Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

How can we improve Azure Log Analytics ?

You've used all your votes and won't be able to post a new idea, but you can still search and comment on existing ideas.

There are two ways to get more votes:

  • When an admin closes an idea you've voted on, you'll get your votes back from that idea.
  • You can remove your votes from an open idea you support.
  • To see ideas you have already voted on, select the "My feedback" filter and select "My open ideas".
(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback

  1. OMS agent for macOS

    I'd like to be able to push syslog and other data data from macOS to Log Analytics, however there is not OMS agent for macOS.

    110 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  2. Fix Bug in Agent

    We started seeing this error after installing the OMS agent on our servers.

    An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425} was rejected.

    A quick search on the internet shows other people have the same error after installing the OMS agent also.

    100 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    8 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    planned  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    We’re aware of an issue that can cause this error to be logged when the Update Assessment solution is installed.
    You can check if this is what you’re seeing my temporarily removing the Update Assessment solution and confirming the errors stop.

    The Update Assessment solution functionality is not affected and you can safely ignore this error.

  3. Request to add BMC Remedy partner type in ITSM Connection

    Hi Team,

    Could you please add BMC Remedy partner type in ITSM connection in LogicApps as this connection is not available which is commonly used tool in most of the software companies.
    Adding this connector will help us to automatically creates remedy tickets whenever there is a failure in ADF or if any component reaches threshold limits

    87 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    4 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    triaged  ·  Adminazurecxpuservoice (Product Manager, Microsoft Azure) responded

    Thanks for the valid suggestion. Your feedback is now open for the user community to upvote & comment on. This allows us to effectively prioritize your request against our existing feature backlog and also gives us insight into the potential impact of implementing the suggested feature.

  4. Multihome agents

    It would be fantastic if we could multihome agents to various workspaces.
    Right now we use the SCOM agent to connect to OMS, which means one OMS workspace. But we would like to have multiple workspaces depending on type of server (eg Production servers, Dev servers, application servers etc).

    I understand we can multihome OMS to different workspaces by multihoming the SCOM agent to different SCOM management groups, but having an entire management group set up just so agents can talk to different OMS workspaces is like swatting a fly with a sledgehammer.
    Even if we can manually configure each…

    74 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    5 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  5. Allow me to remove managed systems (Management Groups and Directly Connected Servers/Agents) from Usage page

    Implements a feature to remove managed （ Management Groups and to Directly Connected Servers ） Overview Usage from want? I think even if servers Connected Directly, the agent is uninstalled, cannot be removed from Operational Insights Usage. Cannot disconnect in the SCOM Management Groups are for the Operational Insights on want to remove.

    44 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    7 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    planned  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    In the current implementation, Management groups CAN already be removed, but only once they are ‘stale’ == have not reported ANY data for >14days, the link to remove will appear.

    The number of Directly reporting agents in ‘settings’ page is the actual number of servers registered, but the drill down will take you to search (where servers presence is inferred from the data).

    We will be working on options to de-register directly connected servers, similarly to we offer for SCOM management groups.

  6. Disable Agent Data Collection from OMS Portal

    Allow to enable/disable/schedule data collection of specific agents. This allows keeping data volume down during tests (e.g. pen or security testing) that might generate lots of events that could you go over the licensed data collection threshold. Maybe combinable with OMS Alert supression.

    31 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  7. Surface hub cannot connect to OMS using a proxy

    we documented at https://technet.microsoft.com/en-us/itpro/surface-hub/monitor-surface-hub?f=255&MSPPError=-2147217396:

    Note
    Surface Hub does not currently support the use of a proxy server to communicate with the OMS service.

    However, in most customer environment a proxy cannot be bypassed. This limitiation must be changed to allow the SurfaceHub OMS Agent to communicate with the OMS Workspace over a Proxy.

