MABS x Recovery Services Vault

Question

MABS x Recovery Services Vault

DENILSON TOBAL - MANZANOS 40

I am trying to find out the information about backup sizing. We need to understand how much our backup uses daily.
When I see the ammount in the Overview... it just show the total used. We want to plan the costs of our backup, and this information is crucial for understanding the costs of the solution.

I tried to setup Diagnostic Settings x Log Analytics... ok... I can use Backup Reports, but it doesnt show the dailly ammount.

0 comments

Answer accepted by question author

Marcin Policht 105.8K MVP Volunteer Moderator

You should be able to get this info by querying the backup job data in Log Analytics. The Recovery Services Vault overview primarily shows cumulative consumption, while individual backup job records can provide the amount of data transferred during each backup cycle.

If you have configured Diagnostic Settings to send Azure Backup data, such as AddonAzureBackupJob or core backup data, to a Log Analytics workspace, you can use Kusto Query Language to calculate daily data churn. In the Azure portal, open the Log Analytics Workspace, select Logs, and run a query similar to the following:

AzureDiagnostics
| where Category == "AzureBackupReport"
| where OperationName == "Job" 
| extend JobData = parse_json(properties_s)
| project TimeGenerated, 
          VaultName = Resource, 
          BackupItemUniqueId = tostring(JobData.BackupItemUniqueId_s),
          DataItemSizeInMB = tostring(JobData.DataTransferredInMB_s)
| summarize DailyBackupSizeMB = sum(toint(DataItemSizeInMB)) by bin(TimeGenerated, 1d), VaultName
| order by TimeGenerated desc

The table and property names depend on how the diagnostic settings are configured. With resource-specific diagnostic mode, the data may be stored in tables such as CoreAzureBackup rather than the legacy AzureDiagnostics table, and the property names can vary between schema versions.

Another option is to use Azure PowerShell to retrieve the details of individual backup jobs. For example:

$vault = Get-AzRecoveryServicesVault -ResourceGroupName "YourResourceGroup" -Name "YourVaultName"
$jobs = Get-AzRecoveryServicesBackupJob -Vault $vault
Get-AzRecoveryServicesBackupJobDetail -Job $jobs[0]

The job detail output should include information about the backup execution, including the Backup size property when it is exposed by the backup service. You can use this information to determine how much data was transferred during individual backup cycles and then aggregate those values by day if you need a daily total.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

0 comments

1 additional answer

Your answer

Answer 1

Hi @DENILSON TOBAL - MANZANOS

We understand that you would like to obtain a day-by-day view of the cloud storage consumed and the data transferred by your Microsoft Azure Backup Server (MABS) backups, as the Recovery Services vault Overview currently provides an aggregate view.

Azure Backup Reports can provide the required historical information. The Usage tab shows protected-instance and cloud-storage-consumption trends at the MABS/DPM billing-entity level, while the Jobs tab provides job-level information, including data transferred where supported.

Verify the diagnostic setting

In the Recovery Services vault, select Diagnostic settings and verify that the vault sends data to the correct Log Analytics workspace using Resource specific mode.

For Recovery Services vault Backup Reports, enable the following categories:

Core Azure Backup Data
Addon Azure Backup Job Data
Addon Azure Backup Policy Data
Addon Azure Backup Storage Data
Addon Azure Backup Protected Instance Data
Azure Backup Operations

If the newer events are configured in Azure diagnostics mode, their data will not appear in Backup Reports. Please also note that changing the diagnostic setting affects newly ingested data and does not convert previously collected legacy records into resource-specific records.

You can check whether recent resource-specific job data is available by running:

AddonAzureBackupJobs
| where TimeGenerated > ago(7d)
| summarize RecordCount=count() by bin(TimeGenerated, 1d)
| order by TimeGenerated asc

An empty result does not by itself confirm that legacy mode is in use. It may also indicate that no jobs occurred during the selected period, the wrong workspace is being queried, the job category was not enabled, or data has not yet been ingested.

Review the daily cloud-storage trend

Azure Backup system functions can return daily billing-group records for MABS/DPM. Please first identify the exact BackupSolution value in your workspace:

Review daily job data transfer

To calculate the data transferred by backup jobs per day, use:

_AzureBackup_GetJobs("2026-07-26", "2026-08-26")
| where BackupSolution in ("DPM", "Azure Backup Server")
| where OperationCategory == "Backup"
| where isnotnull(DataTransferredInMBs)
| summarize
DailyDataTransferredGB = sum(DataTransferredInMBs) / 1024.0,
JobCount = count()
by Day = bin(StartTime, 1d),
BackupInstanceFriendlyName,
BackupSolution
| order by Day asc, BackupInstanceFriendlyName asc
Please compare the JobCount, dates, backup-instance names, and transferred-data totals with the Backup Reports Jobs tab for the same UTC date range. The result represents data reported as transferred by the included jobs. It should not automatically be treated as unique daily changed data because retries, consistency checks, or multiple backup jobs can affect the total.

Azure Backup system functions return data through the last completed UTC day. If current partial-day information is required, the underlying Log Analytics tables must be queried directly.

Optional: configure granular billing

If you also require chargeback visibility in Cost Management, granular billing can be configured separately under Recovery Services vault > Settings > Properties > Cost Management Granularity.

You can select Vault level, Protected item level, or Tag level. This feature is currently in preview for Recovery Services vaults and is a reporting-only change. It does not modify pricing meters or total backup costs. New charges can take up to two hours to appear in Cost Analysis, while historical charges retain their earlier format.

Cost forecasting

For preliminary forecasting, an estimated transfer-to-frontend-size ratio can be calculated as:

Estimated daily ratio (%) = Daily data transferred / Frontend protected size × 100

This value can be used with the Enter your own % option in the Azure Backup pricing estimator together with the protected size, server count, and retention settings. The estimator is intended for budgeting and should not be used as an exact reconciliation of historical charges.

Please also be aware that Microsoft documents a slight difference, on the order of 20 MB per DPM server, between DPM usage shown in Backup Reports and the aggregate usage on the Recovery Services vault Overview. This is due to the metadata data source associated with each registered DPM server, which is not surfaced as a reporting artifact.

The above steps should help identify whether the missing daily view is caused by the diagnostic configuration and provide the required storage-consumption and job-transfer trends. However, the issue cannot yet be considered resolved. Resolution can be confirmed after the diagnostic categories are validated and the queries return the expected MABS/DPM records for the affected vault. For now, the status remains solution proposed and customer validation pending.

Microsoft documentation:

If you have further questions regarding this answer, feel free to click "Comment". If you find the answer helpful, please click "upvote". This helps the community by allowing others with similar queries to easily find the solution.