Share via

Azure Site Recovery alerts

Ramona Istrate 105 Reputation points
2026-02-24T12:35:45.87+00:00

Hello,

I need to implement several Azure Site Recovery (ASR) alerts using Azure Monitor with a Log Analytics Workspace. Specifically, I’m trying to create alerts for:

Protection Disabled

Initial Replication Stuck (>4 hrs)

Recovery Point Stale (>2 hrs)

For the Protection Disabled alert, I created a test VM, enabled replication, waited for the initial replication to complete, and then disabled replication. After that, I searched the logs using simple KQL queries such as:

Code

search "disable"
| where TimeGenerated > ago(2d)

and

Code

search "protection"
| where TimeGenerated > ago(2d)

However, I couldn’t find any entries related to “Protection disabled.” Is there a specific table or log source that records this event when using Azure Monitor + Log Analytics?

For the Initial Replication Stuck alert, I started replication and checked the ASRJobs table. I can see completed and failed jobs, but I never see jobs in an “InProgress” state. It looks like only final job results are logged. Is there any way to detect running or long‑running ASR jobs through Log Analytics?

Any guidance on how to correctly capture these events or whether additional diagnostic settings are required would be greatly appreciated.

Azure Site Recovery
Azure Site Recovery

An Azure native disaster recovery service. Previously known as Microsoft Azure Hyper-V Recovery Manager.

Answer accepted by question author
  1. Jose Benjamin Solis Nolasco 7,461 Reputation points Volunteer Moderator
    2026-02-24T15:34:57.87+00:00

    Welcome to Microsoft Q&A

    Hello Ramona Istrate, I hope you are doing well,

    You need to monitor the ASRReplicatedItems table instead. This table provides a continuous heartbeat of the current state of the VM.Create an alert query that looks for items where the ReplicationState is InitialReplicationInProgress and calculate if the earliest timestamp for that specific state on that specific VM exceeds 4 hours.

    Similar to the stuck replication, you will use the ASRReplicatedItems table. This table includes a specific column for the RPO metric.Query the table where RpoInSeconds > 7200 (which is 2 hours). Set the alert logic to trigger if the threshold is breached.

    Thats how i solved this in my experience so in that way you can track those activities from ARSreplicateditems

    😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator
    2026-02-24T21:43:50.9666667+00:00

    Hello Ramona Istrate, It sounds like you're trying to set up some specific alerts for Azure Site Recovery (ASR) using Azure Monitor, and you’re facing some challenges in capturing the necessary events. Let’s break down your issues:

    Protection Disabled Alert

    For the "Protection Disabled" alert, you mentioned using KQL queries but couldn’t find any logs related to the event. This is because alerts for certain events might not be logged in the ASRJobs table. You should check the default Azure Monitor alerts for ASR, which can be enabled after registering the feature. When properly configured, these alerts will notify you of events like protection being disabled. Make sure to verify if you registered the built-in Azure Monitor alerts for ASR appropriately.

    Steps:

    1. Ensure the registration of built-in alerts for Azure Site Recovery.
    2. Use the Azure Monitor portal to check for alerts by navigating to Azure Monitor > Alerts and setting the filter to Monitor Service = Azure Site Recovery.
    3. As for querying logs, focus on logs from the AzureActivity table as it usually logs activity related to resource modifications.

    Initial Replication Stuck Alert

    Regarding detecting stuck replication jobs, it’s correct that the ASRJobs table might not show intermediate states like "InProgress", focusing instead on completed or failed jobs. To identify long-running jobs, you might need to adjust how you monitor the replication process.

    Suggestions:

    1. Investigate using metrics in Azure Monitor that may provide real-time updates on job statuses.
    2. Check if any additional diagnostics settings related to replication are configured for your environment as these might provide additional visibility.
    3. Review the ASR configurations to ensure that they are logging relevant information for your monitoring needs.

    Additional Diagnostic Steps

    You can also use built-in diagnostics for Azure Site Recovery that run checks on various components which can help identify issues related to the configuration or replication statuses.

    References

    Hope this helps! Let me know if you have any other questions or need further assistance. Thanks

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.