Frågor för AzureDiagnostics-tabellen
Information om hur du använder dessa frågor i Azure Portal finns i Log Analytics-självstudien. Information om REST-API:et finns i Fråga.
Frågor för microsoft.automation
Fel i automationsjobb
Hitta loggar som rapporterar fel i automationsjobb från den senaste dagen.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION"
| where StreamType_s == "Error"
| project TimeGenerated, Category, JobId_g, OperationName, RunbookName_s, ResultDescription
Hitta loggar som rapporterar fel i automationsjobb från den senaste dagen
Visa en lista över alla fel i automationsjobben.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION"
| where StreamType_s == "Error"
| project TimeGenerated, Category, JobId_g, OperationName, RunbookName_s, ResultDescription, _ResourceId
Azure Automation-jobb som misslyckas, pausas eller stoppas
Visa en lista över alla automationsjobb som misslyckades, pausade eller stoppade.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended")
| project TimeGenerated , RunbookName_s , ResultType , _ResourceId , JobId_g
Runbooken har slutförts med fel
Visa en lista över alla jobb som har slutförts med fel.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobStreams" and StreamType_s == "Error"
| project TimeGenerated , RunbookName_s , StreamType_s , _ResourceId , ResultDescription , JobId_g
Visa status för historiska jobb
Visa en lista över alla automationsjobb.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and ResultType != "started"
| summarize AggregatedValue = count() by ResultType, bin(TimeGenerated, 1h) , RunbookName_s , JobId_g, _ResourceId
Azure Automation-jobb som har slutförts
Visa en lista över alla automationsjobb som har slutförts.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and ResultType == "Completed"
| project TimeGenerated , RunbookName_s , ResultType , _ResourceId , JobId_g
Frågor för microsoft.batch
Lyckade uppgifter per jobb
Anger antalet lyckade aktiviteter per jobb.
AzureDiagnostics
| where OperationName=="TaskCompleteEvent"
| where executionInfo_exitCode_d==0 // Your application may use an exit code other than 0 to denote a successful operation
| summarize successfulTasks=count(id_s) by jobId=jobId_s
Misslyckade uppgifter per jobb
Visar en lista över misslyckade uppgifter efter överordnat jobb.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where OperationName=="TaskFailEvent"
| summarize failedTaskList=make_list(id_s) by jobId=jobId_s, ResourceId
Varaktigheter för aktiviteter
Ger den förflutna tiden för aktiviteter i sekunder, från aktivitetsstart till slutförd aktivitet.
AzureDiagnostics
| where OperationName=="TaskCompleteEvent"
| extend taskId=id_s, ElapsedTime=datetime_diff('second', executionInfo_endTime_t, executionInfo_startTime_t) // For longer running tasks, consider changing 'second' to 'minute' or 'hour'
| summarize taskList=make_list(taskId) by ElapsedTime
Storleksändring för pool
Visa en lista över storleksändringstider efter pool och resultatkod (lyckade eller misslyckade).
AzureDiagnostics
| where OperationName=="PoolResizeCompleteEvent"
| summarize operationTimes=make_list(startTime_s) by poolName=id_s, resultCode=resultCode_s
Fel vid storleksändring av pool
Visa en lista över storleksändringsfel efter felkod och tid.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where OperationName=="PoolResizeCompleteEvent"
| where resultCode_s=="Failure" // Filter only on failed pool resizes
| summarize by poolName=id_s, resultCode=resultCode_s, resultMessage=resultMessage_s, operationTime=startTime_s, ResourceId
Frågor för microsoft.cdn
[Microsoft CDN (klassisk)] Begäranden per timme
Rendera linjediagram som visar den totala begäran per timme.
// Summarize number of requests per hour
// Change bins resolution from 1hr to 5m to get real time results)
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write" and Category == "AzureCdnAccessLog"
| where isReceivedFromClient_b == "true"
| summarize RequestCount = count() by bin(TimeGenerated, 1h), Resource, _ResourceId
| render timechart
[Microsoft CDN (klassisk)] Trafik efter URL
Visa utgående från CDN-gränsen efter URL.
// Change bins resolution from 1 hour to 5 minutes to get real time results)
// CDN edge response traffic by URL
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write" and Category == "AzureCdnAccessLog"
| where isReceivedFromClient_b == true
| summarize ResponseBytes = sum(toint(responseBytes_s)) by requestUri_s
[Microsoft CDN (klassisk)] 4XX-felfrekvens per URL
Visa 4XX-felfrekvens per URL.
// Request errors rate by URL
// Count number of requests with error responses by URL.
// Summarize number of requests by URL, and status codes are 4XX
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write" and Category == "AzureCdnAccessLog" and isReceivedFromClient_b == true
| extend Is4XX = (toint(httpStatusCode_s ) >= 400 and toint(httpStatusCode_s ) < 500)
| summarize 4xxrate = (1.0 * countif(Is4XX) / count()) * 100 by requestUri_s, bin(TimeGenerated, 1h), _ResourceId
[Microsoft CDN (klassisk)] Begära fel av användaragenten
Räkna antalet begäranden med felsvar från användaragenten.
// Summarize number of requests per user agent and status codes >= 400
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write" and Category == "AzureCdnAccessLog"
| where isReceivedFromClient_b == true
| where toint(httpStatusCode_s) >= 400
| summarize RequestCount = count() by UserAgent = userAgent_s, StatusCode = httpStatusCode_s , Resource, _ResourceId
| order by RequestCount desc
[Microsoft CDN (klassisk)] Antal topp 10 URL-begäranden
Visa de 10 främsta URL:erna efter antal begäranden.
// top URLs by request count
// Render line chart showing total requests per hour .
// Summarize number of requests per hour
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write" and Category == "AzureCdnAccessLog"
| where isReceivedFromClient_b == true
| summarize UserRequestCount = count() by requestUri_s
| order by UserRequestCount
| limit 10
[Microsoft CDN (klassisk)] Antal unika IP-begäranden
Visa antal unika IP-begäranden.
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write"and Category == "AzureCdnAccessLog"
| where isReceivedFromClient_b == true
| summarize dcount(clientIp_s) by bin(TimeGenerated, 1h)
| render timechart
[Microsoft CDN (klassisk)] De 10 främsta klient-IP-adresserna och HTTP-versionerna
Visa de 10 främsta klient-IP-adresserna och http-versionerna.
// Top 10 client IPs and http versions
// Show top 10 client IPs and http versions.
