Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Allow to ignore/override prioritized recommendations for specific objects

    Allow to ignore/override prioritized recommendations for specific objects to get a green view. Example > SQL Assessment recommends "Avoid using the Simple database recovery" Operations manager database. Default (and best practice) for SCOM is simple recovery.

    68 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    7 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  2. List servers being monitored

    I can't find out where to list the servers whose data is being collected from our on-premise SCOM server. I go to the SQL Assessment, it says 13 servers have been assessed, but I cant find exactly what the servers are??

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  3. SQL Security and Compliance doesnt appear to work

    When you click on the Security and Compliance donut graph in the SQL dashboard, nothing happens. I have 7 Low Priority recommendations in the donut. If you click the See All... it does let me see them in the Event searcher and I can see the details for each of the 7 recommendations. Is this by design?

    Thanks

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    The coded drill downs for ‘Focus Area’ only show ‘High’ priority recommendations. Right now this is by design, hence if there are no High-Pri recommendation, that type of drill down would be empty anyway.

    Search (see all) will show them all (as the link suggests), regardless of priority – in fact you can use some fields such as RecommendationWeight to sort things and define what’s YOUR ’high/low bar.

    From the search result, there is a ‘[View]’ link on the RecommendationId field that will take you to the ‘single recommendation’ page, to see them in the pretty fashion.

    Hope it helps, I am marking this as completed.

  4. Allow addition of custom Assessment Recommendations

    I would be nice if we could add in our own criteria for recommendations to have checked against our servers with out having to only rely on the built in recommendations. This might be similar to the custom Intelligence Pack ideas but we wouldn't need a whole new pack just a option to add more Recommendations on a need basis

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    You CAN already do this by writing searches and saving them and visualizing them in dashboards. If you have the right piece of data, you can query it.
    You might want to tell us what piece of data you need first – in this category http://feedback.azure.com/forums/267889-azure-operational-insights/category/88086-log-management-and-log-collection-policy
    and those in ‘change tracking’ (which is also a form of ‘data collection policy’) http://feedback.azure.com/forums/267889-azure-operational-insights/category/88094-change-tracking

    Beyond logs, using some script and modules to shape custom data is something we do in some of the intelligence packs and leveraging the agent’s infrastructure…

    But at its core, OpInsights is a Log Search & Analytics cloud service. Instead of using rules & monitors running on agents (like SCOM did – and they were very difficult to write), OpInsights gather logs & machine data and let you explore and analyze them with the power & scale of big data in the cloud.

    Also see this blog post for…

  5. SQL Assesment account permissions issue

    Since initial release I've used SQL assessment IP. I've setup account for that IP in SCOM and secured the account to only servers that have SQL. A couple of days ago I've started to receive the following alert:
    An account specified in the Run As profile "Microsoft.SystemCenter.AdvisorAssessments.SQLAssessment.RunAsProfile" cannot be resolved

    for servers that are not included for that account. What has been changed? Why is should distribute that account to all servers in my environment and not just SQL.
    I am also receiving the following alert for servers in workgroup:
    One or more Run As accounts failed to log on.…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  6. SQL Password Policy

    Ability to analyze password policy to see if passwords are meeting complexity rules.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    5 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    As Raj commented, Yes, we already have a rule that recommends" Apply Windows password policies to SQL Server logins.".
    We check for any logins exists that are not set for “is_policy_checked” and “is_expiration_checked”, this is to make sure to enforce the same password policies that Windows is set to enforce.

    I am marking this as ‘completed’. Let us know if this answers or if you had something else in mind.

  7. Incorrect database recovery model for SQL database

    Hello,

    SQL DB which is in FULL recovery model is tagged by Operational Insights as having Simple database recovery model

    Regards,
    Ambarish

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    After offline investigation, we had a bug in the default UI queries – the computation was correct, but the UI search query was missing a filter. This is now fixed.

