Tag: search

Using Custom Log Search Alerts Based on Metric Measurement for Event Based Logs

In Azure Monitor we can create two type of alerts for Log Analytics:

Near real-time metric alerts are scoped to specific performance counter and heartbeat events but with Custom Log Search Alerts you can alert on any log in Log Analytics. With Custom Log Search Alerts the alert logic have two types:

  • Number of results
  • Metric Measurement

In a typical scenario you will use Number of results for logs and events and metric measurement for performance/metric logs. That wouldn’t be a problem if the way the alerts are fired distinguish quite a lot between those. For example in metric measurement you aggregate/summarize results and you alert based on the value from the aggregation/summarization. On top of that different alert instance is fired on each summarized record. In number of results you do not summarize/aggregate and alerts are fired based on the count of the records. For example on 10 records you will get only one alert instead of 10. If you are like me this is a problem as you want to get separate alert instance for your events just like metric measurement alerts.
In this blog post I will show you how to overcome this problem with workaround from the powerful Log Analytics query language.

Continue reading “Using Custom Log Search Alerts Based on Metric Measurement for Event Based Logs” →

Monitoring Windows Services States with Log Analytics

Monitoring Windows Services States is one of the most common requests that I’ve seen on forums, groups and blog posts. My fellow MVP and OMS expert Stefan Roth wrote a similar blog post titled OMS – Monitor Windows Services / Processes. I would suggest to check it out as well. The approach I will show is somehow already cover in official article that demonstrates custom fields in Log Analytics. The difference is that we now have the new rich Log Analytics search syntax so we do not need  custom fields anymore. This approach also is different from Stefan’s as his one covers wider topic with monitoring processes by using performance counters. In this approach we will use windows events which Stefan mentions that is not reliable but he was referring to specific Event Id which I also agree it is not reliable. In the next steps I will use another Event Id that is reliable 100%. The advantage of using windows events for monitoring windows services states are:

  • Only windows events are gathered which results in less data uploaded compared to performance data

  • You do not have to add performance counter for each process, you just need to add only one event log to monitor all services

  • The services are shown with their actual name that is used in services.msc or Get-Service cmdlet.

  • We have the actual state of the service when it happened

Some of the disadvantages of this method are:

  • Until the service is started or stopped it will take at least 5 minutes until the data appears in Log Analytics

Continue reading “Monitoring Windows Services States with Log Analytics” →

Find if You Are Using Only TLS 1.2 Protocol with Log Analytics

I’ve stumbled on a great article by Brandon Wilson named Demystifying Schannel on which he explains how we can enable verbose logging for Schannel to found out what protocols our machines are using. As I leave and breathe Log Analytics and love to crunch data I thought would be cool example if we can ingest that data into it  and show you some cool example with the new query language on transforming data.

Continue reading “Find if You Are Using Only TLS 1.2 Protocol with Log Analytics” →

Less Than 2000 Time Slices Error in OMS Log Analytics – Resolution

I’ve seen a lot of people having the following error appear when they do measurement functions in OMS Log Analytics Search:

Intervals for aggregate functions must result in less than 2000 time slices Unexpected ‘measure’ at position XX.

image

Continue reading “Less Than 2000 Time Slices Error in OMS Log Analytics – Resolution” →

Why My Newly Added Event Log to OMS Not Appearing in Search

This blog post it is kind of short tip but also something you should pay attention to.

You might end up adding a event log to OMS but the events from that log not appearing in OMS. Continue reading “Why My Newly Added Event Log to OMS Not Appearing in Search” →