// Summarize top 10 client ips and http versions
AzureDiagnostics
| where OperationName == "Microsoft.Cdn/Profiles/AccessLog/Write" and Category == "AzureCdnAccessLog"
| where isReceivedFromClient_b == true
| summarize RequestCount = count() by ClientIP = clientIp_s, HttpVersion = httpVersion_s, Resource
| top 10 by RequestCount
| order by RequestCount desc
[Azure Front Door Standard/Premium] De 20 mest blockerade klienterna efter IP och regel
Visa de 20 mest blockerade klienterna efter IP- och regelnamn.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
| where action_s == "Block"
| summarize RequestCount = count() by ClientIP = clientIP_s, UserAgent = userAgent_s, RuleName = ruleName_s,Resource
| top 20 by RequestCount
| order by RequestCount desc
[Azure Front Door Standard/Premium] Begäranden om ursprung efter väg
Räkna antalet begäranden för varje väg och ursprung per minut. Sammanfatta antalet begäranden per minut för varje väg och ursprung.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| summarize RequestCount = count() by bin(TimeGenerated, 1m), Resource, RouteName = routingRuleName_s, originName = originName_s, ResourceId
[Azure Front Door Standard/Premium] Begära fel av användaragenten
Räkna antalet begäranden med felsvar från användaragenten. Sammanfatta antalet begäranden per användaragent och statuskoder >= 400.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| where toint(httpStatusCode_s) >= 400
| summarize RequestCount = count() by UserAgent = userAgent_s, StatusCode = httpStatusCode_s , Resource, ResourceId
| order by RequestCount desc
[Azure Front Door Standard/Premium] De 10 främsta klient-IP-adresserna och http-versionerna
Visa de 10 främsta klient-IP-adresserna och http-versionerna efter antal begäranden.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| summarize RequestCount = count() by ClientIP = clientIp_s, HttpVersion = httpVersion_s, Resource
|top 10 by RequestCount
| order by RequestCount desc
[Azure Front Door Standard/Premium] Begär fel efter värd och sökväg
Räkna antalet begäranden med felsvar per värd och sökväg. Sammanfatta antalet begäranden per värd, sökväg och statuskoder >= 400.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| where toint(httpStatusCode_s) >= 400
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), StatusCode = httpStatusCode_s, ResourceId
| order by RequestCount desc
[Azure Front Door Standard/Premium] Antal blockerade begäranden i brandväggen per timme
Räkna antalet brandväggsblockerade begäranden per timme. Sammanfatta antalet brandväggsblockerade begäranden per timme efter princip.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
| where action_s == "Block"
| summarize RequestCount = count() by bin(TimeGenerated, 1h), Policy = policy_s, PolicyMode = policyMode_s, Resource, ResourceId
| order by RequestCount desc
[Azure Front Door Standard/Premium] Antal brandväggsbegäranden efter värd, sökväg, regel och åtgärd
Räkna bearbetade brandväggsbegäranden efter värd, sökväg, regel och åtgärd som vidtagits. Sammanfatta antalet begäranden efter värd, sökväg, regel och åtgärd.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), RuleName = ruleName_s, Action = action_s, ResourceId
| order by RequestCount desc
[Azure Front Door Standard/Premium] Begäranden per timme
Rendera linjediagram som visar totalt antal begäranden per timme för varje FrontDoor-resurs.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
| summarize RequestCount = count() by bin(TimeGenerated, 1h), Resource, ResourceId
| render timechart
[Azure Front Door Standard/Premium] Antal topp 10 URL-begäranden
Visa de 10 främsta URL:erna efter antal begäranden.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| summarize UserRequestCount = count() by requestUri_s
| order by UserRequestCount
| limit 10
[Azure Front Door Standard/Premium] Antal topp 10 URL-begäranden
Visa utgående från AFD-gränsen efter URL. Ändra bins resolution från 1 timme till 5m för att få realtidsresultat.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| summarize ResponseBytes = sum(toint(responseBytes_s)) by requestUri_s
[Azure Front Door Standard/Premium] Antal unika IP-begäranden
Visa antalet unika IP-begäranden.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
| summarize dcount(clientIp_s) by bin(TimeGenerated, 1h)
| render timechart
Frågor för microsoft.containerservice
Sök i AzureDiagnostics
Sök i AzureDiagnostics för att söka efter ett specifikt värde i tabellen AzureDiagnostics./nAnteckning om att den här frågan kräver att seachValue-parametern> uppdateras <för att ge resultat
// This query requires a parameter to run. Enter value in SearchValue to find in table.
let SearchValue = "<SearchValue>";//Please update term you would like to find in the table.
AzureDiagnostics
| where ResourceProvider == "Microsoft.ContainerService"
| where * contains tostring(SearchValue)
| take 1000
Frågor för microsoft.dbformariadb
Körningstid som överskrider ett tröskelvärde
Identifiera frågor som deras körningstid överskrider 10 sekunder.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMARIADB"
| where Category == 'MySqlSlowLogs'
| project TimeGenerated, LogicalServerName_s, event_class_s, start_time_t , query_time_d, sql_text_s, ResourceId
| where query_time_d > 10 // You may change the time threshold
Visa de långsammaste frågorna
Identifiera de 5 långsammaste frågorna.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMARIADB"
| where Category == 'MySqlSlowLogs'
| project TimeGenerated, LogicalServerName_s, event_class_s, start_time_t , query_time_d, sql_text_s
| top 5 by query_time_d desc
Visa frågans statistik
Skapa en sammanfattningsstatistiktabell efter fråga.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMARIADB"
| where Category == 'MySqlSlowLogs'
| project TimeGenerated, LogicalServerName_s, event_class_s, start_time_t , query_time_d, sql_text_s
| summarize count(), min(query_time_d), max(query_time_d), avg(query_time_d), stdev(query_time_d), percentile(query_time_d, 95) by LogicalServerName_s ,sql_text_s
| top 50 by percentile_query_time_d_95 desc
Granska granskningslogghändelser i GENERAL-klassen
Identifiera allmänna klasshändelser för servern.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMARIADB"
| where Category == 'MySqlAuditLogs' and event_class_s == "general_log"
| project TimeGenerated, LogicalServerName_s, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
| order by TimeGenerated asc
Granska granskningslogghändelser i CONNECTION-klassen
Identifiera anslutningsrelaterade händelser för servern.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMARIADB"
| where Category == 'MySqlAuditLogs' and event_class_s == "connection_log"
| project TimeGenerated, LogicalServerName_s, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
| order by TimeGenerated asc
Frågor för microsoft.dbformysql
Körningstid som överskrider ett tröskelvärde
Identifiera frågor som deras körningstid överskrider 10 sekunder.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORMYSQL"
| where Category == 'MySqlSlowLogs'
| project TimeGenerated, LogicalServerName_s, event_class_s, start_time_t , query_time_d, sql_text_s, ResourceId
| where query_time_d > 10 //You may change the time threshold
Visa de långsammaste frågorna
Identifiera de 5 långsammaste frågorna.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORMYSQL"
| where Category == 'MySqlSlowLogs'
| project TimeGenerated, LogicalServerName_s, event_class_s, start_time_t , query_time_d, sql_text_s
| top 5 by query_time_d desc
Visa frågans statistik
Skapa en sammanfattningsstatistiktabell efter fråga.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORMYSQL"
| where Category == 'MySqlSlowLogs'
| project TimeGenerated, LogicalServerName_s, event_class_s, start_time_t , query_time_d, sql_text_s
| summarize count(), min(query_time_d), max(query_time_d), avg(query_time_d), stdev(query_time_d), percentile(query_time_d, 95) by LogicalServerName_s ,sql_text_s
| top 50 by percentile_query_time_d_95 desc
Granska granskningslogghändelser i GENERAL-klassen
Identifiera allmänna klasshändelser för servern.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMYSQL"
| where Category == 'MySqlAuditLogs' and event_class_s == "general_log"
| project TimeGenerated, LogicalServerName_s, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
| order by TimeGenerated asc
Granska granskningslogghändelser i CONNECTION-klassen
Identifiera anslutningsrelaterade händelser för servern.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORMYSQL"
| where Category == 'MySqlAuditLogs' and event_class_s == "connection_log"
| project TimeGenerated, LogicalServerName_s, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
| order by TimeGenerated asc
Frågor för microsoft.dbforpostgresql
Autovacuum-händelser
Sök efter autovacuum-händelser under de senaste 24 timmarna. Parametern "log_autovacuum_min_duration" måste vara aktiverad.
