Forum Widgets
Latest Discussions
Welcome to the new Azure Log Analytics community!
Azure Log Analytics has been enhanced substantially and now offers an improved search and analytics experience. This includes interactive query language and an advanced analytics portal, both powered by a highly scalable and powerful data store. The query language is super rich, offering flexible search functions as well as advanced machine learning constructs. To support these new capabilities and provide you with the best querying experience, the advanced analytics portal supports multi-line editing of queries, many visualizations, and advanced diagnostics. To ramp-up quickly, we suggest you review the documentation, where you can find: Getting started tutorials Useful cheat sheets Plenty of examples The complete language reference Test drive the query language in the free demo environment and get started now! Have a question, comment, or request? Post it right here. The Azure Log Analytics TeamSolved4.2KViews11likes4CommentsAzure Monitor Connections Video Nov 4, 2020
Welcome to this month's Azure Monitor Connection post. Every 4-6 weeks we'll post a new video sharing the latest capabilities with demonstrations. In this session, learn what’s new in Azure Monitor for October 2020. This video covers exporting data from Azure Monitor Logs, introduces Insights Hub and reviews best practices for monitoring Azure resources. We’re actively monitoring this thread for your input so please do reach out with questions and feedback on the topics covered in the video. Thanks to YossiY for joining us in this session to demonstrate exporting data from a Log Analytics workspace.4.1KViews6likes1CommentWelcome to the Azure Monitor AMA!
Welcome to the Azure Monitor AMA! Ask us your tough questions, your detailed questions, your simple questions -- or, share your feedback (your experience to date, features you'd like to see, etc.) directly with the team. We will start answering at 9AM PST on Tuesday, June 30, 2020. To submit a question, click "Start a new conversation" in the Microsoft Azure Monitor AMA space --and do this for each new question. Please label your question by selecting from provided options as this will enable us to easily identify and answer your questions. If you want to keep an eye on the questions being asked by your peers, simply refresh the AMA space page from time to time. Please introduce yourself by replying to this thread. Let's get started!5.7KViews6likes10CommentsMeet our community repo - sharing queries, workbooks and alerts
Yes - we have public GitHub repo with hundreds of queries, workbooks and alerts, organized by Azure services, solutions and common "How to" scenarios. Have a cool query or a useful workbook? contribute to the repo and share with the community. Every month we'll be announcing the top contributor and top pages right on the front page of the repo!1.2KViews5likes3CommentsMonitoring of the legacy applications.
Azure Monitor has made lot of good things. And I think companies in future may try to replace their legacy monitoring tool with Azure Monitor. I think we need more solutions to monitor the legacy applications. - SCOM provides lot of legacy management packs, like mp for SharePoint, Windows Server, IIS , Skype for Business. IS there any plans to release solution packs for these ? - O365 Solution Pack was good. I think now its replaced with the Azure Sentinel O365 connector. AFAIK, this new connector can do things specific to security. But what about general monitoring of O365 ?Consultant1520Jun 30, 2020Copper Contributor1.7KViews5likes1CommentFYI - Log Search editor is becoming multi-line
With the new query language available in Log Search, we notice user queries develop and no longer fit into just one line. To accommodate longer queries we decided to make log search a multi-line editing area: so a few things have changed: Run - to run the query, click the Search icon or use the keyboard shortcut Shift+Enter. Enter no longer runs the query, as it's now a valid character you can use as part of a query, to add lines and make it more readable. Resize - the editing area start off with 5 lines. You can drag the bottom border to adjust the text area size to your needs. Intellisense - as you type, Intellisense suggestions appear beneath the editing area. To reach the suggestions area, click Tab. If the cursor is on the last row of your query, the ↓ key will also take you there. Once you've found the best suggestion, click Enter to accept it and continue editing. Note - If you're also using the Advanced Analytics portal, you might be used to separate queries by adding new lines or marking only parts of the text to be run. Log search does not support that behavior - here your entire text is considered a single query, that is always run in its entirety. We hope you'll find it as cool as we do. Let us know what you think and how we can further improve your experience. - Noa Kuperberg7.9KViews5likes6CommentsM365 Defender flags MMAExtensionHeartbeatService and GCService as potential risk
This feedback is provided for improvement of Azure Monitor experience in customers using the M365 Defender Security Recommendations feature. M365 Defender produces a vulnerability recommendation of Change service executable path to a common protected location for the default setup of MMA on Windows computers. Both the "GCService" (Azure Policy Guest Configuration) and the "MMAExtensionHeartbeatService" (Microsoft Monitoring Agent Azure VM Extension Heartbeat) are located in C:\Packages. The remediation option is "Move your service executable to a common protected path like 'C:\Windows', 'C:\Program Files', 'C:\Program Files(x86)', or 'C:\ProgramData'." Of course, you can 'Create Exception' with "Third party control" justification that would clear the vulnerability finding, however this exposes the computer to all threats of this type, it is not granular to only permit the allowed exceptions. Recommend either add C:\Packages to the common protected paths list or allow for granular application of exceptions to this policy.SolvedJohn_JoynerFeb 26, 2022Brass Contributor4.5KViews4likes3CommentsAlert "Monitor Condition" never changes
We're starting our journey from SCOM to Azure Monitor and have run into an issue with Azure Alerts (sorry for posting this in Azure Log Analytics, but there is no Azure Monitor Tech Community). I've noticed that when an Azure Alert is generated, that the Monitor Condition never changes from "Fired" to "Resolved". According to the documentation, the Monitor Condition, "Indicates whether the condition that created a metric alert has been resolved. Metric alert rules sample a particular metric at regular intervals. If the criteria in the alert rule is met, then a new alert is created with a condition of "fired." When the metric is sampled again, if the criteria is still met, then nothing happens. If the criteria is not met, then the condition of the alert is changed to "resolved." The next time that the criteria is met, another alert is created with a condition of "fired."" Despite the condition no longer being met (for instance, a service down), the Monitor Condition never changes. Am I missing something?ScottAllisonOct 03, 2018Iron Contributor18KViews4likes25Comments
Resources
Tags
- azure monitor1,092 Topics
- Azure Log Analytics398 Topics
- Query Language246 Topics
- Log Analytics62 Topics
- Custom Logs and Custom Fields18 Topics
- Solutions17 Topics
- Metrics15 Topics
- alerts14 Topics
- Workbooks14 Topics
- application insights13 Topics