Update: Microsoft will be moving away from UserVoice sites on a product-by-product basis throughout the 2021 calendar year. We will leverage 1st party solutions for customer feedback. Learn more here.

Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Windows 8+/RT App for tablet

    Provide Windows 8+/RT application to access Operational Insights from Windows Tablet

    116 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    declined  ·  1 comment  ·  Mobile App  ·  Flag idea as inappropriate…  ·  Admin →
  2. Delete logs from OMS workspace by type/date

    Possibility to delete logs by type/date. For example if there are enormous amount of logs/custom logs generated by accident, it can increase the bill by thousand of dollars. And if the plan is Premium with 1 year retention policy, billing amount can become huge.

    64 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Log Analytics cost is incurred when data is sent into the service and if data is retained beyond the included retention period (e.g. 31 days for the current default Per GB pricing tier).

    Once the data has been ingested into Log Analytics, the only cost savings possible is from reducing the retention period in cases where data is being retained beyond the included amount. See https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-cost-storage#change-the-data-retention-period for more information. Also, work is underway now to enable more granular retention by enabling different retention settings by data type (see UserVoice suggestion https://feedback.azure.com/forums/267889-log-analytics/suggestions/6657533).

    That said, there are cases where it might be necessary to delete logs. Specifically, to support compliance issues, we have introduced Purge API (https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-personal-data-mgmt#how-to-export-and-delete-private-data). Please note that this API must not be treated as general-purpose data delete API, but used for very limited purposes only. Also, using purge will not reduce cost for retention.

  3. Ability to remove a "Data Source" from the OMS service

    Hi OMS Team,

    I would like a feature that allows me to remove a "Data Source" ex. "Computer" from the data set that have been decommisioned. It should not be automatically removed because I would like to choice to keep the data for 30 days - 1 year

    51 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Data collection and data storage are two different things in Log Analytics.

    Once data is collected, it is stored in Log Analytics until the retention period is reached. You can use the time selector to see recent data or historical data.

    For data collection, rather than managing individual agents, we allow agents to send / not send data as needed. The Agent Health solution allows you to see computers that have stopped sending data recently and you can determine if this is expected or not.

    For things like classic cloud services, VM scale sets, and containers you can have new instances start sending data and not worry about being “notified” and updating an authoritative list of computers when an instances is deleted.

  4. It's good if we have single MMA file for appinsights and opinsights

    It's good if we have single MMA file for appinsights and opinsights

    45 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The agent used by Operational Insights isn’t intended to be installed on PAAS roles.
    To collect log data for PAAS roles and send it to Operational Insights you will need to configure Azure Diagnostics to log to table storage, and then Op Insights can read the data from table storage.

    Details are here:
    https://msdn.microsoft.com/en-us/library/azure/dn904284.aspx
    Also check this thread on the MSDN forum see the thread on the MSDN forum https://social.msdn.microsoft.com/Forums/azure/en-US/50ecdf2e-0e35-4fba-927a-5ba52f726405/add-operational-insights-to-cloud-service-during-publish?forum=opinsights

    AppInsights team on their UserVoice also has a similar idea http://visualstudio.uservoice.com/forums/121579-visual-studio/category/77108-application-insights

    Anyhow, only the old version of App Insights from VSO requires MMA. In the new version of App Insights, that team has moved away from MMA agent. The new version of App Insights (in the new Azure portal – http://azure.microsoft.com/en-us/documentation/articles/app-insights-get-started/ ) can collect most of the application related information automatically along with the applications.

  5. Windows Server 2008 R2 SP1 servers are shown as "No Real time Protection"

    Windows Server 2008 R2 SP1 servers are shown as "No Real time Protection". Although I have SCEP agent on them and real time protection is enabled on them with the same policies as other servers. I have Windows Server 2012 R2, Windows Server 2012 and Windows Server 2008 R2 SP1 servers and 2008 R2 SP1 servers are the only one shown that way.

    34 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    declined  ·  5 comments  ·  Malware Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  6. Blackberry 10 Mobile App

    Provide Blackberry 10 Mobile application to access Operational Insights

    36 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    declined  ·  1 comment  ·  Mobile App  ·  Flag idea as inappropriate…  ·  Admin →
  7. dashboard customization per user

    arrange system dashboard per user account (like azure portal)

    31 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  8. Install updates from Advisor

    Is there any way to update your servers/run security patches directly from Advisor so that I don't have to log in to my servers and run patches from there?

    11 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Flag idea as inappropriate…  ·  Admin →

    Consider voting on this idea http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519057-programmatically-submit-search-requests-and-receiv which would provide a way to query your data programmatically (i.e. retrieve a list of machines that satisfy certain criteria) and therefore integrate it into your automation scenario like a SCOrch/SMA runbook or script (which might then do the actual patching).

  9. URL direct to Dashboard

    Allow direct URL to log into Dashboard instead of forcing to Overview page. Currently if we save the URL to the Dashboard, then close browsers and run the URL we are taken back to the Overview page. I'd love to be able to open a folder of Favorites in tabs to all my favorite dashboards.
    Similar to the "Access read only Dashboard directly from URL".

    21 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →
  10. Type=Event break down 'ParameterXml' into discrete fields so they can be used as facets

    If I know what is written in Parameter1 or Parameter5 (i.e. a processname, a transactionId, etc) this would allow to easily group by that, and/or 'follow' certain activities and correlate data more precisely.