AzureDiagnostics
| where TimeGenerated > ago(1d)
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Category == "PostgreSQLLogs"
| where Message contains "automatic vacuum"
Servern startas om
Sök efter serverstängning och serverklara händelser.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Category == "PostgreSQLLogs"
| where Message contains "database system was shut down at" or Message contains "database system is ready to accept"
Hitta fel
Sök efter fel under de senaste 6 timmarna.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where TimeGenerated > ago(6h)
| where Category == "PostgreSQLLogs"
| where errorLevel_s contains "error"
Obehöriga anslutningar
Sök efter otillåtna (avvisade) anslutningsförsök.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Category == "PostgreSQLLogs"
| where Message contains "password authentication failed" or Message contains "no pg_hba.conf entry for host"
Dödlägen
Sök efter dödlägeshändelser.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Category == "PostgreSQLLogs"
| where Message contains "deadlock detected"
Låskonkurrens
Sök efter låskonkurration. Det kräver log_lock_waits=ON och beror på deadlock_timeout inställning.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Message contains "still waiting for ShareLock on transaction"
Granskningsloggar
Hämta alla granskningsloggar. Det kräver att granskningsloggar aktiveras [https://docs.microsoft.com/azure/postgresql/concepts-audit].
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Category == "PostgreSQLLogs"
| where Message contains "AUDIT:"
Granskningsloggar för tabeller och händelsetyper
Sök efter granskningsloggar efter en specifik tabell och händelsetyp DDL. Andra händelsetyper är READ, WRITE, FUNCTION, MISC. Det kräver att granskningsloggar är aktiverade. [https://docs.microsoft.com/azure/postgresql/concepts-audit].
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.DBFORPOSTGRESQL"
| where Category == "PostgreSQLLogs"
| where Message contains "AUDIT:"
| where Message contains "table name" and Message contains "DDL"
Frågor med körningstid som överskrider ett tröskelvärde
Identifiera frågor som tar längre tid än 10 sekunder. Frågearkivet normaliserar faktiska frågor för att aggregera liknande frågor. Som standard aggregeras poster var 15:e minut. Frågan använder genomsnittlig körningstid var 15:e minut och annan frågestatistik, till exempel max, min kan användas efter behov.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORPOSTGRESQL"
| where Category == "QueryStoreRuntimeStatistics"
| where user_id_s != "10" //exclude azure system user
| project TimeGenerated, LogicalServerName_s, event_type_s , mean_time_s , db_id_s , start_time_s , query_id_s, _ResourceId
| where todouble(mean_time_s) > 0 // You may change the time threshold
Långsammaste frågor
Identifiera de 5 långsammaste frågorna.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORPOSTGRESQL"
| where Category == "QueryStoreRuntimeStatistics"
| where user_id_s != "10" //exclude azure system user
| summarize avg(todouble(mean_time_s)) by event_class_s , db_id_s ,query_id_s
| top 5 by avg_mean_time_s desc
Frågestatistik
Skapa en sammanfattningsstatistiktabell efter fråga.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORPOSTGRESQL"
| where Category == "QueryStoreRuntimeStatistics"
| where user_id_s != "10" //exclude azure system user
| summarize sum(toint(calls_s)), min(todouble(min_time_s)),max(todouble(max_time_s)),avg(todouble(mean_time_s)),percentile(todouble(mean_time_s),95) by db_id_s ,query_id_s
| order by percentile_mean_time_s_95 desc nulls last
Trender för körningsantal
Körningstrend efter fråga aggregerad med 15 minuters intervall.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORPOSTGRESQL"
| where Category == "QueryStoreRuntimeStatistics"
| where user_id_s != "10" //exclude azure system user
| summarize sum(toint(calls_s)) by tostring(query_id_s), bin(TimeGenerated, 15m), ResourceId
| render timechart
De vanligaste väntehändelserna
Identifiera de 5 vanligaste väntehändelserna med frågor.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORPOSTGRESQL"
| where Category == "QueryStoreWaitStatistics"
| where user_id_s != "10" //exclude azure system user
| where query_id_s != 0
| summarize sum(toint(calls_s)) by event_s, query_id_s, bin(TimeGenerated, 15m)
| top 5 by sum_calls_s desc nulls last
Trender för väntehändelser
Visa trender för väntehändelser över tid.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DBFORPOSTGRESQL"
| where Category == "QueryStoreWaitStatistics"
| where user_id_s != "10" //exclude azure system user
| extend query_id_s = tostring(query_id_s)
| summarize sum(toint(calls_s)) by event_s, query_id_s, bin(TimeGenerated, 15m), ResourceId // You may change the time threshold
| render timechart
Frågor för microsoft.devices
Connectvity-fel
Identifiera enhetsanslutningsfel.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"
| where Category == "Connections" and Level == "Error"
Enheter med de flesta begränsningsfel
Identifiera enheter som gjorde flest begäranden som resulterade i begränsningsfel.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"
| where ResultType == "429001"
| extend DeviceId = tostring(parse_json(properties_s).deviceId)
| summarize count() by DeviceId, Category , _ResourceId
| order by count_ desc
Slutpunkter
Identifiera döda eller ej felfria slutpunkter efter det antal gånger problemet rapporterades, samt orsaken till varför.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"
| where Category == "Routes" and OperationName in ("endpointDead", "endpointUnhealthy")
| extend parsed_json = parse_json(properties_s)
| extend Endpoint = tostring(parsed_json.endpointName), Reason =tostring(parsed_json.details)
| summarize count() by Endpoint, OperationName, Reason, _ResourceId
| order by count_ desc
Felsammanfattning
Antal fel för alla åtgärder efter typ.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"
| where Level == "Error"
| summarize count() by ResultType, ResultDescription, Category, _ResourceId
Nyligen anslutna enheter
Lista över enheter som IoT Hub såg ansluta under den angivna tidsperioden.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"
| where Category == "Connections" and OperationName == "deviceConnect"
| extend DeviceId = tostring(parse_json(properties_s).deviceId)
| summarize max(TimeGenerated) by DeviceId, _ResourceId
SDK-version av enheter
Lista över enheter och deras SDK-versioner.
// this query works on device connection or when your device uses device to cloud twin operations
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"
| where Category == "Connections" or Category == "D2CTwinOperations"
| extend parsed_json = parse_json(properties_s)
| extend SDKVersion = tostring(parsed_json.sdkVersion) , DeviceId = tostring(parsed_json.deviceId)
| distinct DeviceId, SDKVersion, TimeGenerated, _ResourceId
Frågor för microsoft.documentdb
Förbrukade RU/s under de senaste 24 timmarna
Identifiera förbrukade RU/s i Cosmos-databaser och -samlingar.
// To create an alert for this query, click '+ New alert rule'
//You can compare the RU/s consumption with your provisioned RU/s to determine if you should scale up or down RU/s based on your workload.
AzureDiagnostics
| where TimeGenerated >= ago(24hr)
| where Category == "DataPlaneRequests"
//| where collectionName_s == "CollectionToAnalyze" //Replace to target the query to a collection
| summarize ConsumedRUsPerMinute = sum(todouble(requestCharge_s)) by collectionName_s, _ResourceId, bin(TimeGenerated, 1m)
| project TimeGenerated , ConsumedRUsPerMinute , collectionName_s, _ResourceId
| render timechart
Samlingar med begränsningar (429) under de senaste 24 timmarna
Identifiera samlingar och åtgärder som har tagit emot 429 (begränsningar), som inträffar när förbrukat dataflöde (RU/s) överskrider etablerat dataflöde.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where TimeGenerated >= ago(24hr)
| where Category == "DataPlaneRequests"
| where statusCode_s == 429
| summarize numberOfThrottles = count() by databaseName_s, collectionName_s, requestResourceType_s, _ResourceId, bin(TimeGenerated, 1hr)
| order by numberOfThrottles
De vanligaste åtgärderna efter förbrukade enheter för programbegäran (RU: er) under de senaste 24 timmarna
Identifiera de viktigaste åtgärderna för Cosmos-resurser efter antal och förbrukade RU per åtgärd.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where Category == "DataPlaneRequests"
| summarize numberOfOperations = count(), totalConsumedRU = sum(todouble(requestCharge_s)) by databaseName_s, collectionName_s, OperationName, requestResourceType_s, requestResourceId_s, _ResourceId
| extend averageRUPerOperation = totalConsumedRU / numberOfOperations
| order by numberOfOperations
De viktigaste logiska partitionsnycklarna efter lagring
Identifiera de största värdena för logisk partitionsnyckel. PartitionKeyStatistics genererar data för de viktigaste logiska partitionsnycklarna efter lagring.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where Category == "PartitionKeyStatistics"
//| where collectionName_s == "CollectionToAnalyze" //Replace to target the query to a collection
| summarize arg_max(TimeGenerated, *) by databaseName_s, collectionName_s, partitionKey_s, _ResourceId //Get the latest storage size
| extend utilizationOf20GBLogicalPartition = sizeKb_d / 20000000 //20GB
| project TimeGenerated, databaseName_s , collectionName_s , partitionKey_s, sizeKb_d, utilizationOf20GBLogicalPartition, _ResourceId
Frågor för microsoft.eventhub
[Klassisk] Varaktighet för avbildningsfel
Sammanfattar duarationen av fel vid avbildning.
