Azure Log Analytics: A little more about Usage

In post and post we’ve spoken about Usage but its a topic that comes up a lot. I have a two step process, to identify the culprits if high usage is experienced.  I’ll also talk about planning later…and especially the recommendation to Alert on Usage! Log Analytics shows Usage in two main places 1. Azure…


NEW EXAMPLE SCENARIO: Web Application Monitoring on Azure

Written by Shawn Gibbs and Nanette Ray from AzureCAT. Reviewed by Mike Wasson, Ed Price, and Tim Benjamin. Published by Adam Boeglin from Microsoft patterns & practices. Web Application Monitoring on Azure We believe monitoring applications is a vital cloud scenario, and so we’re glad to build out this content, now available on the Azure…


SQL Audit logs in Azure Log Analytics and Azure Event Hubs

We are pleased to announce that Azure SQL Database Audit logs can now be written directly to Azure Log Analytics or Azure Event Hubs. This ability, now available in public preview, provides SQL Database Auditing customers with an easy way to centrally manage all of their log data, along with a rich set of tools…


Azure Log Analytics: A little more on Parse and Print

In my last post I wrote about Print and Let – which reminded me of some work I did to manipulate some text recently (it also used a Print operator, which was the thing that reminded me). The raw data was this (it was from an event log but I don’t recall which one): “Device=\.\PHYSICALDRIVE;…


Azure Log Analytics: Do you need some demo data?

This article (as a test) was also published to my LinkedIn feed   Sometimes you need some demo data to work with, here are two methods: Use the Print operator to create some In its basic use, you can use Print to display some text e.g. print “this is a test” – which looks like:…


Learn for Free KQL–the language Log Analytics and other services use

KQL, the Kusto Query Language, is used to query Azure’s services. This course will teach you the basic syntax of KQL, then cover advanced topics such as machine learning and time series analysis, as well as exporting your data to various platforms. https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch I’ve been using KQL for quite a while, but still found this…


Azure Log Analytics: Disk Space Usage ; Part 3

Azure Log Analytics: Disk Space Usage ; Part 3 Category    Log Analytics Syntax v2 ; OMS Syntax As promised here is Part 3 Part 1: https://blogs.msdn.microsoft.com/ukhybridcloud/2017/12/08/azure-log-analytics-disk-space-usage/ Part 2: http://blogs.msdn.microsoft.com/ukhybridcloud/2018/05/17/azure-log-analytics-disk-space-usage-part-2/ Part 3: this post In this post we’ll look at Trends and doing an estimate. My query now looks like the one further down this article (see…

4

Azure Log Analytics: Disk Space Usage – Part 2

  My previous post on this topic is one of the most viewed (according to our blog analytics in the last week).   So I thought it was time to share some extra queries that you many find helpful. Please see the previous post, Part 1: https://blogs.msdn.microsoft.com/ukhybridcloud/2017/12/08/azure-log-analytics-disk-space-usage/ Part3: https://blogs.msdn.microsoft.com/ukhybridcloud/2018/05/18/azure-log-analytics-disk-space-usage-part-3/ The original query I produced was this: //…


Azure Log Analytics: Queries, Has the Hostname been changed?

The question was asked, how do you find a Computer using Log Analytics that has had its name changed? Normally you would find an EventID that contains this by doing a web search or by looking in Eventvwr after trying a name change yourself on a test server.   Both methods said that EventID 6011 should…


The most basic basic of OMS / Log Analytics is….

Updated post (27th June2018): The Log Analytics landing page has been updated https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-portal-faq [Workspace Summary] is the new “Overview” —————————————————————— …please use the Azure Portal to access the product not the Legacy OMS portal. Simply from Portal.Azure.Com, select your Log Analytics workspace – then press OVERVIEW or Log Search rather than OMS Portal.  The old…