Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Scroll list on performace counters

    When you go to Linux performace counters there is a list of all counters that I can not scroll down. If you chose them all you can not set it up because you are not able to scroll down

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  2. Cant see Alert Names in Overview / Settings / Alerts

    Am looking at alerts ummary under Overview\Settings and cant resize any of the columns, so Name is not clear as it is only showing about 12 characters

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  3. Cannot scroll down in the advisor deployment window

    in the servers sections, add/setup, there is an issue scrolling down so not of the text is visible. IE

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Browser Support  ·  Flag idea as inappropriate…  ·  Admin →
  4. It would be great if the host groups are honored in Capacity Dashboard.

    It seems that there is a single dashboard aggregating all my hosts. But, it would be useless if I have two host groups, one for dev and another for production.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Capacity Management Solution  ·  Flag idea as inappropriate…  ·  Admin →
  5. Exchange Alert rule shows Exchange 2010 not supported on Windows 2012

    Side Note : do you want the Configuration Assessment errors or will they "just" be fixed before GA

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  6. Capacity Data Aggregation Does not appear to be collecting relevant data

    Providing more context around the data aggregation process and potential issues would be valuable. I have activated the Capacity Planning component (2 weeks ago) and have yet to see any data collected for my services. Not clear what the issue is.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Capacity Management Solution  ·  Flag idea as inappropriate…  ·  Admin →

    For Capacity, check the pre-requisites here http://technet.microsoft.com/en-us/library/dn500856.aspx

    And if aggregation never finishes, most likely not all the right data is making up to the cloud. There are a lot of things to watch for and troubleshooting steps in this blog post http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    Also notice this item was causing issue at the time of this post http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519268-not-all-data-this-is-transfered-to-advisor-uses-th and we unified the proxy settings, which were causing issues for many people (covered in the blog post).

    As per making the experience clearer, I mentioned here http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519308-timeout-connecting-to-preview that we will be shipping some SCOM monitors that will self-monitor the connection and alert you with actionable KB associated to resolve connectivity issues that prevent (all or some) data to be sent to the cloud.

    All the above should help :-)

  7. Event id 55041 advisior

    I am getting frequently this error on SCOM Management server and also few servers are not reporting to Azure via opsmgr

    Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationException: Unable to communicate successfully with web service when performing Get Alert Update. ---> System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at https://service.systemcenteradvisor.com/IdentityProvider/IdentityProviderService.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: The remote server returned an error: (407) Proxy Authentication Required. at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context) at System.Net.HttpWebRequest.GetRequestStream() at System.ServiceModel.Channels.HttpOutput.WebRequestHttpOutput.GetOutputStream() --- End of inner exception stack trace --- Server stack trace: at System.ServiceModel.Channels.HttpOutput.WebRequestHttpOutput.GetOutputStream() at System.ServiceModel.Channels.HttpOutput.Send(TimeSpan…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Your proxy is asking for Authentication.

    Please refer to the blog post here http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    or the documentation on MSDN https://msdn.microsoft.com/en-us/library/azure/dn884643.aspx

    for how to configure a RunAs account to authenticate with the proxy, or what destinations to allow exceptions for.

    That one rule is only part of the old Advisor Configuration Alerts synchronization – a lot of people just seem to be turning off the flood and not syncing those ‘proactive’ alerts down to SCOM anyway – see more information on http://blogs.technet.com/b/momteam/archive/2014/07/24/how-to-stop-the-receiving-of-advisor-alerts-in-operations-manager.aspx and https://social.msdn.microsoft.com/Forums/azure/en-US/54de90e2-7efb-4274-943e-5904fb41ab1b/alerts-not-working-with-direct-agent?forum=opinsights

    If you need more help,
    Customers with Premier support can log support cases via Premier https://premier.microsoft.com/

    Customers with Azure support agreements can log support cases in the Azure portal https://manage.windowsazure.com/?getsupport=true

    For general discussion/question and answers (not ideas and bug reports) use the MSDN Forum
    https://social.msdn.microsoft.com/Forums/azure/en-US/home?forum=opinsights

    Onboarding issues? Read this troubleshooting guide http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    How do I do XYZ? Try our documentation http://azure.microsoft.com/en-us/documentation/articles/operational-insights-feature-guide/
  8. How does one find out which servers are gateways?

    In the old version, finding out the server gateways and server agents was an easy task. Unsure how to gather this information in the current version. Is there a way to do this.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Check under the ‘Daily Data Usage’ on the overview screen, we talked about this here http://blogs.technet.com/b/momteam/archive/2014/07/25/system-center-advisor-limited-preview-saved-searches-cloud-attach-status-and-usage-and-more.aspx

    and check this other idea http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519184-make-advisor-limited-preview-work-with-mma-agents

    I am closing this – please let me know if you need more info about this. Also answered your other thread with the search queries to look for when data was last sent by each machine http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519275-how-does-one-view-a-list-of-servers-that-are-not-r

  9. Dashboard tiles summaries

    In dashboard tiles total (big figure in upper-left corner) shows data in a cumulative manner: summarizing all the bars, which in some cases looks confusing. For example, for "Missing required updates" only most recent result is relevant. Like yesterday I had 57 required updates missing, then I installed most of them and today I have 3 left, but the total shows 60 (57+3).

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →

    Absolutely – you need to take into account the time dimension in those queries, to make them useful on dashboards.
    See this post about the topic http://cloudadministrator.wordpress.com/2014/10/19/system-center-advisor-restarted-time-matters-in-dashboard-part-6/

    In general, not all searches are suitable to be displayed with a certain visualization. Try tweaking the search first to the shape and exact criteria you want before using it in a tile.