    25 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  8. Display of supported service tags

    The below docment is the network requirements for using the Log Analytics agent. However, there is no description of service tags to use Log Analytics agent.

    https://docs.microsoft.com/en-us/azure/azure-monitor/platform/log-analytics-agent#firewall-requirements

    On the other hand, the service tag is described below, but it is inaccurate and difficult to understand.

    https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags

    Currently, I think we can communicate between Agent and Log Analytics workspace with the following service tags.
    However, especially, "GuestAndHybridManagement" is not listed on the service tag or network requirements docments.
    -AzureMonitor
    -Storage
    -GuestAndHybridManagement

    I would like to check the service tag as official information. Please descrive the service tag for using the Log…

    23 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  9. Push\Install of Microsoft Monitoring Agent from OMS

    If you really want this to be used for stand alone clients, which I think is a great idea for the hybrid cloud, there needs to be an easier way to get the agent installed on those devices.

    19 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    3 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  10. Allow to deploy agent using GPO

    I know there is way to deploy agent with workspace details but this requires to use the setup.exe file
    Can you please provide a way to deploy with GPO?
    thanks

    14 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    2 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    under review  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    You have a few options today:

    - startup scripts from GPO’s would be the most generic way to install and configure the agent. Command line to silent install as well as script snippets on how to enable/disable/configure thru COM API are documented here https://azure.microsoft.com/en-us/documentation/articles/operational-insights-direct-agent/

    - Powershell magazine came up with a DSC module that allows you to install the agent that way http://www.powershellmagazine.com/2014/11/26/dsc-resource-module-for-microsoft-monitoring-agent-install-and-configuration-for-azure-operational-insights/

    - if the machines are in Azure, there is a VM extension http://azure.microsoft.com/en-us/updates/easily-enable-operational-insights-for-azure-virtual-machines/

  11. Multiple data destinations for Linux agent

    The Windows agent can be multihomed to send data to multiple Log Analytics workspaces. The Linux agent can send to only a single destination, either a workspace or management group. It would be a great enhancement if we could configure the Linux agent to report to multiple workspaces.

    13 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  12. SCOM-OMS prerequisites checker tool

    Tool which can be used to do prerequisite check for connection between Agent/MS and OMS.
    Based on firewall requirements:
    https://technet.microsoft.com/en-us/library/mt484101.aspx
    including option for Proxy server and Proxy user account.
    It would be a great help for deployment and troubleshooting scenarios.

    13 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  13. The health service HTTP module exceeded number of attempts to post data

    Trying to configure the OMS/SCOM integration.. but the above error comes into the eventlog.. in the PerfMon i see continuous spikes of the system trying to send data..

    not sure if the URL is correct.. but unknown where to configure it:
    The health service HTTP module exceeded number of attempts to post data URL: https://.ods.opinsights.azure.com/ProtectionStatusDataService.svc/PostDataItems. Dropping data batch.

    System


    • Provider

    [ Name] HealthService


    • EventID 2136

    [ Qualifiers] 32768

    Level 2

    Task 0

    Keywords 0x80000000000000

    11 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    5 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  14. Control when Advisor MPs are downloaded

    We need to control when Advisor MPs are introduced to our environment to prevent possible outages during production business hours. It would be nice to set a maintenance windows to control when changes are introduces. It would also be beneficial to be able to introduce the MPs to pre-Prod prior to Prod environments.

    10 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    under review  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    Hi, we are discussing this internally.

    Today you have a way to do this, by overriding the rules that perform MP/IP download and import – there is an override MP here http://blogs.technet.com/b/momteam/archive/2015/02/06/notice-upcoming-url-change-for-opsmgr-reporting-to-opinsights.aspx
    - you could keep them turned off in PROD and leave them enabled in QA/TEST – once you see a new MP has been updated in the test environment, you can remove the override in prod/let the update run/then block it again.

