---
title: "Monitor backup coverage"
description: "Find endpoints whose data is not protected, from Outpost Backup or any other backup product, and act on backup failures and alerts."
url: "https://support.outpostplatform.com/backup/coverage/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "The Backup page (Coverage) counts endpoints as Protected, Stale, Failed, or Unprotected across Outpost Backup and third-party products, with filters by status, source, and site and the built-in views Needs attention and Unprotected. Covers an endpoint's Backups tab, backup alerts, and the MSP practice-level Backup coverage page across every client. Needs backup:read."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "backup:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/backup/coverage.mdx"
license: "CC BY 4.0"
---

# Monitor backup coverage

The **Backup** page answers one question for every endpoint in a client:
would its data survive losing the disk? It counts Outpost Backup and every
third-party product that reports on the endpoint the same way. Use it to find
endpoints nothing protects, and to follow up failures. On the MSP plan, a
practice-level page asks the same question across every client.

## Before you begin

- You need the `backup:read` permission. The Owner, Support Manager, Field
  Technician, Support Rep, and Accounting roles hold it.
- On the MSP plan, open the client's workspace first, or use the
  [practice-level page](#see-coverage-across-every-client).

## How an endpoint's status is decided

Each endpoint gets one status from every source that reports on it, Outpost
Backup and third-party products alike:

| Status | Meaning |
| --- | --- |
| **Failed** | Any source's latest attempt failed. |
| **Stale** | Nothing failed, but the newest success is too old: more than 8 hours for Outpost Backup, which is twice the default interval of 4 hours, or more than 48 hours for another product. |
| **Protected** | Nothing failed, and a source has succeeded within those limits. |
| **Unprotected** | No source has ever succeeded, including endpoints with no backup at all. |

The statuses are checked in that order, so a failure in one product makes the
endpoint **Failed** even if another product succeeded.

## Find endpoints that need attention

1. Go to **Backup** > **Coverage**. The four tiles count the whole client and
   do not change with the filters. **Reporting sources** shows how many
   endpoints each product reports on.
2. Choose the **Needs attention** view, which lists **Failed**, **Stale**, and
   **Unprotected** endpoints. The **Unprotected** view lists endpoints with no
   backup yet.
3. To narrow the list, filter by **Status**, **Source**, or **Site**, or enter
   part of a hostname in **Find an endpoint**.
4. Sort by **Endpoint**, **Status**, or **Last success**.
5. Select an endpoint's name to open its **Backups** tab.

Each row shows the endpoint's **Status**, the **Sources** reporting on it,
**Last success**, **Last attempt**, and **Operating system**. You can save a
filtered list as a view of your own. Sharing a view with your team needs
`backup:manage`.

## Read an endpoint's Backups tab

The endpoint's **Backups** tab shows:

- **Outpost Backup**: whether it is on, the last result, the next backup, the
  schedule, what is kept, and the newest verification for each copy. A copy
  that has not yet handed its key to Outpost shows **Key pending**.
- **Other backup products**: each third-party product that reports on the
  endpoint, with its last result.
- **Snapshot timeline**: snapshots by day, with **Verified**, **Verification
  failed**, or **Not verified**. Select **Show expired snapshots** to include
  snapshots retention has removed. **Missing** marks a snapshot that is no
  longer in the repository.
- **Restores** and **Runs**: recent restores, and every backup run with its
  copy, kind, reason (**Why**), **Result**, upload size, and failed files.

From the tab, **Back up files now** and **Back up system image now** start a
backup, which needs `backup:restore`. The backup starts when the endpoint is
online.

## Backup alerts

Outpost raises alerts in the **Backup** category:

| Alert title | Severity | Raised when | Clears when |
| --- | --- | --- | --- |
| **Backup failed on** the endpoint, with the copy | Warning | A run of the primary or secondary copy fails. | The next run of that copy succeeds. |
| **Backup overdue on** the endpoint, with the copy | Warning | A copy has had no success within twice its own interval. | That copy succeeds. |
| **Backup verification failed on** the endpoint, with the copy | Critical | A verification check fails. | A later check passes. |
| **Backup snapshots missing on** the endpoint, with the copy | Critical | A snapshot that retention still keeps is missing from the repository, or was reported deleted. | A technician acknowledges it. |
| The product name, then **backup problem on** the endpoint | Warning | Another product reports a failure, or has had no success in 48 hours. | That product succeeds. |

Each alert is raised once per endpoint and copy, or per endpoint and product,
and stays open until it clears. Route them like any other alert. See
[Alerts](/service-desk/alerts/).

:::caution
Treat **Backup snapshots missing** as a possible attack on the backups. It means backup data
disappeared that nothing in Outpost was due to delete. Check who has write and
delete access to the bucket or share before you acknowledge it.
:::

## See coverage across every client

On the MSP plan, **Backup coverage** at practice level lists every client's
endpoints in one table, with the same four statuses and sources.

1. In the practice-level navigation, select **Backup coverage**. It is shown to
   practice roles that hold `endpoint:read`.
2. The tiles count every client. To look at one, choose it in **Client**, or
   leave **Every client**.
3. Filter by **Status** or **Source**, or enter part of a hostname in **Find an
   endpoint**. The search matches hostnames, not client names.
4. Select an endpoint to open its **Backups** tab inside that client's
   workspace.

Views you save on this page are your own and cannot be shared. If a client's
data cannot be read, the page shows **This list is incomplete** and names
what is missing, rather than leaving the client out without a word.

## Verify

- Every endpoint you expect to be protected shows **Protected**.
- The **Needs attention** view is empty, or lists only endpoints you have
  decided not to back up.

## Next steps

- [Configure backups with policy](/backup/configure-backup/)
- [Monitor third-party backup products](/backup/third-party-backups/)
- [Restore files and systems](/backup/restore/)