Azure Log Analytics: Using Perfmon data

Updated: As last night the Settings moved to the Azure portal Today I was looking at Perfmon data for a particular process.  In this case it happened to be lsass.exe but only on Domain Controllers. I needed to add this Perfmon Counter to OMS, in Settings – Data – Windows Performance Counters  (via the OMS…

0

Azure Log Analytics: Using the Parse operator

Updated: to include some screenshots (as thus wasn’t working the other day) Today I had to look at getting some data from SecurityEvent.  This is using the new Log Analytics query language and the Advanced Analytics portal. I was looking at EventID: 5061, but you can use any EventID you like, e.g. SecurityEvent | where…

0

Have you have upgraded to the new OMS Query language?

This new language and features was announced here https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-log-search-upgrade  The new documents and samples can be found at https://docs.microsoft.com/en-gb/azure/log-analytics/log-analytics-log-search-new and https://docs.loganalytics.io/          

0

Modern Service Management in the Cloud

Hi all, I’m Gavin Kemp the shy and retiring member of the UK cloud infrastructure team. Helping customers to the cloud is my number 1 priority but also making them feel comfortable with the cloud is as equally important. My approach has been to genrally describe it as a co-lo datacenter that’s a little bit…

0

OMS Syntax post series: #4 : WireData

One of the most interesting set of syntax has been the use of WireData, I’m not really a networking person but they way you can visualise and assess the data is very useful. For all of these replace aDomainName.co.uk with your own FQDN   I started to look at traffic from a Subnet and the…

0

OMS Syntax post series: #3 Events & Alerts

Part 3, Events and Alert examples:   I wanted to look at a range of EventIDs (I cant remember why now) but this is how: Type=Event EventID=* | measure count () by EventID | Where (EventID>6000 AND EventID<6500) If you want to look for some specific EventIDs, I was also filtering on the last 24hrs…

0

OMS Syntax post series: #2 Computers

Part 2 of the OMS Syntax series   Just a list of distinct computers in the OMS workspace (just returns the count and name rather than all the other details) Computer=* | Distinct Computer A similar list to the above but shows the computers sorted by aggregated value (i.e. sorted by  computers that have the…

0

OMS Syntax post series: #1 Performance

This is a series of posts, which I will update and add to often (I hope), basically I’ve ended up with a OneNote of syntax that I know works in certain key areas of OMS. Looking for % used space (this example and all the rest, require you to add the correct Perf counter in…

0

OMS now in the UK Azure region

https://azure.microsoft.com/en-gb/blog/announcing-new-set-of-azure-services-in-the-uk/ Log Analytics  Azure Log Analytics is a service in the Operations Management Suite (OMS) offering that monitors your cloud and on-premises environments to maintain their availability and performance. It collects data generated by resources in your hybrid cloud environments and from other monitoring tools to provide insights and analysis and help you detect and…

0