Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Add a cost calculator or explain usage stats easier for purchasing

    There are a few people wondering about how we can estimate usage and how that usage is calculated. See here

    http://ok-sandbox.com/2014/11/azure-operational-insights-prices-and-questions/

    22 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The new Usage page provides information on actual usage and can be used to estimate what is needed for purchases.

    The included views will give you information on:
    • How much data is sent to Log Analytics and by which Computers
    • How much data is sent for each solution
    • How much data isn’t associated with a computer
    • Which computers are sending data and which computers haven’t recently sent data
    • How many nodes are sending data for each of the OMS offers (Insight & Analytics, Automation & Control, and Security and Compliance)
    • How long it takes for Log Analytics to make data searchable

    There is also a calculator available here:
    http://aka.ms/omscalculator

    -Richard

  2. Delete Logs and custom log

    hey ,
    How can I delete the logs,saved searches and custom logs ?

    11 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  3. No data after more than 60 minutes (SQL Assessment and IIS)

    Both the Change Tracking and Log Management have not received any data and have a orange triangle exclamation icon. The tile text indicates I should post here if more than 60 minutes passes and the error does not go away. At this point only the Malware Assessment seems to have any data. About 6hrs have elapsed at the time of this post.

    9 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The fix that enables both SQL Assessment and IIS Logs to be collected from Direct Agent has been published today.

    SQL Assessment also requires .NET 4 to be present on the agent to function.

    In general, when troubleshooting data flow, refer to the following resources:

    For IIS Logs, I had blogged some considerations here earlier on http://blogs.technet.com/b/momteam/archive/2014/09/19/iis-log-format-requirements-in-system-center-advisor.aspx but troubleshooting steps for OpsMgr and Direct Agent would be slightly different.

    Capacity Planning does NOT work with Direct Agent – that scenario requires Operations Manager AND Virtual Machine Manager today – http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519243-capacity-intelligence-pack-does-not-work-if-scom-v and the scenario is currently about the capacity of a private cloud. Consider the ideas about collecting just performance counters from agents or WAD
    http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519061-collect-custom-windows-performance-counters
    http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519356-collect-custom-performance-counters-from-windows-a

    Official documentation for what does and doesn’t work with Direct Agent is also here http://technet.microsoft.com/en-us/library/dn848311.aspx

    Look at the ‘Operations Manager’ Event Log on the agent is, anyhow, the common single most useful troubleshooting…

  4. Put a button to add servers on the main page

    Put a nice big button right on the main page that says "add servers" or "add devices" - for net new users this will help make them less frustrated when trying to figure out how to add devices

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  5. Add scale/units and tooltips to charts in 'Usage' blade

    it's very hard to understand without a scale or tooltips

    4 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  6. missing servers

    Some of my running machines in Azure portal are not seen by OI interface, so can't activate the agent. Seach is set to "all".

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    One reason why you might not be seeing the VM’s under in the Azure Portal under an Operational Insights workspace / ‘servers’ tab is if the VM is already reporting to a DIFFERENT workspace, also linked to the same subscription.

    Otherwise, depending what the issue is, you can
    refer to these resources
    http://blogs.technet.com/b/momteam/archive/2014/07/25/system-center-advisor-limited-preview-saved-searches-cloud-attach-status-and-usage-and-more.aspx
    http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519275-how-does-one-view-a-list-of-servers-that-are-not-r

    and if the agent is enabled but you never see any data, you would have to troubleshoot ON the agent – refer to the blog post here http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx (especially the ‘VERIFY IF THINGS ARE WORKING’ section and the part with the list of errors you might see in the event log).

    In Azure Portal, did you enable the VM’s with the ‘one click’ extension, i.e. like described here
    http://azure.microsoft.com/en-us/updates/easily-enable-operational-insights-for-azure-virtual-machines/

    What does the ‘status’ column say in Azure portal (under your OpInsights workspace / servers) for those VM’s? that would show ‘hearbeat’ status. our portal…

  7. set integration pack monitor for servers group

    Should be a great idea set what kind of IP I want use for a specific group of servers. For example if I've 5 lab servers and for these machines I don't want Change Tracking + Security Monitor, I want create a group on SCOM and disable these objects easier.

    S

    2 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    You can totally do that with Overrides and groups in SCOM today – all of the collection policy is driven by management packs – the ‘Advisor Managed’ list in the console is just a handy default, and it is really just a group used in overrides!
    Just export and look at the MPs – each IP is driven by a couple of discoveries (or in many cases not even present/needed) and a bunch of Rules you can override at will -often they just target windows computer and are enabled for the ‘Advisor Managed’ group.

