Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. PCI DSS V3.1 Intelligence Pack

    Would I be able to create an Intelligence Pack that would monitor against defined standards such as PCI DSS V3.1?

    19 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Let’s see how much interest this generates in the community.

    Any more information about the scenario / use cases would be helpful.

    At this stage you can start determining what data the solution would need, and if it is something that can be collected with the current ‘log managament’ or other solution’s capabilities – i.e. windows events / perf counters – and start writing your searches to get insights.

    There is an uber-thread tracking ‘solution building’ here http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519059-ability-for-partners-to-create-intelligence-packs that links to a set of smaller items that will make building your own solutions eventually possible.

  2. Add Account to workspace, it doesn't work

    I try to add another account to my workspace, but it doesn't work.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  3. software inventory

    I'd like to be able to perform full software inventory on servers and be able to identify non-current versions of programs installed, i.e. JAVA, Adobe Reader etc.

    Management Suite should be able to push the newest versions to servers.

    46 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    3 comments  ·  Security and Audit Solution  ·  Flag idea as inappropriate…  ·  Admin →
  4. Trigger the Agent

    If I look on the last submission time of the agent, I can see that this is some time ago. As then incorrect data is reflected, it would be good if I can manually trigger the agent to update the data.

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  5. Multiple Workspaces.

    Ability to have two workplaces open at the same time on different tabs

    15 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  Browser Support  ·  Flag idea as inappropriate…  ·  Admin →
  6. False Remote Desktop alert

    The SQL Assessment notifies me that Remote Desktop isn't enabled on my SQL servers. However, it's configured via GP. The assessment should take that into account.

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    4 comments  ·  SQL Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
  7. Easy UI with Connection Options

    Functionality and Logic need to be more Intuitive. Connecting assets to monitor insights should not be so difficult.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →

    We are sorry to hear you find this difficult. Unfortunately it is not very clear what exactly you found complex.

    Right now the big blue ‘Settings’ tile on the overview screen is your entry point for the steps of adding agents/system, adding solutions to your workspace, and configuring log collection, and it is meant to guide you thru these first steps.

    We have some step-by-step documentation about onboarding starting here https://azure.microsoft.com/en-us/documentation/articles/operational-insights-onboard-in-minutes/

    and there are even videos, i.e. https://channel9.msdn.com/blogs/satyavel/3-Ways-to-Onboard-to-OpInsights albeit the UI probably already changed a little since then.

    We are continuously making enhancements, see for example this review https://cloudadministrator.wordpress.com/2015/08/04/operations-management-suite-goodbye-silverlight-and-other-stuff/ so, as the UI changes, is not always possible to immediately have uptodate documentation and guidance, but generally we try to make it simpler.

  8. Allow Multiple Accounts in Backup Solution

    For the Backup solution, need to be able to add more than one vault account.

    33 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →
  9. Settings information

    Please show the subscription ID in the OMS console under settings + the region. It makes it easier to configure a connection from Azure Automation for access the OMS Search API

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  10. More assessments?

    Will Microsoft develop more assessments, i.e Lync?

    6 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  11. Portal site Localization

    Now, OMS portal site is not localized to other languages.

    such as assessment intelligent pack, it has useful information, but many customer (in Japan) cannot understand English information...

    Please localize portal site to famous language.

    6 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  12. Closing workspace causing constant warning alerts in OpsMgr management server?

    I closed a workspace that has connection to my OpsMgr (2012 R2 with UR6) mgmt. group. I then created a new one, went back to OpsMgr Console, did 're-configure Operational Insights' successfully. But since then, I've been getting alerts in OpsMgr on one of the mgmt. server saying 'Advisor failed to download the latest advisor knowledge management packs', with event 55002 happening every few minutes,
    event details shown below, I've tried reboot the server etc., did not help.

    Failed to synchronize the latest Management Package information from Advisor Cloud service. Wait for the next cycle to retry. Reason: Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationFaultException: A…

    2 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    2 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →

    If the workspace is closed, the web service API don’t allow the management group – which is still ‘connected’ from its point of view to do anything.

    If you did re-register the group to a new workspace, anyhow, it should start working again.

