Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. upload logs to the Azure OMS more frequently

    Can the the upload frequency of the logs to the Azure OMS be reduced? currently it is minumum 12 hours http://onlinehelp.microsoft.com/en-us

    This is applicable to system update management, Change management within Operational insights

    6 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Flag idea as inappropriate…  ·  Admin →

    Thanks for idea. Let’s see how many customers are interested.

    As an added note, while frequency can not be changed for both System Update Assessment and Change Tracking, the 12-hour frequency only applies to System Update Assessment. Change Tracking only consumes data when there is change in the environment, with minimum frequency of 6 minutes.

  2. 10 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Thank you for your feedback.

    While there is no out-of-box way to achieve this today, you can manually set up a dashboard with search queries.
    Blog on how to monitor IIS by converting IIS Management Pack into search queries: http://blogs.msdn.com/b/dmuscett/archive/2014/11/05/iis-mp-event-alerting-rules-s-opinsights-searches-equivalents.aspx

    Also, distributed application support is tracked here: http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519314-business-service-distributed-application-health11

  3. Intelligence for backup extended to include Data Protection Manager to Azure

    We would like to be able to have good summary information around backup where we don't have an Azure only solution. In a case where we are seeing a lot of growth around IaaS workloads that are not in Azure but are Windows server based where we use a lot of System Center for Monitoring, Management and Backup. It would be great to consolidate backup information from multiple customers where we manage their environment and need to meet in this case backup SLA's using DPM either D2D2VTL or D2D2Azure. Having a backup summary would allow at a glance to show…

    4 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  4. unknown protocol in wiredata

    The search result of:

    Type:WireData | Measure Sum(TotalBytes) by ApplicationProtocol

    shows Unknown Protocol with a sum greater than nearly all the other 43 protocols combined. This appears to be a bug. See attached screenshot.

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    5 comments  ·  Wire Data Solution  ·  Flag idea as inappropriate…  ·  Admin →

    Even if ApplicationProtocol is reported as Unknown, you should be able to see the underlying transport/network protocols as TCP, UDP, etc.

    At this stage, ApplicationProtocol is currently limited to a well-known set of protocols based on standard port mapping logic in the MP. If the port number on the wire data does not follow the standard port number, the application protocol will be shown as Unknown.

    It’s on our radar to see how this can be improved in future iterations – we just recently enabled this first version of wiredata and are gathering more feedback on how to evolve it, we are still in the process of documenting it.

  5. PCI DSS V3.1 Intelligence Pack

    Would I be able to create an Intelligence Pack that would monitor against defined standards such as PCI DSS V3.1?

    19 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Let’s see how much interest this generates in the community.

    Any more information about the scenario / use cases would be helpful.

    At this stage you can start determining what data the solution would need, and if it is something that can be collected with the current ‘log managament’ or other solution’s capabilities – i.e. windows events / perf counters – and start writing your searches to get insights.

    There is an uber-thread tracking ‘solution building’ here http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519059-ability-for-partners-to-create-intelligence-packs that links to a set of smaller items that will make building your own solutions eventually possible.

  6. Add Account to workspace, it doesn't work

    I try to add another account to my workspace, but it doesn't work.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  7. software inventory

    I'd like to be able to perform full software inventory on servers and be able to identify non-current versions of programs installed, i.e. JAVA, Adobe Reader etc.

    Management Suite should be able to push the newest versions to servers.

    46 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    3 comments  ·  Security and Audit Solution  ·  Flag idea as inappropriate…  ·  Admin →
  8. Trigger the Agent

    If I look on the last submission time of the agent, I can see that this is some time ago. As then incorrect data is reflected, it would be good if I can manually trigger the agent to update the data.

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  9. Multiple Workspaces.

    Ability to have two workplaces open at the same time on different tabs

    15 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  Browser Support  ·  Flag idea as inappropriate…  ·  Admin →
  10. False Remote Desktop alert

    The SQL Assessment notifies me that Remote Desktop isn't enabled on my SQL servers. However, it's configured via GP. The assessment should take that into account.

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    4 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  11. Easy UI with Connection Options

    Functionality and Logic need to be more Intuitive. Connecting assets to monitor insights should not be so difficult.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →

    We are sorry to hear you find this difficult. Unfortunately it is not very clear what exactly you found complex.