    We might provide more advanced targeting criteria from the portal in the farther future to support direct agents, but for the time being this granularity is something you can currently only control and take advantage of thru System Center Operations Manager.

    Since the request was about SCOM, I am considering it completed – but if…

  8. How does one view a list of servers that are not responding?

    When the Microsoft System Center Advisor Status Update arrives, there is a list of servers that are not reporting but where can one find that in the SCA portal?

    2 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  9. 2 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  10. Timestamp of last data aggregation on Overview page

    Similar to Server Manager's Dashboard, add a timestamp of the last refresh of data aggregation for each tile on the Overview page and add ability to refresh data aggregation for existing data in Advisor.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    ‘Capacity’ Inteligence Pack and the new CSS Assessments (SQL Assessment, AD Assessment) are the only ones using pre-aggegated/processed data – refreshed every few hours.
    In these new IPs (SQL Assessment) we have taken the suggestion and we actually display the last scan time (data can be as old as one week as the actual assessment runs once a week on agents, but as soon as data is sent, the portal should reflect the new data’s time for that scenario within 1 to 4 hours.

    The rest of the scenarios use pretty much ‘raw’ data straight our of search engine so are more real time. So, if there is data, that data should be ‘current’ (or an hour old at most) at all times.
    Some tiles (i.e. Log Management, Change Tracking) are clear about what time window the query refers to – some of the other older IP’s are…

  11. how to remove a management group from advisor

    The UI for adding or removing management groups is impossible to find (I have not found it). Sort of. I did find the video of how to install the Advisor settings into my own management group after searching google.

    The UI in the scom console to "add computer/group" does not have an instance group of Windows Computers or windows Servers. The closest thing is "Windows Server instances Group" which also contains each drive letter and other objects that SCOM discovered.

    Neither adding nor removing computers show up in the ? for the System Center Advisor. I understand that the process…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    You can remove a management group that is no longer reporting for over 14 days (i.e. you decommissioned it, or you moved it to another account) from the ‘Daily Data Usage’ drill down, that shows you connected MG’s.

    The option to remove it will not remove the old data – will only disconnect it so it is not allowed to talk to the service anymore.
    We basically just want to prevent you from accidentally disconnecting an MG and having data stop flowing, going un-noticed for a while. if the MG is really ‘gone gone’, instead, after two weeks you can really remove it for good.
    But the old data stays, just new data does not come in.

    Most new scenarios really only show ‘recent’ data in a specific time window (i.e. a week, a month, 24 hours…), but the old Silverlight experience from legacy advisor configuration assessment does not, and…

  12. Allow data to be send directly from Agents or from OpsMgr gateway (was: bandwidth)

    Need the ability to send directly from agents to cloud or from OpsMgr Gateways to cloud; this is for remote agents that over a low bandwidth LAN.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    We technically have the required modules that are needed to send data from the agents directly, but are currently not being used – since opening proxies and firewall from a single spot (from the MS) was considered more convenient for the majority of SCOM customers.

    With the introduction of ‘Direct Agent’ we essentially support this scenario now.

  13. Need OMS service status web page

    Need a status page for OMS - where users can see the current status of the various OMS components.

    At 3 AM in the morning my SCOM management group connection stopped working.

    No changes were made to my SCOM management server.

    I suspect the problem is with OMS - but I've got no way of checking or reporting the service outage.

    Most cloud service providers provide this type of capability.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  14. can't install direct agent

    I uninstalled the Advisor Agent and Gateway on my Config Mgr server, hoping to take advantage of the new Direct Agents to monitor something besides the same 8 red-herring alerts I get every single week from Advisor - and I can't install it; the Direct Agent states it can't be installed because Advisor is present - but I just uninstalled the Advisor agent and gateway.

    I'm out. This whole thing has gone goofy with Ops Mgr integration and agents and gateways. We're a small IT shop and I don't have time to figure out Ops Mgr in addition to the…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    We indeed intended to simplify – you can now use just the direct agent, with no need for OpsMgr and also don’t need a specialized Gateway. The agent can also be configured to talk thru proxies (there is a powershell example here http://technet.microsoft.com/en-us/library/dn500848.aspx).

    This said, System Center does bring some additional capabilities if you have it and use it in combination with OpInsights, but with Direct Agent we meant to not make it a requirement, precisely to simplify on-boarding and reduce the infrastructure footprint for those – like yourself – who don’t use System Center.

    I also attempted the procedure today (albeit this had already been tested): I just took an old machine that had the OpsMgr 2012 SP1 agent and the advisor gateway on it; I un-installed the gateway; rebooted; installed the new Direct Agent MMA package (which upgraded the one already on the machine), rebooted again; configured…

  • Don't see your idea?

Feedback and Knowledge Base