AzureDiagnostics
| where ResourceProvider == \"MICROSOFT.EVENTHUB\"
| where Category == \"ArchiveLogs\"
| summarize count() by \"failures\", \"durationInSeconds\", _ResourceId
[Klassisk] Anslutningsbegäran för klienten
Sammanfattade statusen för anslutningsbegäran för klienten.
AzureDiagnostics // Need to turn on the Capture for this
| where ResourceProvider == \"MICROSOFT.EVENTHUB\"
| project \"OperationName\"
[Klassisk] Åtkomst till keyvault – nyckeln hittades inte
Sammanfattar åtkomsten till keyvault när nyckeln inte hittas.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == \"MICROSOFT.EVENTHUB\"
| where Category == \"Error\" and OperationName == \"wrapkey\"
| project Message, _ResourceId
[Klassisk] Åtgärd som utförs med keyvault
Sammanfattar den åtgärd som utförs med keyvault för att inaktivera eller återställa nyckeln.
AzureDiagnostics
| where ResourceProvider == \"MICROSOFT.EVENTHUB\"
| where Category == \"info\" and OperationName == \"disable\" or OperationName == \"restore\"
| project Message
Fel under de senaste 7 dagarna
Här visas alla fel för de senaste 7 dagarna.
AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where Category == "OperationalLogs"
| summarize count() by "EventName", _ResourceId
Varaktighet för avbildningsfel
Sammanfattar duarationen av fel vid avbildning.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.EVENTHUB"
| where Category == "ArchiveLogs"
| summarize count() by "failures", "durationInSeconds", _ResourceId
Anslutningsbegäran för klienten
Sammanfattade statusen för anslutningsbegäran för klienten.
AzureDiagnostics // Need to turn on the Capture for this
| where ResourceProvider == "MICROSOFT.EVENTHUB"
| project "OperationName"
Åtkomst till keyvault – nyckeln hittades inte
Sammanfattar åtkomsten till keyvault när nyckeln inte hittas.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.EVENTHUB"
| where Category == "Error" and OperationName == "wrapkey"
| project Message, ResourceId
Åtgärd som utförs med keyvault
Sammanfattar den åtgärd som utförs med keyvault för att inaktivera eller återställa nyckeln.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.EVENTHUB"
| where Category == "info" and OperationName == "disable" or OperationName == "restore"
| project Message
Frågor för microsoft.keyvault
[Klassisk] Hur aktiv har keyVault varit?
[Klassisk] Linjediagram som visar trenden för KeyVault-begärandens volym, per åtgärd över tid.
// KeyVault diagnostic currently stores logs in AzureDiagnostics table which stores logs for multiple services.
// Filter on ResourceProvider for logs specific to a service.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.KEYVAULT"
| summarize count() by bin(TimeGenerated, 1h), OperationName // Aggregate by hour
| render timechart
[Klassisk] Vem anropar den här KeyVault?
[Klassisk] Lista över uppringare som identifieras av deras IP-adress med antalet förfrågningar.
// KeyVault diagnostic currently stores logs in AzureDiagnostics table which stores logs for multiple services.
// Filter on ResourceProvider for logs specific to a service.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.KEYVAULT"
| summarize count() by CallerIPAddress
[Klassisk] Finns det några långsamma begäranden?
[Klassisk] Lista över KeyVault-begäranden som tog längre tid än 1 s.
// To create an alert for this query, click '+ New alert rule'
let threshold=1000; // let operator defines a constant that can be further used in the query
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.KEYVAULT"
| where DurationMs > threshold
| summarize count() by OperationName, _ResourceId
[Klassisk] Hur snabbt betjänar den här KeyVault-begäranden?
[Klassisk] Linjediagram som visar trenden för begärandevaraktighet över tid med hjälp av olika sammansättningar.
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.KEYVAULT"
| summarize avg(DurationMs) by requestUri_s, bin(TimeGenerated, 1h) // requestUri_s contains the URI of the request
| render timechart
[Klassisk] Finns det några fel?
[Klassisk] Antal misslyckade KeyVault-begäranden efter statuskod.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider =="MICROSOFT.KEYVAULT"
| where httpStatusCode_d >= 300 and not(OperationName == "Authentication" and httpStatusCode_d == 401)
| summarize count() by requestUri_s, ResultSignature, _ResourceId
// ResultSignature contains HTTP status, e.g. "OK" or "Forbidden"
// httpStatusCode_d contains HTTP status code returned by the request (e.g. 200, 300 or 401)
// requestUri_s contains the URI of the request
[Klassisk] Vilka ändringar inträffade förra månaden?
[Klassisk] Visar en lista över alla uppdaterings- och korrigeringsbegäranden från de senaste 30 dagarna.
// KeyVault diagnostic currently stores logs in AzureDiagnostics table which stores logs for multiple services.
// Filter on ResourceProvider for logs specific to a service.
AzureDiagnostics
| where TimeGenerated > ago(30d) // Time range specified in the query. Overrides time picker in portal.
| where ResourceProvider =="MICROSOFT.KEYVAULT"
| where OperationName == "VaultPut" or OperationName == "VaultPatch"
| sort by TimeGenerated desc
[Klassisk] Visa en lista över alla indatadeserialiseringsfel
[Klassisk] Visar fel som orsakats på grund av felaktiga händelser som inte kunde deserialiseras av jobbet.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT" and parse_json(properties_s).DataErrorType in ("InputDeserializerError.InvalidData", "InputDeserializerError.TypeConversionError", "InputDeserializerError.MissingColumns", "InputDeserializerError.InvalidHeader", "InputDeserializerError.InvalidCompressionType")
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
[Klassisk] Sök i AzureDiagnostics
[Klassisk] Sök i AzureDiagnostics för att söka efter ett specifikt värde i tabellen AzureDiagnostics./nAnteckning om att den här frågan kräver att seachValue-parametern> uppdateras <för att ge resultat
// This query requires a parameter to run. Enter value in SearchValue to find in table.
let SearchValue = "<SearchValue>";//Please update term you would like to find in the table.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where * contains tostring(SearchValue)
| take 1000
Frågor för microsoft.logic
Totalt antal fakturerbara körningar
Totalt antal fakturerbara körningar efter åtgärdsnamn.
// Total billable executions
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where Category == "WorkflowRuntime"
| where OperationName has "workflowTriggerStarted" or OperationName has "workflowActionStarted"
| summarize dcount(resource_runId_s) by OperationName, resource_workflowName_s
Distribution av Logic App-körning efter arbetsflöden
Tidsschema per timme för Logic App-körning, distribution efter arbetsflöden.