    Alternatively, the language could provide XML parsing facilities to extract the fields at runtime, but the above seems to make for simpler queries and is likely far easier to implement.

    15 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  11. Portal Customization

    Allow for customization with the Interface like the Preview Portal.

    10 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →
  12. Hide items from Change History

    My virtual servers use Dynamic Memory feature (Hyper-V) and I want hide changes of "PhysicalMemory" at "Configuration: Change History" report

    4 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Change History and Configuration Snapshot are old Silverlight parts from the currently released Advisor functionality. We don’t have plans to ‘change’ those; eventually, over time, the plan is to get rid of all Silverlight parts altogether. They are provided for the time being no to regress in functionality (we don’t want to cut them until there is a first class replacement).

    The comments under this post show a way to explore your configuration changes in the new Search experience. While that might look rough at this point in time, it is just an early version, but that’s the direction.

  13. Do not change alert resolution state in SCOM

    We are using a several custom alert resolution states in SCOM and we have identified this issue. We have a notification subscription rule in the SCOM which launches a custom script for each new created alert. This script does alert categorization and sets its resolution state to value that corresponds to its next processing - email notification, automatic escalation to support teams, transferring alert to ticketing system and so on. We found out that resolution state of all alerts created by Advisor is reset to New every 60 minutes. This feature is not compatible with our processes and workflows and…

    4 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)

    There are today two possible workarounds:
    - do not include the advisor rules in your notification/ticketing in the first place
    - stop the alert synchronization to onprem – we wrote how to do this here http://blogs.technet.com/b/momteam/archive/2014/07/24/how-to-stop-the-receiving-of-advisor-alerts-in-operations-manager.aspx

    In general, we are convinced that the type of ‘proactive’ recommendations are better consumed online, in the portal, and explored/prioritized periodically (i.e. you could review the recommendations weekly and prioritize the most important ones you want to act on that week).
    We want to make this the way to consume this information, because ‘alerts’ get in the way of the reactive stream of work, and no amount of tweaking of the synchronization mechanism is going to solve that.

  14. Switching oms does not work

    We use 3 (separate) oms portal for our DEV/QA/PROD solutions.

    1- when accessing diffrent oms via link it redirects me to the one im currently logged in ...
    2 - list of oms in change workspace get reset and im not able to see all of them there. Subscribtions list also is not working so we are forced to access oms via azure portal.

    6 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Change Tracking Solution  ·  Flag idea as inappropriate…  ·  Admin →
  15. remove disconnected servers

    I have disconnected a machine, but it still show up in the SQL Assessment. The settings page also indicates that the server is connected even if it has been offline for more than a week.

    6 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    For ‘generic’ behavior in this sense, please look at and vote and follow the related threads
    http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519218-purging-non-reporting-servers-configuration-asses
    http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519275-how-does-one-view-a-list-of-servers-that-are-not-r

    For what you see in ‘settings’, we have option to de-authorize/disconnect management groups
    http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519336-how-to-remove-a-management-group-from-advisor
    but we need the equivalent for direct agents, which is tracked here http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6949226-allow-me-to-remove-managed-systems-management-gro

    For SQL Assessment specifically, instead, the data from previous assessment scans gets carried forward for a while, and a server will be dropped automatically after 3 weeks, as described here https://azure.microsoft.com/en-us/documentation/articles/operational-insights-assessment/
    So this is by design and not a bug.

  16. ability to "archive" cold data to lower cost storage

    not necessarily exclusive to Security but we see huge increases in cost once the Security solution is enabled and it could help to get cold / or older data archived to low cost storage to bring cost down.

    5 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Security and Audit Solution  ·  Flag idea as inappropriate…  ·  Admin →
  17. Install and setup documentation , please

    How to configure the server to perform the SQL Assessment?
    I installed the Assessment client it on our development server a few days ago, but I still see the "We're still getting things ready." message on the OMS homepage.
    Other server data are visible in OMS, so I guess I didn't setup the agent correctly and it's not able to connect to SQL server, but I cannot find the documentation about this issue.

    4 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  18. Help Link in OMS leads to https://technet.microsoft.com/en-us/library

    When you click on the blue question mark on bottom right corner it leads to https://technet.microsoft.com/en-us/library . It should lead to OMS content in Azure documentation.

    4 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
  19. Problem with MS Edge browser

    Using Edge, the window doesn't update until you hit the refresh button.
    1. Click on overview, click on settings,
    2. Wait - nothing happens
    3. Click refresh (circle with arrow)
    4. Screen now appears.

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    declined  ·  0 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  20. eventID 8000 on servers

    We have been getting eventID 8000 on servers and are stumped on why. No proxy is set in SCOM. There is recent data in OMS. This is the 2 errors we are seeing. Is this a known bug?

    --
    The health service HTTP module in management group "xxxxx_01" timed out connecting to service. Please check configuration settings.
    Provided configuration:

    Service Url https://db7ef280-bf22-4379-84a5-2a6d7b55c38b.ods.opinsights.azure.com/EventDataService.svc/PostDataItems.

    Proxy Provided .

    A subscriber data source in management group xxxxx_01 has posted items to the workflow, but has not received a response in 1846 minutes. Data will be queued to disk until a response has been…

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
← Previous 1 3 4
  • Don't see your idea?

Feedback and Knowledge Base