    You can explore the data with these queries (changing in ‘Passed’ vs ‘Failed’)

    Type:SQLAssessmentRecommendation IsRollup=false RecommendationPeriod=“2014-11” AffectedObjectResult=Failed Recommendation=“Avoid using the Simple database recovery model.” | sort RecommendationWeight desc

    Type:SQLAssessmentRecommendation IsRollup=false RecommendationPeriod=“2014-11” AffectedObjectResult=Passed Recommendation=“Avoid using the Simple database recovery model.” | sort RecommendationWeight desc

  8. Add Max Degree of Parallelism to the SQL Assessment Intelligence Pack

    Many organizations find themselves with a functioning Operations team without the advantage of a strong DBA group. While the existing recommendations/checks in the SQL Assessment Intelligence Pack are great, this setting out of box is always set to 0. The default setting of 0 is never the best practice setting based on server resources.

    Is there a way to add check for this, based on the actual resources of the machine the DB is running on? Or at a minimum, alert if still set to the default of 0.

    http://support.microsoft.com/kb/2806535/en-us?wa=wsignin1.0

    Thanks!

    Christopher

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  9. The recommendation "Implement Windows authentication on Microsoft Azure-hosted SQL Server deployments." does not apply to on-premises SQL

    I don't understand why I am receiving the recommendation "Implement Windows authentication on Microsoft Azure-hosted SQL Server deployments." for an on-premises SQL server.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    3 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  10. advisorassessment.exe crashes

    Witnessing just two windows servers 2008 r2 where advisorassessment.exe crashes and both HealthService and MonitoringHost.exe utilize 25% CPU utilization.

    Description

    Faulting Application Path: C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 3255\29645\AdvisorAssessment\AdvisorAssessment.exe

    Problem signature
    Problem Event Name: CLR20r3
    Problem Signature 01: advisorassessment.exe
    Problem Signature 02: 2.0.41030.1
    Problem Signature 03: 54528d5b
    Problem Signature 04: mscorlib
    Problem Signature 05: 4.0.30319.17929
    Problem Signature 06: 4ffa57ca
    Problem Signature 07: 43c1
    Problem Signature 08: 1b6
    Problem Signature 09: Microsoft.Sirona.SironaException
    OS Version: 6.1.7601.2.1.0.272.7
    Locale ID: 1033
    Additional Information 1: 5c3f
    Additional Information 2: 5c3f49e979dedf82006528754a2dbb3e
    Additional Information 3: eecc
    Additional Information 4: eecc263e6d951355e98e8f9a81b541c0

    Removing the two…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    The advisorassessment.exe process is part of the new CSS assessments such as SQL Assessment Intelligence Pack.
    This might take some CPU for a few minutes while it runs the analysis, but it is configured to run ONCE A WEEK by default.

    When looking at this environment in particular, we found that HealthService was completely reaching memory limits and restarting itself, which made the machine un-necessary busy always reloading configuration and launching multiple instances of the process. This is a phenomenon in SCOM well described by Kevin Holman http://blogs.technet.com/b/kevinholman/archive/2009/12/21/the-new-and-improved-guide-on-healthservice-restarts-aka-agents-bouncing-their-own-healthservice.aspx

    In particular for Operational Insights, there are some old notes in this Advisor document http://onlinehelp.microsoft.com/en-us/advisor/ff976541.aspx (look for the section titled “System Center Operation Manager Health Service keeps restarting”) that are still applicable and fixed this situation. We will move those to the new MSDN documentation.

  11. The recommendation "Review the system processor scheduling mode." is not working correctly

    I am receiving the "Review the system processor scheduling mode." recommendation even though I have my Windows Server 2012 R2 server's processor scheduling configured for background services.

    Additionally, the registry key:
    HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl
    has the registry value:
    Win32PrioritySeparation correctly set to 0.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  12. I am receiving the recommendation to "Review network provider ordering settings." on a fresh Windows Server 2012 R2 OS installed on VMware

    I am receiving the recommendation "Review network provider ordering settings." on a fresh Windows Server 2012 R2 operating system install hosted on VMware ESXi 5.5 with the latest version of VMware Tools installed. Since no changes have been made to network provider order, I believe that this is a bug.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    4 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →

    After investigation, there are various other permutations with other hypervisors and we don’t have a knowledge of all those cases to make it more reliable in all environments.
    Since it triggers false positives, the content owner decided to retire this rule.

    This has been fixed and deployed yesterday.
    It might take a while to reflect in the result of the analysis as the scan occurs once a week on every agent.

  • Don't see your idea?

Feedback and Knowledge Base