// Hourly Time chart for Logic App execution distribution by workflows
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where Category == "WorkflowRuntime"
| where OperationName has "workflowRunStarted"
| summarize dcount(resource_runId_s) by bin(TimeGenerated, 1h), resource_workflowName_s
| render timechart
Logic App-körningsdistribution efter status
Slutförda körningar efter arbetsflöde, status och fel.
//logic app execution status summary
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where OperationName has "workflowRunCompleted"
| summarize dcount(resource_runId_s) by resource_workflowName_s, status_s, error_code_s
| project LogicAppName = resource_workflowName_s , NumberOfExecutions = dcount_resource_runId_s , RunStatus = status_s , Error = error_code_s
Antal utlösta fel
Visa åtgärds-/utlösarfel för alla Logic App-körningar efter resursnamn.
// To create an alert for this query, click '+ New alert rule'
//Action/Trigger failures for all Logic App executions
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where Category == "WorkflowRuntime"
| where status_s == "Failed"
| where OperationName has "workflowActionCompleted" or OperationName has "workflowTriggerCompleted"
| extend ResourceName = coalesce(resource_actionName_s, resource_triggerName_s)
| extend ResourceCategory = substring(OperationName, 34, strlen(OperationName) - 43) | summarize dcount(resource_runId_s) by code_s, ResourceName, resource_workflowName_s, ResourceCategory, _ResourceId
| project ResourceCategory, ResourceName , FailureCount = dcount_resource_runId_s , ErrorCode = code_s, LogicAppName = resource_workflowName_s, _ResourceId
| order by FailureCount desc
Frågor för microsoft.network
Begäranden per timme
Antal inkommande begäranden på Application Gateway.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess"
| summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
| render timechart
Icke-SSL-begäranden per timme
Antal icke-SSL-begäranden på Application Gateway.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and sslEnabled_s == "off"
| summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
| render timechart
Misslyckade begäranden per timme
Antal begäranden som Application Gateway svarade på med ett fel.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and httpStatus_d > 399
| summarize AggregatedValue = count() by bin(TimeGenerated, 1h), _ResourceId
| render timechart
Fel per användaragent
Antal fel per användaragent.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and httpStatus_d > 399
| summarize AggregatedValue = count() by userAgent_s, _ResourceId
| sort by AggregatedValue desc
Fel efter URI
Antal fel per URI.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and httpStatus_d > 399
| summarize AggregatedValue = count() by requestUri_s, _ResourceId
| sort by AggregatedValue desc
De 10 främsta klient-IP-adresserna
Antal begäranden per klient-IP.
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess"
| summarize AggregatedValue = count() by clientIP_s
| top 10 by AggregatedValue
De vanligaste HTTP-versionerna
Antal begäranden per HTTP-version.
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess"
| summarize AggregatedValue = count() by httpVersion_s
| top 10 by AggregatedValue
Nätverkssäkerhetshändelser
Hitta Rapporter om nätverkssäkerhetshändelser blockerade inkommande trafik.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK"
| where Category == "NetworkSecurityGroupEvent"
| where direction_s == "In" and type_s == "block"
Begäranden per timme
Rendera linjediagram som visar totalt antal begäranden per timme för varje FrontDoor-resurs.
// Summarize number of requests per hour for each FrontDoor resource
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| summarize RequestCount = count() by bin(TimeGenerated, 1h), Resource, ResourceId
| render timechart
Vidarebefordrade serverdelsbegäranden genom routningsregel
Räkna antalet begäranden för varje routningsregel och serverdelsvärd per minut.
// Summarize number of requests per minute for each routing rule and backend host
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| summarize RequestCount = count() by bin(TimeGenerated, 1m), Resource, RoutingRuleName = routingRuleName_s, BackendHostname = backendHostname_s, ResourceId
Begär fel efter värd och sökväg
Räkna antalet begäranden med felsvar per värd och sökväg.
// Summarize number of requests by host, path, and status codes >= 400
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where toint(httpStatusCode_s) >= 400
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), StatusCode = httpStatusCode_s, ResourceId
| order by RequestCount desc
Begära fel av användaragenten
Räkna antalet begäranden med felsvar från användaragenten.
// Summarize number of requests per user agent and status codes >= 400
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where toint(httpStatusCode_s) >= 400
| summarize RequestCount = count() by UserAgent = userAgent_s, StatusCode = httpStatusCode_s , Resource, ResourceId
| order by RequestCount desc
De 10 främsta klient-IP-adresserna och http-versionerna
Visa de 10 främsta klient-IP-adresserna och http-versionerna.
// Summarize top 10 client ips and http versions
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| summarize RequestCount = count() by ClientIP = clientIp_s, HttpVersion = httpVersion_s, Resource
| top 10 by RequestCount
| order by RequestCount desc
Antal blockerade begäranden i brandväggen per timme
Räkna antalet brandväggsblockerade begäranden per timme.
// Summarize number of firewall blocked requests per hour by policy
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorWebApplicationFirewallLog"
| where action_s == "Block"
| summarize RequestCount = count() by bin(TimeGenerated, 1h), Policy = policy_s, PolicyMode = policyMode_s, Resource, ResourceId
| order by RequestCount desc
De 20 mest blockerade klienterna efter IP och regel
Visa de 20 mest blockerade klienterna efter IP- och regelnamn.
// Summarize top 20 blocked clients by IP and rule
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorWebApplicationFirewallLog"
| where action_s == "Block"
| summarize RequestCount = count() by ClientIP = clientIP_s, UserAgent = userAgent_s, RuleName = ruleName_s ,Resource
| top 20 by RequestCount
| order by RequestCount desc
Antal brandväggsbegäranden efter värd, sökväg, regel och åtgärd
Räkna bearbetade brandväggsbegäranden efter värd, sökväg, regel och åtgärd som vidtagits.
// Summarize request count by host, path, rule, and action
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorWebApplicationFirewallLog"
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), RuleName = ruleName_s, Action = action_s, ResourceId
| order by RequestCount desc
Loggdata för programregel
Parsar loggdata för programregeln.
AzureDiagnostics
| where Category == "AzureFirewallApplicationRule"
//this first parse statement is valid for all entries as they all start with this format
| parse msg_s with Protocol " request from " SourceIP ":" SourcePort:int *
//Parse action as this is the same for all log lines
| parse kind=regex flags=U msg_s with * ". Action\\: " Action "\\."
// case1: Action: A. Reason: R.
| parse kind=regex flags=U msg_s with "\\. Reason\\: " Reason "\\."
//case 2a: to FQDN:PORT Url: U. Action: A. Policy: P. Rule Collection Group: RCG. Rule Collection: RC. Rule: R.
| parse msg_s with * "to " FQDN ":" TargetPort:int * "." *
//Parse policy if present
| parse msg_s with * ". Policy: " Policy ". Rule Collection Group: " RuleCollectionGroup "." *
| parse msg_s with * " Rule Collection: " RuleCollection ". Rule: " Rule
//case 2.b: Web Category: WC.
| parse Rule with * ". Web Category: " WebCategory
//case 3: No rule matched. Proceeding with default action"
| extend DefaultRule = iff(msg_s contains "No rule matched. Proceeding with default action", true, false)
| extend
SourcePort = tostring(SourcePort),
TargetPort = tostring(TargetPort)
| extend
Action = case(Action == "","N/A", case(DefaultRule, "Deny" ,Action)),
FQDN = case(FQDN == "", "N/A", FQDN),
TargetPort = case(TargetPort == "", "N/A", tostring(TargetPort)),
Policy = case(RuleCollection contains ":", split(RuleCollection, ":")[0] ,case(Policy == "", "N/A", Policy)),
RuleCollectionGroup = case(RuleCollection contains ":", split(RuleCollection, ":")[1], case(RuleCollectionGroup == "", "N/A", RuleCollectionGroup)),
RuleCollection = case(RuleCollection contains ":", split(RuleCollection, ":")[2], case(RuleCollection == "", "N/A", RuleCollection)),
WebCategory = case(WebCategory == "", "N/A", WebCategory),
Rule = case(Rule == "" , "N/A", case(WebCategory == "N/A", Rule, split(Rule, '.')[0])),
Reason = case(Reason == "", case(DefaultRule, "No rule matched - default action", "N/A"), Reason )
| project TimeGenerated, msg_s, Protocol, SourceIP, SourcePort, FQDN, TargetPort, Action, Policy, RuleCollectionGroup, RuleCollection, Rule, Reason ,WebCategory
Loggdata för nätverksregel
Parsar loggdata för nätverksregeln.
AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where OperationName == "AzureFirewallNatRuleLog" or OperationName == "AzureFirewallNetworkRuleLog"
//case 1: for records that look like this:
//PROTO request from IP:PORT to IP:PORT.
| parse msg_s with Protocol " request from " SourceIP ":" SourcePortInt:int " to " TargetIP ":" TargetPortInt:int *
//case 1a: for regular network rules
| parse kind=regex flags=U msg_s with * ". Action\\: " Action1a "\\."
//case 1b: for NAT rules
//TCP request from IP:PORT to IP:PORT was DNAT'ed to IP:PORT
| parse msg_s with * " was " Action1b:string " to " TranslatedDestination:string ":" TranslatedPort:int *
//Parse rule data if present
| parse msg_s with * ". Policy: " Policy ". Rule Collection Group: " RuleCollectionGroup "." *
| parse msg_s with * " Rule Collection: " RuleCollection ". Rule: " Rule
//case 2: for ICMP records
//ICMP request from 10.0.2.4 to 10.0.3.4. Action: Allow
| parse msg_s with Protocol2 " request from " SourceIP2 " to " TargetIP2 ". Action: " Action2
| extend
SourcePort = tostring(SourcePortInt),
TargetPort = tostring(TargetPortInt)
| extend
Action = case(Action1a == "", case(Action1b == "",Action2,Action1b), split(Action1a,".")[0]),
Protocol = case(Protocol == "", Protocol2, Protocol),
SourceIP = case(SourceIP == "", SourceIP2, SourceIP),
TargetIP = case(TargetIP == "", TargetIP2, TargetIP),
//ICMP records don't have port information
SourcePort = case(SourcePort == "", "N/A", SourcePort),
TargetPort = case(TargetPort == "", "N/A", TargetPort),
//Regular network rules don't have a DNAT destination
TranslatedDestination = case(TranslatedDestination == "", "N/A", TranslatedDestination),
TranslatedPort = case(isnull(TranslatedPort), "N/A", tostring(TranslatedPort)),
//Rule information
Policy = case(Policy == "", "N/A", Policy),
RuleCollectionGroup = case(RuleCollectionGroup == "", "N/A", RuleCollectionGroup ),
RuleCollection = case(RuleCollection == "", "N/A", RuleCollection ),
Rule = case(Rule == "", "N/A", Rule)
| project TimeGenerated, msg_s, Protocol, SourceIP,SourcePort,TargetIP,TargetPort,Action, TranslatedDestination, TranslatedPort, Policy, RuleCollectionGroup, RuleCollection, Rule
Loggdata för hotinformationsregel
Parsar loggdata för hotinformationsregeln.
AzureDiagnostics
| where OperationName == "AzureFirewallThreatIntelLog"
| parse msg_s with Protocol " request from " SourceIP ":" SourcePortInt:int " to " TargetIP ":" TargetPortInt:int *
| parse msg_s with * ". Action: " Action "." Message
| parse msg_s with Protocol2 " request from " SourceIP2 " to " TargetIP2 ". Action: " Action2
| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt)
| extend Protocol = case(Protocol == "", Protocol2, Protocol),SourceIP = case(SourceIP == "", SourceIP2, SourceIP),TargetIP = case(TargetIP == "", TargetIP2, TargetIP),SourcePort = case(SourcePort == "", "N/A", SourcePort),TargetPort = case(TargetPort == "", "N/A", TargetPort)
| sort by TimeGenerated desc
| project TimeGenerated, msg_s, Protocol, SourceIP,SourcePort,TargetIP,TargetPort,Action,Message
Loggdata för Azure Firewall
Börja med den här frågan om du vill parsa loggarna från nätverksregler, programregler, NAT-regler, IDS, hotinformation och mer för att förstå varför viss trafik tilläts eller nekades. Den här frågan visar de sista 100 loggposterna, men genom att lägga till enkla filterinstruktioner i slutet av frågan kan resultatet justeras.
// Parses the azure firewall rule log data.
// Includes network rules, application rules, threat intelligence, ips/ids, ...
AzureDiagnostics
| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule"
//optionally apply filters to only look at a certain type of log data
//| where OperationName == "AzureFirewallNetworkRuleLog"
//| where OperationName == "AzureFirewallNatRuleLog"
//| where OperationName == "AzureFirewallApplicationRuleLog"
//| where OperationName == "AzureFirewallIDSLog"
//| where OperationName == "AzureFirewallThreatIntelLog"
| extend msg_original = msg_s
// normalize data so it's eassier to parse later
| extend msg_s = replace(@'. Action: Deny. Reason: SNI TLS extension was missing.', @' to no_data:no_data. Action: Deny. Rule Collection: default behavior. Rule: SNI TLS extension missing', msg_s)
| extend msg_s = replace(@'No rule matched. Proceeding with default action', @'Rule Collection: default behavior. Rule: no rule matched', msg_s)
// extract web category, then remove it from further parsing
| parse msg_s with * " Web Category: " WebCategory
| extend msg_s = replace(@'(. Web Category:).*','', msg_s)
// extract RuleCollection and Rule information, then remove it from further parsing
| parse msg_s with * ". Rule Collection: " RuleCollection ". Rule: " Rule
| extend msg_s = replace(@'(. Rule Collection:).*','', msg_s)
// extract Rule Collection Group information, then remove it from further parsing
| parse msg_s with * ". Rule Collection Group: " RuleCollectionGroup
| extend msg_s = replace(@'(. Rule Collection Group:).*','', msg_s)
// extract Policy information, then remove it from further parsing
| parse msg_s with * ". Policy: " Policy
| extend msg_s = replace(@'(. Policy:).*','', msg_s)
// extract IDS fields, for now it's always add the end, then remove it from further parsing
| parse msg_s with * ". Signature: " IDSSignatureIDInt ". IDS: " IDSSignatureDescription ". Priority: " IDSPriorityInt ". Classification: " IDSClassification
| extend msg_s = replace(@'(. Signature:).*','', msg_s)
// extra NAT info, then remove it from further parsing
| parse msg_s with * " was DNAT'ed to " NatDestination
| extend msg_s = replace(@"( was DNAT'ed to ).*",". Action: DNAT", msg_s)
// extract Threat Intellingence info, then remove it from further parsing
| parse msg_s with * ". ThreatIntel: " ThreatIntel
| extend msg_s = replace(@'(. ThreatIntel:).*','', msg_s)
// extract URL, then remove it from further parsing
| extend URL = extract(@"(Url: )(.*)(\. Action)",2,msg_s)
| extend msg_s=replace(@"(Url: .*)(Action)",@"\2",msg_s)
// parse remaining "simple" fields
| parse msg_s with Protocol " request from " SourceIP " to " Target ". Action: " Action
| extend
SourceIP = iif(SourceIP contains ":",strcat_array(split(SourceIP,":",0),""),SourceIP),
SourcePort = iif(SourceIP contains ":",strcat_array(split(SourceIP,":",1),""),""),
Target = iif(Target contains ":",strcat_array(split(Target,":",0),""),Target),
TargetPort = iif(SourceIP contains ":",strcat_array(split(Target,":",1),""),""),
Action = iif(Action contains ".",strcat_array(split(Action,".",0),""),Action),
Policy = case(RuleCollection contains ":", split(RuleCollection, ":")[0] ,Policy),
RuleCollectionGroup = case(RuleCollection contains ":", split(RuleCollection, ":")[1], RuleCollectionGroup),
RuleCollection = case(RuleCollection contains ":", split(RuleCollection, ":")[2], RuleCollection),
IDSSignatureID = tostring(IDSSignatureIDInt),
IDSPriority = tostring(IDSPriorityInt)
| project msg_original,TimeGenerated,Protocol,SourceIP,SourcePort,Target,TargetPort,URL,Action, NatDestination, OperationName,ThreatIntel,IDSSignatureID,IDSSignatureDescription,IDSPriority,IDSClassification,Policy,RuleCollectionGroup,RuleCollection,Rule,WebCategory
| order by TimeGenerated
| limit 100
Azure Firewall DNS-proxyloggdata
Börja med den här frågan om du vill förstå dns-proxyloggdata för brandväggen. Den här frågan visar de sista 100 loggposterna, men genom att lägga till enkla filterinstruktioner i slutet av frågan kan resultatet justeras.
