I am trying to run the below log analytics query using Azure CLI. I have created the workspace required. However, I am getting the error as below. I have upgraded my CLI version to the latest one based on google recommendations but nothing seems to have worked so far. I have also ensured the workspace ID is the same as the one in Azure Workspace.
az monitor log-analytics -query -w xxxxxx --analytics-query "Perf | where ObjectName == 'LogicalDisk' "
'xxxxxx' is misspelled or not recognized by the system.
The eventual outcome I am looking for is to get a list of all VMs in all the subscriptions and their used disk space ( not the allocated disk space ).
Thanks in advance.
I got same error when I tried in my environment. So, I modified a bit and executed as below:
az monitor log-analytics query --analytics-query "Perf | where (ObjectName == 'LogicalDisk')" -w <workspace-ID>
Error is disappeared, but empty block is being retrieved. So, there is a need to upgrade the CLI & python versions to the latest releases. However, running the "upgrade" command in CLI shows that it is still in development.
I found an alternative to run azure Monitor Log Analytics query using "Kql query inside workspace logs":
Perf | where (ObjectName == "LogicalDisk" and CounterName == "Free Megabytes") | summarize arg_max(TimeGenerated, *) by Computer | sort by TimeGenerated desc
Reference:
MsDoc to check log queries
Related
I am trying to add an alert if Azure ML pipeline fails. It looks that one of the ways is to create a monitor in the Azure Portal. The problem is that I cannot find a correct signal name (required when setting up condition), which would identify pipeline fail. What signal name should I use? Or is there another way to send an email if Azure pipeline fails?
What signal name should I use?
You can use PipelineChangeEvent category of AmlPipelineEvent table to view events when ML pipeline draft or endpoint or module are accessed (read, created, or deleted).
For example, according to documentation, use AmlComputeJobEvent to get failed jobs in the last five days:
AmlComputeJobEvent
| where TimeGenerated > ago(5d) and EventType == "JobFailed"
| project TimeGenerated , ClusterId , EventType , ExecutionState , ToolType
Updated answer:
According to Laurynas G:
AmlRunStatusChangedEvent
| where Status == "Failed" or Status == "Canceled"
You can refer to Monitor Azure Machine Learning, Log & view metrics and log files and Troubleshooting machine learning pipelines
I am trying to bring in Azure Synapse logs into Loganalytics to create dashboards on usage level.
I have already setup in diagnostic settings to pass on the logs to my loganalytics workspace.
But while trying to execute queries from below documentation, I am getting error saying -
Query -
//Chart the most active resource classes
AzureDiagnostics | where Category contains "ExecRequests" | where
Status_s == "Completed" | summarize totalQueries = dcount(RequestId_s)
by ResourceClass_s | render barchart
Error:
'where' operator: Failed to resolve column or scalar expression named 'Status_s'...
Documentation link for queries : https://learn.microsoft.com/en-us/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-monitor-workload-portal
Please let me know if there is something I am missing. I am directly logging to loganalytics workspace and running these queries inside a workbook...
Also i didnt find any proper documentation/blogs/links for connecting synapse to loganalytics, please let me know if anyone has that..
The documentation linked in your post appears to be out of date even though the last update date is recent.
See this link:
Azure services that use resource-specific mode store data in a table
specific to that service and do not use the AzureDiagnostics
table.
The link also lists a number of resource-specific tables for Synapse. "SynapseSqlPoolExecRequests" and "SynapseSqlPoolSqlRequests" are a few examples that might provide the info you're seeking.
So, I can see create_or_update logs of my VM on activity logs. There is no filter just to get the create logs as much as I am aware.
So is there any way where I can just see the create logs of a VM using API or commands?
You can follow below steps to achieve your requirement
You need to enable diagnostic settings to activity logs.
refer https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log#send-to-log-analytics-workspace for enabling the diagnostic settings.
Once the Log analytics workspace is established, you can query the logs as
AzureActivity
| where OperationName == 'Create or Update Virtual Machine' and ActivitySubstatusValue == 'Created'
| order by TimeGenerated desc
above output will show only the Create operations. You can further filter it based on your requirement.
I have a log analytics workspace and 2 VMs connected to it. The VMs do not have Guest-OS enabled.
When I navigate to the Log Analytics --> Log blade and run the Azure provided query for "% Free Space" nothing shows up at all.
Do I need to enable Guest-OS for the VMs ? I thought this metric was out-of-the-box by Azure. What am I missing here ?
More observations:
VM1 and VM2 are connected to the log workspace. I enabled guest-os for VM2 ONLY thinking that this is needed. When I ran this Free Space query with log analytics workspace as the scope, I could see the data for VM1 also which was strange.
So I concluded that Guest-OS is not needed for this metric.
So I removed Guest-OS and removed WADPerformaceCounterTable from the storage too.
And now I dont see ANY data for the query
According to my test, if we want to monitor the servers available disk space using Azure Log Analytics, we need to have the Azure monitor agent installed on the VM’s you want to monitor and enable Performance counters in Azure log analysis.. For further details about it, please refer to the blog.
For example(I use windows VM for test)
Enable the Log Analytics VM Extension. For more details, please refer to here and here
Configuring Performance counters
Query
erf
| where ObjectName == "LogicalDisk" or // the object name used in Windows records
ObjectName == "Logical Disk" // the object name used in Linux records
| where CounterName == "Free Megabytes"
| summarize arg_max(TimeGenerated, *) by InstanceName // arg_max over TimeGenerated returns the latest record
| project TimeGenerated, InstanceName, CounterValue, Computer, _ResourceId
As part of the storage cost optimization, we need to extract the following information from Azure at the disk level for migrated servers so far.
Please suggest if any one have a PowerShell script.
I could only get the provisioned storage, but not the used storage.
VM name.
Disk name (maybe more than one).
Provisioned storage.
Used storage.
You should be able to do this with log analytics, if you connect the VMs to a Log Analytics Workspace and enable Guest OS Metrics / Performance Counters and then query the Log Analytics Workspace.
Here is a script to get you started:
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize FreeSpace = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":"
| sort by CounterName asc