    We are determining how to make this more polished.
    Also see the similar idea http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/7161777-intelligence-pack-updates

  15. Update required for Amazon Linux to current version  

    Using OMS with Amazon Linux, last supported version is 2012.09 --> 2015.09 (x86/x64). Newer version of Amazon Linux required for reporting into OMS

    9 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    under review  ·  0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  16. Azure Operational Insights Onboarding Issues, Error 4200

    I have been have some issues connecting my existing Operations Center install to Operational Insights. I had experimented with the very first version of operational insights and had subsequentially removed it after some initial testing, I have readded the management packs and tried to reconnect to a new workspace I have created but I get the following Error :

    Error 4200: Unable to register to Operational Insights Service. Please contact the system administrator.

    I do notice that some of the management packs are downloaded, but I also received a lot of error messages in my event logs.

    The following messages…

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    under review  ·  AdminOMS Log Analytics Team (Product Manager, Microsoft Azure) responded

    Error 4200 is “Unable To Save Settings”.
    This means that registration and saving the certificate in the Runas profile in SCOM succeeded, but when we tried to save the other settings like urls and workspace Id – something failed there – these are just calls to SCOM SDK, so the underlying issue could be in the SCOM management system / database (maybe load related).

    The best first step to take for this investigation is to enable VERBOSE tracing to see what precisely fails – refer to the tracing article https://support.microsoft.com/en-us/kb/942864 (you might need to involve formal support channel to decipher this).

  17. MSI-based Windows agent for Intune compatibility

    OMS Windows agent as MSI installer rather than a .exe setup. This enables the agent to be directly deployable wo Windows 10 devices through Intune and OMA-DM.

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  18. Microsoft.IntelligencePacks.Advisor.Monitoring not importing.

    I've just onboarded our SCOM 2012 R2 environment onto OMS and I'm continually receiving the following error. The Management group is UR7.

    Failed to import the latest Advisor Management Packs to the Management Server. Reason: System.ArgumentException: The requested management pack is not valid. See inner exception for details.

    Parameter name: managementPack ---> Microsoft.EnterpriseManagement.Common.ManagementPackException: Verification failed with 1 errors:

    Error 1:
    Found error in 2|Microsoft.IntelligencePacks.Advisor.Monitoring/31bf3856ad364e35|7.0.10038.0|Microsoft.IntelligencePacks.Advisor.Monitoring|| with message:
    Could not load management pack [ID=Microsoft.IntelligencePacks.Monitoring, KeyToken=31bf3856ad364e35, Version=7.0.10038.0]. The management pack was not found in the store.
    : An error occurred while loading management pack 3478205f-b521-8bc4-b69b-67ac2759516d from the database

    ---> Microsoft.EnterpriseManagement.Common.ManagementPackException: Could not load…

    7 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →

  19. Add Proxy property to Heartbeat data type

    Please add a proxy property to the Heartbeat data type. It doesn't have to be the actual TCP socket, it can be a Y/N. Just something that can be queried to definitively identify if an agent has been configured to use a proxy.

    Network changes within firewalled environments can result in agents being quietly cutoff from Log Analytics. When these events occur it may be weeks before someone notices in non-production environments. Hundreds of agents are affected at a time. Proxies are most often required in DMZ's where tcp/443 access to the internet is blocked.

    The ability to query for…

    7 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    1 comment  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
    triaged  ·  Adminazurecxpuservoice (Product Manager, Microsoft Azure) responded

    Thanks for your feedback and its now open for the user community to upvote & comment on. This allows us to effectively prioritize your request against our existing feature backlog and also gives us insight into the potential impact of implementing the suggested feature.

  20. OMS files should not be world writable

    The agent creates the following world writable files when it runs.
    /var/opt/microsoft/omsagent/.../state/contentlocationcache.cache
    /var/opt/microsoft/omsagent/.../log/ODSIngestion.status

    Per MS support, these 2 files can safely be changed to 664 permissions without impact to the the agent.
    Having world writable files is a security vulnerability and this should be changed to use the lower permissions.

    6 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    0 comments  ·  Agent Management (OnPrem components) / Connectivity / Setup  ·  Flag idea as inappropriate…  ·  Admin →
← Previous 1
  • Don't see your idea?

Azure Monitor-Log Analytics

Categories

Feedback and Knowledge Base

(thinking…)
Hosted by UserVoice