// DNS proxy log data
// Parses the DNS proxy log data.
AzureDiagnostics
| where Category == "AzureFirewallDnsProxy"
| parse msg_s with "DNS Request: " SourceIP ":" SourcePortInt:int " - " QueryID:int " " RequestType " " RequestClass " " hostname ". " protocol " " details
| extend
ResponseDuration = extract("[0-9]*.?[0-9]+s$", 0, msg_s),
SourcePort = tostring(SourcePortInt),
QueryID = tostring(QueryID)
| project TimeGenerated,SourceIP,hostname,RequestType,ResponseDuration,details,msg_s
| order by TimeGenerated
| limit 100
BGP-routningstabell
BPG-routningstabellen har lärts under de senaste 12 timmarna.
AzureDiagnostics
| where TimeGenerated > ago(12h)
| where ResourceType == "EXPRESSROUTECIRCUITS"
| project TimeGenerated , ResourceType , network_s , path_s , OperationName
BGP-informationsmeddelanden
BGP-informationsmeddelanden efter nivå, resurstyp och nätverk.
AzureDiagnostics
| where Level == "Informational"
| project TimeGenerated , ResourceId, Level, ResourceType , network_s , path_s
Slutpunkter med övervakningsstatusen nere
Ta reda på orsaken till att övervakningsstatusen för Azure Traffic Manager-slutpunkter är nere.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceType == "TRAFFICMANAGERPROFILES" and Category == "ProbeHealthStatusEvents"
| where Status_s == "Down"
| project TimeGenerated, EndpointName_s, Status_s, ResultDescription, SubscriptionId , _ResourceId
Lyckade P2S-anslutningar
Lyckade P2S-anslutningar under de senaste 12 timmarna.
AzureDiagnostics
| where TimeGenerated > ago(12h)
| where Category == "P2SDiagnosticLog" and Message has "Connection successful"
| project TimeGenerated, Resource ,Message
P2S-anslutningar misslyckades
P2S-anslutningar misslyckades under de senaste 12 timmarna.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where TimeGenerated > ago(12h)
| where Category == "P2SDiagnosticLog" and Message has "Connection failed"
| project TimeGenerated, Resource ,Message
Ändringar i gatewaykonfigurationen
Lyckade gatewaykonfigurationsändringar som gjorts av administratören under de senaste 24 timmarna.
AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category == "GatewayDiagnosticLog" and operationStatus_s == "Success" and configuration_ConnectionTrafficType_s == "Internet"
| project TimeGenerated, Resource, OperationName, Message, operationStatus_s
S2S-tunnel connet/koppla från händelser
S2S-tunnel connet/koppla från händelser under de senaste 24 timmarna.
AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category == "TunnelDiagnosticLog" and (status_s == "Connected" or status_s == "Disconnected")
| project TimeGenerated, Resource , status_s, remoteIP_s, stateChangeReason_s
BGP-routningsuppdateringar
BGP-väguppdateringar under de senaste 24 timmarna.
AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category == "RouteDiagnosticLog" and OperationName == "BgpRouteUpdate"
Visa loggar från AzureDiagnostics-tabellen
Visar de senaste loggarna i AzureDiagnostics-tabellen, sorterade efter tid (senaste först).
AzureDiagnostics
| top 10 by TimeGenerated
Frågor för microsoft.recoveryservices
Misslyckade säkerhetskopieringsjobb
Hitta loggar som rapporterade misslyckade säkerhetskopieringsjobb från den senaste dagen.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.RECOVERYSERVICES" and Category == "AzureBackupReport"
| where OperationName == "Job" and JobOperation_s == "Backup" and JobStatus_s == "Failed"
| project TimeGenerated, JobUniqueId_g, JobStartDateTime_s, JobOperation_s, JobOperationSubType_s, JobStatus_s , JobFailureCode_s, JobDurationInSecs_s , AdHocOrScheduledJob_s
Frågor för microsoft.servicebus
[Klassisk] Listhanteringsåtgärder
Här visas alla hanteringsanrop.
AzureDiagnostics
| where ResourceProvider ==\"MICROSOFT.SERVICEBUS\"
| where Category == \"OperationalLogs\"
| summarize count() by EventName_s, _ResourceId
[Klassisk] Felsammanfattning
Sammanfattar alla fel som påträffas.
AzureDiagnostics
| where ResourceProvider ==\"MICROSOFT.SERVICEBUS\"
| where Category == \"Error\"
| summarize count() by EventName_s, _ResourceId
[Klassisk] Keyvault-åtkomstförsök – nyckeln hittades inte
Sammanfattar åtkomsten till keyvault när nyckeln inte hittas.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == \"MICROSOFT.SERVICEBUS\"
| where Category == \"Error\" and OperationName == \"wrapkey\"
| project Message, _ResourceId
[Klassisk] Autota bort entiteter
Sammanfattning av alla entiteter som har tagits bort automatiskt.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == \"MICROSOFT.SERVICEBUS\"
| where Category == \"OperationalLogs\"
| where EventName_s startswith \"AutoDelete\"
| summarize count() by EventName_s, _ResourceId
[Klassisk] Keyvault har utförts i drift
Sammanfattar den åtgärd som utförs med keyvault för att inaktivera eller återställa nyckeln.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == \"MICROSOFT.SERVICEBUS\"
| where (Category == \"info\" and (OperationName == \"disable\" or OperationName == \"restore\"))
| project Message, _ResourceId
Hanteringsåtgärder under de senaste 7 dagarna
Här visas alla hanteringsanrop under de senaste 7 dagarna.
AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider =="MICROSOFT.SERVICEBUS"
| where Category == "OperationalLogs"
| summarize count() by EventName_s, _ResourceId
Sammanfattning av fel
Sammanfattar alla fel som har setts under de senaste 7 dagarna.
AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider =="MICROSOFT.SERVICEBUS"
| where Category == "Error"
| summarize count() by EventName_s, _ResourceId
Keyvault-åtkomstförsök – nyckeln hittades inte
Sammanfattar åtkomsten till keyvault när nyckeln inte hittas.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SERVICEBUS"
| where Category == "Error" and OperationName == "wrapkey"
| project Message, _ResourceId
Autota bort entiteter
Sammanfattning av alla entiteter som har tagits bort automatiskt.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SERVICEBUS"
| where Category == "OperationalLogs"
| where EventName_s startswith "AutoDelete"
| summarize count() by EventName_s, _ResourceId
Keyvault har utförts i drift
Sammanfattar den åtgärd som utförs med keyvault för att inaktivera eller återställa nyckeln.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SERVICEBUS"
| where (Category == "info" and (OperationName == "disable" or OperationName == "restore"))
| project Message, _ResourceId
Frågor om microsoft.sql
Lagring på hanterade instanser över 90 %
Visa alla hanterade instanser med lagringsanvändning över 90 %.
