OR Interrupted OR Not started OR Blocked OR Over quota OR Restarted OR In process with fault)<\/i><\/td>\n<\/tr>\n
S0 == 2<\/i><\/td>\n(System state status Equal to Failed)<\/i><\/td>\n<\/tr>\n
H0 == 8 OR H0 == 2<\/i><\/td>\n(Hyper-V status Equal to Failed or Completed with errors)<\/i><\/td>\n<\/tr>\n
RH0 == 8 OR RH0 == 2<\/i><\/td>\n(Restore Hyper-V status Equal to Failed or Completed with errors)<\/i><\/td>\n<\/tr>\n
T7 == 1<\/i><\/td>\n(Total errors Equal to 1)<\/i><\/td>\n<\/tr>\n
T7 >= 100<\/i><\/td>\n(Total errors Greater than or Equal to 50)\u00a0<\/i><\/td>\n<\/tr>\n
H7 <= 5<\/i><\/td>\n(Hyper-V errors Less than or Equal to 5)<\/i><\/td>\n<\/tr>\n
G7 > 10<\/i><\/td>\n(Office 365 Exchange errors Greater than 10)<\/i><\/td>\n<\/tr>\n
RN7 > 2<\/i><\/td>\n(Restore Network shares errors Greater than 2)<\/i><\/td>\n<\/tr>\n
OT == 1<\/i><\/td>\n(OS type Equals Workstation)<\/i><\/td>\n<\/tr>\n
OT == 2<\/i><\/td>\n(OS type Equals Server)<\/i><\/td>\n<\/tr>\n
OT == 1 AND TS < 9.days().ago()<\/i><\/td>\n(OS type Equals Workstation AND Timestamp Prior to Last 9 days)<\/i><\/td>\n<\/tr>\n
OT == 2 AND (TS < 1.days().ago() OR TL < 2.days().ago())\u00a0<\/i><\/td>\n(OS type Equals Server AND (Timestamp Prior to Last 1 day OR Total last successful session Prior to Last 2 days)<\/i><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

In addition to Total Status\u00a0<\/i>for backup\u00a0(T0),<\/b>\u00a0you also have individual expressions for each of the supported backup and restore data sources. This way you can also filter by MS SQL\u00a0<\/i>Status\u00a0<\/i>for last backup\u00a0(S0)<\/b>, or Hyper-V status\u00a0<\/i>for last backup\u00a0(H0)<\/b>, or restore\u00a0(RH0)<\/b>, by swapping out the appropriate short name expression for the desired data source.<\/p>\n

If you want to dig deeper and break down the Total status Equal to Failed\u00a0(T0 == 2)<\/b>\u00a0and Total status Equal to Completed with errors\u00a0(T0 == 8)<\/b>\u00a0results, you can use the Total Errors\u00a0(T7)<\/b>\u00a0expression to group by an exact count, greater than or less than a specific value. Just like the prior examples, there are also expressions for filtering backup and restore errors for each of the individual data sources.<\/p>\n

Earlier I began to hint that Operating System type\u00a0(OT)<\/b>\u00a0can also play a factor in prioritization and that errors and failures that occur on a Desktop OS\u00a0(OT == 1)<\/b>\u00a0might get resolved at a lower priority than those on a Server OS. For example, a laptop or desktop that is offline with no backups for two or three days over the weekend may not justify a support ticket. When you start to think about user holidays and vacations, you might even be able to justify waiting until it\u2019s been offline for more than nine days. A Server OS, however, probably shouldn\u2019t be offline more than 24 hours and shouldn\u2019t go a weekend without a successful backup.<\/p>\n

Wrapping up<\/h3>\n

Assuming you followed along in the console, you probably want to combine or tweak the values on a few of the useful expressions that we\u2019ve built, and then copy and paste them into the Advanced Search. After each paste, click Save View and name that view prior to clicking Save as New. Once you\u2019re done, check to make sure your new views are visible in the drop-down lists on the left side\u00a0Dashboard views<\/a>\u00a0and right side\u00a0Save views<\/a>.<\/p>\n

If I\u2019ve piqued your interest and you have further questions, please stay tuned for the next blog post where we\u2019ll continue to define and construct these advanced filters. Alternatively, feel free to join me during an upcoming\u00a0Backup Office Hours<\/a>\u00a0session or reach out to me on\u00a0Twitter<\/a>.<\/p>\n

 <\/p>\n

Eric Harless is the Head Backup Nerd at\u00a0SolarWinds MSP<\/a>. Eric has worked with SolarWinds Backup since 2013 and has over 25+ years of data protection industry experience in sales, support, marketing, systems engineering and product management.<\/em><\/p>\n

You can follow Eric on Twitter\u00a0at @backup_nerd<\/em><\/p>\n

 <\/p>\n

Other blogs in this series<\/strong><\/p>\n