    Also check this series of blog posts on the syntax – part II I speaks about the Time dimension http://blogs.msdn.com/b/dmuscett/archive/2014/10/19/advisor-search-how-to-part-ii-more-on-filtering-using-boolean-operators-and-the-time-dimension.aspx
    (but you probably want to read the whole series)

  10. No Data show

    Why my Capacity Planning Intelligence Packs not working, after 1 days my screen still at Data aggregation in progress, not data show or dashboard show.

    I notice that the OpsMgr to VMM Connector needs to be configured and working for data aggregation to succeed did not checked, are the check box should be check then only got data will show.

    i already follow the guide to configure the OpsMgr to VMM Connector to configure it but still not data.

    any help can i refer?

    regards,

    VH

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Capacity Management Solution  ·  Flag idea as inappropriate…  ·  Admin →

    Yes – there is a pretty comprehensive list of things to check here http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx
    they should help identify issues you might be having sending the right data.

    Even if the right data is there, it does take over a day for capacity to light up, and over a week for predictions/projections to become available.

    But do let us know if you need and we can help you offline.

  11. ARM Search API doesn't work in West Europe?

    Hi folkks,
    when I'm trying to use the Seerarch API against a workspace in West Europe I Always get the following error:
    Invoke-WebRequest : {"error":{"code":"NoRegisteredProviderFound","message":"No registered resource provider found for location 'westeurope' and API version '2014-10-10' for type
    'workspaces'. The supported api-versions are '2014-10-10, 2014-11-10, 2015-03-20'. The supported locations are 'eastus, westeurope'."}}
    Everything works fine against workspace in East-US.
    The differences I can think of are:
    - workspace location
    - wroksapce name, the West Europe one is mnemonic (something like 'my-ws') the east-us ones are guid.

    Any clue?

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  Extensibility / Partner scenarios  ·  Flag idea as inappropriate…  ·  Admin →

    I believe ‘name’ vs ‘guid’ (as shown in the URLs in portal) depends on whether the workspace was initially created thru OMS/OpInsights portal and/or thru Azure, and in which period they were created…

    Please use api-version 2015-03-20 or 2014-11-10 when making calls to West Europe. 2014-10-10 is not supported.

  12. Monitoring Agent silent / unattended install

    Info on silent or command line install of Microsoft monitoring agent for Azure servers (we have a few :-) )

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  13. 0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →
  14. Provide some form of visible notification when new Intelligence Packs are available

    Maybe the tile showing there are new, not-added, IPs? or a total (i.e. 3 out of 6 in use)

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Solutions / Packs Gallery and new IP ideas  ·  Flag idea as inappropriate…  ·  Admin →
  15. 0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Change Tracking Solution  ·  Flag idea as inappropriate…  ·  Admin →
  16. Move Facet selection to the left side

    Based on some of the usability studies, other users felt that the facet navigation/selection would feel more natural if it was on the left side of the screen, not on the right.

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  17. Documentation API Error

    He guys I've noticed error in the documentation located here:
    https://technet.microsoft.com/en-us/library/mt484116.aspx
    the query for getting the schema:
    armclient get /subscriptions/{SubId}/resourceGroups/{ResourceGroupId}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/schema?api-version=2015-03-20
    should be
    armclient post /subscriptions/{SubId}/resourceGroups/{ResourceGroupId}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/schema?api-version=2015-03-20

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  18. Exclude Updates as being required

    I would like the ability to exclude certain updates from being noted as required.

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Flag idea as inappropriate…  ·  Admin →

    You can do this today with your own search queries and filter out the ones you don’t care about, i.e.

    Type=RequiredUpdate KBID!=2978126 KBID!=2995387

    Take a look at the sample queries here http://blogs.msdn.com/b/dmuscett/archive/2014/10/19/advisor-searches-collection.aspx

    Also see similar request and discussion on this other idea http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519261-allow-to-select-categories-of-products-to-which-yo

  19. When editing an alert whcih triggers a runbook it is impossible to see if the runbook will be triggered on a hybrid worker or not.

    When editing an alert whcih triggers a runbook it is impossible to see if the runbook will be triggered on a hybrid worker or not.

    the dropdown and switch is grayed out and it always shows "Azure" even when saved for at hybrid worker
    see attached picture for

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Alert Management Solution  ·  Flag idea as inappropriate…  ·  Admin →

    Hi,
    We are sorry to hear the issue you’re facing in UI rendering on OMS Portal.

    May we suggest using the new Azure Alerts instead?
    It uses Azure Portal which has been validated across all popular platforms and browsers. And new Azure Alerts allow you to create and manage all your log analytics as well as monitor based alerts in the space place. Azure Alerts is now in public preview, more details here: https://azure.microsoft.com/en-us/blog/new-alerts-preview-in-azure-monitor/

    Additionally, Azure Alerts (Preview) allow you to create log analytics based alerts using ActionGroups (from Azure Monitor); which allow you to have multiple actions for an alert including email, SMS, Webhook, ITSM Connector and now Runbook. You can have all of them or just one, unlike in OMS. And the ActionGroup UI is more details for runbooks and can clearly show/manage runbook parameters; see here for more details on Runbook support on ActionGroups: https://azure.microsoft.com/en-us/updates/automation-runbooks-available-in-action-groups/

  20. Unify/standartize log seach lanauges across OMS and Application Insights

    We have some language to retrieve logs in AI and also in OMS. and language in AI is much better(richer syntax, visualization). I spend 4 hours for the simple request -it's a great opportunity for improvement(not only my skills could be improved)

    Could you somehow standardize syntax across 2 log search solutions in Azure? or at least enrich OMS language?

    https://azure.microsoft.com/en-us/documentation/articles/app-insights-analytics/

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  • Don't see your idea?

Feedback and Knowledge Base