How to - Monitor Backup Success

Everyone knows that backing up data is absolutely critical. Most of us have processes in place for backup software to run periodically and perform backups. But if those backups silently fail, they don't have any value. So monitoring the backups are happening and succeeding is important.

Most backup software reports success or failure by writing to the Event Log. This HOWTO will describe how to use the Event Log monitor in PA Server Monitor to monitor scheduled backups.

First, look in your existing Event Log (possibly the Application log or the Microsoft-Windows-Backup/Operational log) and find a successful backup event. Note the event Source and the event text. Does it contain the word "success", "completed" or something else that could be used to distinguish it from a failed backup?

This is the event we will target for this example:

NOTE ABOUT MICROSOFT BACKUP: Microsoft plays some games with their Backup events. Although the Event Log Viewer shows the source is "Backup", it is actually "Microsoft-Windows-Backup". And the Event Log is reported as "Microsoft-Windows-Backup/Operational", but in reality, it is just "Microsoft-Windows-Backup". It is this way in Windows 2008 R2 and possibly other versions of Windows.

Now create a new Event Log monitor. Uncheck all the Event Sources and Event Logs except the targets we identified in the above step.

The source event in our example was of type Informational. To protect against any eventual changes in how the software reports events, this example checks all 5 Event Type boxes for that source.

Next, click the box in the first column ("Event ID & Text Filters"). This is where we will create our filter to watch for the success or completed text. For this example, we will look for the word "completed".

Normally the Event Log monitor alerts when it sees a matching event. But we want it to do the exact opposite -- we want it to alert if it doesn't see a successful backup event. For this, we'll go to the monitor's Advanced Options and invert the monitor status.

Now any time the monitor runs and does NOT see a successful backup event, it will fire actions. The last trick is to make sure the monitor only runs after a backup should have completed. So if your backups normally run daily from 1:00am to 3:00am for example, set the monitor to run daily at 3:30am. If you don't want to be alerted at 3:30am in the morning, perhaps daily at 8:00am would better :)