    Right now the big blue ‘Settings’ tile on the overview screen is your entry point for the steps of adding agents/system, adding solutions to your workspace, and configuring log collection, and it is meant to guide you thru these first steps.

    We have some step-by-step documentation about onboarding starting here https://azure.microsoft.com/en-us/documentation/articles/operational-insights-onboard-in-minutes/

    and there are even videos, i.e. https://channel9.msdn.com/blogs/satyavel/3-Ways-to-Onboard-to-OpInsights albeit the UI probably already changed a little since then.

    We are continuously making enhancements, see for example this review https://cloudadministrator.wordpress.com/2015/08/04/operations-management-suite-goodbye-silverlight-and-other-stuff/ so, as the UI changes, is not always possible to immediately have uptodate documentation and guidance, but generally we try to make it simpler.

  12. Allow Multiple Accounts in Backup Solution

    For the Backup solution, need to be able to add more than one vault account.

    33 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →
  13. Settings information

    Please show the subscription ID in the OMS console under settings + the region. It makes it easier to configure a connection from Azure Automation for access the OMS Search API

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  14. More assessments?

    Will Microsoft develop more assessments, i.e Lync?

    6 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  15. Portal site Localization

    Now, OMS portal site is not localized to other languages.

    such as assessment intelligent pack, it has useful information, but many customer (in Japan) cannot understand English information...

    Please localize portal site to famous language.

    6 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  16. Closing workspace causing constant warning alerts in OpsMgr management server?

    I closed a workspace that has connection to my OpsMgr (2012 R2 with UR6) mgmt. group. I then created a new one, went back to OpsMgr Console, did 're-configure Operational Insights' successfully. But since then, I've been getting alerts in OpsMgr on one of the mgmt. server saying 'Advisor failed to download the latest advisor knowledge management packs', with event 55002 happening every few minutes,
    event details shown below, I've tried reboot the server etc., did not help.

    Failed to synchronize the latest Management Package information from Advisor Cloud service. Wait for the next cycle to retry. Reason: Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationFaultException: A…

    2 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →

    If the workspace is closed, the web service API don’t allow the management group – which is still ‘connected’ from its point of view to do anything.

    If you did re-register the group to a new workspace, anyhow, it should start working again.

    Those errors could be transient – MP’s download is attempted every 10 minutes – how often do you see those errors?
    Have you checked the actual list of MP’s imported in the environment? “Verify if things are working” – procedure 1 here http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    Also check the MPB’s that come with update rollups are imported (Windows Update does not automatically update those, as explained in the KB article for each rollup)?

  17. Support conversion and formatting functions in the search language

    There should be option in the search language to convert metrics. For example If I want to convert Bytes to Gigabytes that should be possible in the search language. Other examples are in converting time to specific format (shorter time format, adding timezone and etc.)

    15 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    8 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  18. Connect to Azure Storage should not take you to documentation

    I want to add additional storage accounts but all it keeps doing wihen I click connect is take me to documentation. Clicking the Connect to Azure Storage button should take me to a location to connect, not send me to a documentation page

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  19. Reuse workspace name

    cannot reused name of closed workspace?

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    3 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →

    Ok, I got this answer from the engineers and confirmed the current limitation – we will have to make a change for this:

    WorkspaceName is used to register the portal DNS, and it should be globally unique.
    We cannot reuse the workspace name now, because we dodn’t yet remove the DNS mapping when we do the CloseWorkspace operation.

  20. 'interval' function in Measure command should support all statistical/aggregation functions (Max/Min/Avg/Sum) not just count

    Per documentation:
    https://azure.microsoft.com/en-us/documentation/articles/operational-insights-search/
    Interval function is supported only of grouping Date/Time fields and works with only count() aggregation function. This makes the use of interval function very limited. For example if you want to create query that will show certain results for every hour for the past 12 hours for multiple of objects you can't.
    Example of this:
    Type:WireData | measure count() by ApplicationServiceName interval 1HOUR
    In order to achieve such results you will have to create query for every ApplicationServiceName like this:
    Type:WireData (ApplicationServiceName=http) | measure count() by TimeGenerated interval 1HOUR
    Additionally if you want to see the traffic…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  • Don't see your idea?

Feedback and Knowledge Base