// To create an alert for this query, click '+ New alert rule'
let storage_percentage_threshold = 90;
AzureDiagnostics
| where Category =="ResourceUsageStats"
| summarize (TimeGenerated, calculated_storage_percentage) = arg_max(TimeGenerated, todouble(storage_space_used_mb_s) *100 / todouble (reserved_storage_mb_s))
by _ResourceId
| where calculated_storage_percentage > storage_percentage_threshold
Processoranvändningen överskrider 95 % på hanterade instanser
Visa alla hanterade instanser där CPU-treshold är över 95 % av treshold.
// To create an alert for this query, click '+ New alert rule'
let cpu_percentage_threshold = 95;
let time_threshold = ago(1h);
AzureDiagnostics
| where Category == "ResourceUsageStats" and TimeGenerated > time_threshold
| summarize avg_cpu = max(todouble(avg_cpu_percent_s)) by _ResourceId
| where avg_cpu > cpu_percentage_threshold
Visa alla aktiva intelligenta insikter
Visa alla aktiva prestandaproblem som identifieras av intelligenta insikter. Observera att SQLInsights-loggen måste aktiveras för varje databas som övervakas.
AzureDiagnostics
| where Category == "SQLInsights" and status_s == "Active"
| distinct rootCauseAnalysis_s
Väntestatistik
Vänta statistik under den senaste timmen, efter logisk server och databas.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SQL"
| where TimeGenerated >= ago(60min)
| parse _ResourceId with * "/microsoft.sql/servers/" LogicalServerName "/databases/" DatabaseName
| summarize Total_count_60mins = sum(delta_waiting_tasks_count_d) by LogicalServerName, DatabaseName, wait_type_s
Frågor för microsoft.streamanalytics
Visa en lista över alla indatafel
Visar alla fel som inträffade när data bearbetades från indata.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).Type == "DataError"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla indatadeserialiseringsfel
Visar fel som orsakats på grund av felaktiga händelser som inte kunde deserialiseras av jobbet.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType in ("InputDeserializerError.InvalidData", "InputDeserializerError.TypeConversionError", "InputDeserializerError.MissingColumns", "InputDeserializerError.InvalidHeader", "InputDeserializerError.InvalidCompressionType")
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla InvalidInputTimeStamp-fel
Visar fel som orsakas av händelser där värdet för TIMESTAMP BY-uttrycket inte kan konverteras till datetime.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "InvalidInputTimeStamp"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla InvalidInputTimeStampKey-fel
Visar fel som orsakas på grund av händelser där värdet för TIMESTAMP BY OVER-tidsstämpelnColumn är NULL.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "InvalidInputTimeStampKey"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Händelser som kom sent
Visar fel på grund av händelser där skillnaden mellan programtid och ankomsttid är större än principen för sen ankomst.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "LateInputEvent"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Händelser som kom tidigt
Visar fel på grund av händelser där skillnaden mellan programtid och ankomsttid är större än 5 minuter.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "EarlyInputEvent"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Händelser som har kommit ur ordning
Visar fel på grund av händelser som tas emot i fel ordning enligt out-of-order-principen.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "OutOfOrderEvent"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Alla utdatafel
Visar alla fel som inträffade när du skrev resultatet av frågan till utdata i jobbet.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType in ("OutputDataConversionError.RequiredColumnMissing", "OutputDataConversionError.ColumnNameInvalid", "OutputDataConversionError.TypeConversionError", "OutputDataConversionError.RecordExceededSizeLimit", "OutputDataConversionError.DuplicateKey")
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla RequiredColumnMissing-fel
Visar alla fel där utdataposten som skapas av jobbet har en kolumn som saknas.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "OutputDataConversionError.RequiredColumnMissing"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla ColumnNameInvalid-fel
Visar fel där utdataposten som skapas av jobbet har ett kolumnnamn som inte mappas till en kolumn i dina utdata.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "OutputDataConversionError.ColumnNameInvalid"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla TypeConversionError-fel
Visar fel där utdataposten som skapas av jobbet har en kolumn som inte kan konverteras till en giltig typ i utdata.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "OutputDataConversionError.TypeConversionError"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla RecordExceededSizeLimit-fel
Visar fel där storleken på den utdatapost som genereras av jobbet är större än den utdatastorlek som stöds.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "OutputDataConversionError.RecordExceededSizeLimit"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Visa en lista över alla DuplicateKey-fel
Visar fel där utdataposten som skapas av jobbet innehåller en kolumn med samma namn som en systemkolumn.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).DataErrorType == "OutputDataConversionError.DuplicateKey"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Alla loggar med nivån "Fel"
Visar alla loggar som sannolikt har påverkat jobbet negativt.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and Level == "Error"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Åtgärder som har "misslyckats"
Visar alla åtgärder på jobbet som har resulterat i ett fel.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and status_s == "Failed"
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Utdatabegränsningsloggar (Cosmos DB, Power BI, Event Hubs)
Visar alla instanser där skrivning till en av dina utdata begränsades av måltjänsten.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).Type in ("DocumentDbOutputAdapterWriteThrottlingError", "EventHubOutputAdapterEventHubThrottlingError", "PowerBIServiceThrottlingError", "PowerBIServiceThrottlingError")
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Tillfälliga in- och utdatafel
Visar alla fel som rör indata och utdata som är tillfälliga till sin natur.
// To create an alert for this query, click '+ New alert rule'
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).Type in ("AzureFunctionOutputAdapterTransientError", "BlobInputAdapterTransientError", "DataLakeOutputAdapterTransientError", "DocumentDbOutputAdapterTransientError", "EdgeHubOutputAdapterEdgeHubTransientError", "EventHubBasedInputInvalidOperationTransientError", "EventHubBasedInputOperationCanceledTransientError", "EventHubBasedInputTimeoutTransientError", "EventHubBasedInputTransientError", "EventHubOutputAdapterEventHubTransientError", "InputProcessorTransientFailure", "OutputProcessorTransientError", "ReferenceDataInputAdapterTransientError", "ServiceBusOutputAdapterTransientError", "TableOutputAdapterTransientError")
| project TimeGenerated, Resource, Region_s, OperationName, properties_s, Level, _ResourceId
Sammanfattning av alla datafel under de senaste 7 dagarna
Sammanfattning av alla datafel under de senaste 7 dagarna.
AzureDiagnostics
| where TimeGenerated > ago(7d) //last 7 days
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and parse_json(properties_s).Type == "DataError"
| extend DataErrorType = tostring(parse_json(properties_s).DataErrorType)
| summarize Count=count(), sampleEvent=any(properties_s) by DataErrorType, JobName=Resource
Sammanfattning av alla fel under de senaste 7 dagarna
Sammanfattning av alla fel under de senaste 7 dagarna.
AzureDiagnostics
| where TimeGenerated > ago(7d) //last 7 days
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS"
| extend ErrorType = tostring(parse_json(properties_s).Type)
| summarize Count=count(), sampleEvent=any(properties_s) by ErrorType, JobName=Resource
Sammanfattning av misslyckade åtgärder under de senaste 7 dagarna
Sammanfattning av misslyckade åtgärder under de senaste 7 dagarna.
AzureDiagnostics
| where TimeGenerated > ago(7d) //last 7 days
| where ResourceProvider == "MICROSOFT.STREAMANALYTICS" and status_s == "Failed"
| summarize Count=count(), sampleEvent=any(properties_s) by JobName=Resource