Programmatically Search Operations Management Suite

At Ignite Jo Chan showed us how we can now execute Search queries trough Operations Management Suite API which is basically Azure Resource Manager API. He demonstrated that with a tool called ARMClient. That tool seems nice but I wanted to get results with PowerShell as it is more familiar to me.

Searching over Internet I’ve found ARMPowerShell Module. I’ve installed the module and with simple command like Connect-ARM I was able to authenticate. Look trough Jo’s examples from Ignite I’ve managed to get results with the following commands:

Connect-ARM
$Subscription = $ARMSubscriptions.Values | where {$_.DisplayName -eq “Visual Studio Ultimate with MSDN”}
$ResourceGroupName = “oi-default-east-us”
$OMSWorkspace = “test-stan”
$SubscriptionID = $Subscription.subscriptionId
$BaseSavedSearches = “/subscriptions/$SubscriptionID/resourcegroups/$ResourceGroupName/providers/microsoft.operationalinsights/workspaces/$OMSWorkspace/savedSearches”

$OMSSavedSearches = Execute-ARMQuery -SubscriptionId $SubscriptionID -HTTPVerb       Get
-Base           $BaseSavedSearches `
-APIVersion     “2014-10-10”

$BaseSearch = “/subscriptions/$SubscriptionID/resourcegroups/$ResourceGroupName/providers/microsoft.operationalinsights/workspaces/$OMSWorkspace/search”
$Query = “shutdown Type=Event EventLog=System Source=User32 EventID=1074 | Select TimeGenerated,Computer”
$OMSSearchResult = Execute-ARMQuery  -SubscriptionId $SubscriptionID -HTTPVerb       Post
-Base           $BaseSearch -Data           @{Query=$Query}
-APIVersion     “2014-10-10”

Unfortunately this module requires some user interaction. For example Connect-ARM pops up a prompt for entering your credentials. And I’ve wanted to be able to query the OMS API from Azure Automation. This lead me to writing my own small OMS module.

First I needed to find a way to authenticate and get token so I can execute web requests with Invoke-WebRequest. On StackOverflow I’ve found the following code. This allows me to get token from Azure AD. What I’ve needed is to load ADAL assembly. In my module I’ve wrote a function Import-ADALDll to do that. For that function and for the Azure Automation module I borrowed some code from my friend and fellow MVP Tao Yang. To get Token I’ve wrote a separate function called Get-AADToken. Now that I have those two pieces in hand I’ve wrote two other functions:

• Get-OMSSavedSearches – This will return all Saved Searches in your OMS workspace. I thought that it will be useful as you can get the actual query and use it later. Result is returned as object.
• Execute-OMSSearchQuery – With this function you will be able to execute queries. Simple as that. Results are returned as object.

The module I’ve created is called OMSSearch and you can find it in GitHub along with small documentation.

After you archive the files from Github into OMSSearch.zip file you can upload that file as module in Azure Automation:

When the module is uploaded you will be able to create OMS Connection. OMS Connection probably is not the right term but here is how mine looks:

You have TenantADName which represents the UPN suffix that is attached to the accounts you create in your Azure AD. You will also create Azure AD account that has co-administrator rights in your subscription or owner/contributor rights on the resource group where your OMS workspaces is located.

You will enter the credentials for that account in the OMS Connection.

Besides those two there are some other prerequisites that you need to have. You can find those in the GItHub page.

After that a simple Runbook like this will returned saved searches:

workflow Get-SavedSearches
{
$OMSCon = Get-AutomationConnection -Name ‘stasoutlook’
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = “3c1d68a5-4064-4522-94e4-e0378165555e”
$ResourceGroupName = “oi-default-east-us”
$OMSWorkspace = “test”    

    Get-OMSSavedSearches -OMSWorkspaceName $OMSWorkspace 
-ResourceGroupName $ResourceGroupName -SubscriptionID $subscriptionId
-Token $Token
}

The other example is with executing queries:

workflow Get-RestartedServers
{
$OMSCon = Get-AutomationConnection -Name ‘stasoutlook’
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = “3c1d68a5-4064-4522-94e4-e03781655555e”
$ResourceGroupName = “oi-default-east-us”
$OMSWorkspace = “test”
$Query = ‘shutdown Type=Event EventLog=System Source=User32 EventID=1074 | Select TimeGenerated,Computer’

    Execute-OMSSearchQuery -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName   
-OMSWorkspaceName $OMSWorkspace -Query $Query
-Token $Token
}

Hope you will find this module useful until may be we have Azure cmdlets for OMS.