    Those errors could be transient – MP’s download is attempted every 10 minutes – how often do you see those errors?
    Have you checked the actual list of MP’s imported in the environment? “Verify if things are working” – procedure 1 here http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    Also check the MPB’s that come with update rollups are imported (Windows Update does not automatically update those, as explained in the KB article for each rollup)?

  13. Support conversion and formatting functions in the search language

    There should be option in the search language to convert metrics. For example If I want to convert Bytes to Gigabytes that should be possible in the search language. Other examples are in converting time to specific format (shorter time format, adding timezone and etc.)

    15 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    8 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  14. Connect to Azure Storage should not take you to documentation

    I want to add additional storage accounts but all it keeps doing wihen I click connect is take me to documentation. Clicking the Connect to Azure Storage button should take me to a location to connect, not send me to a documentation page

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  15. Reuse workspace name

    cannot reused name of closed workspace?

    30 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    4 comments  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →

    Ok, I got this answer from the engineers and confirmed the current limitation – we will have to make a change for this:

    WorkspaceName is used to register the portal DNS, and it should be globally unique.
    We cannot reuse the workspace name now, because we dodn’t yet remove the DNS mapping when we do the CloseWorkspace operation.

  16. 'interval' function in Measure command should support all statistical/aggregation functions (Max/Min/Avg/Sum) not just count

    Per documentation:
    https://azure.microsoft.com/en-us/documentation/articles/operational-insights-search/
    Interval function is supported only of grouping Date/Time fields and works with only count() aggregation function. This makes the use of interval function very limited. For example if you want to create query that will show certain results for every hour for the past 12 hours for multiple of objects you can't.
    Example of this:
    Type:WireData | measure count() by ApplicationServiceName interval 1HOUR
    In order to achieve such results you will have to create query for every ApplicationServiceName like this:
    Type:WireData (ApplicationServiceName=http) | measure count() by TimeGenerated interval 1HOUR
    Additionally if you want to see the traffic…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Search UI and Language  ·  Flag idea as inappropriate…  ·  Admin →
  17. Azure Operational Insights Onboarding Issues, Error 4200

    I have been have some issues connecting my existing Operations Center install to Operational Insights. I had experimented with the very first version of operational insights and had subsequentially removed it after some initial testing, I have readded the management packs and tried to reconnect to a new workspace I have created but I get the following Error :

    Error 4200: Unable to register to Operational Insights Service. Please contact the system administrator.

    I do notice that some of the management packs are downloaded, but I also received a lot of error messages in my event logs.

    The following messages…

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Error 4200 is “Unable To Save Settings”.
    This means that registration and saving the certificate in the Runas profile in SCOM succeeded, but when we tried to save the other settings like urls and workspace Id – something failed there – these are just calls to SCOM SDK, so the underlying issue could be in the SCOM management system / database (maybe load related).

    The best first step to take for this investigation is to enable VERBOSE tracing to see what precisely fails – refer to the tracing article https://support.microsoft.com/en-us/kb/942864 (you might need to involve formal support channel to decipher this).

  18. Inaccuracy in configuration assessment for patches

    We currently have configuration assessment enabled, and we are receiving alerts for 'Servicing state update 2871777 reduces errors when applying Windows Server 2012 updates. The problem is that this is superseded by KB3003729, which we have installed on the servers throwing this alert for the prior update.

    I realize that we can select to ignore these alerts, but if I want to receive value from Op Insights I don't feel it should be necessary to 'tune' alerts for things that are being recommended by Microsoft, having to essentially evaluate the validity of each alert before acting upon it.

    9 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Will forward the bug report to the team. These rules are still maintained, but you have noticed that part of the product still uses Silverlight screens and the ‘old’ (non search) backend.

    Generally speaking, the original Advisor scenario has evolved in a few ways:

    - Configuration ‘best practices’ check are being implemented per technology in vertical IP’s such as SQL Assessment – http://blogs.technet.com/b/momteam/archive/2014/10/23/new-sql-server-assessment-intelligence-pack-in-advisor.aspx and AD Assessment http://blogs.technet.com/b/momteam/archive/2015/02/24/new-active-directory-assessment-intelligence-pack-in-azure-operational-insights.aspx

    - tracking changes of configuration has been turned into the ‘Change Tracking’ solution http://blogs.technet.com/b/momteam/archive/2014/09/24/wish-you-knew-which-configuration-change-caused-the-issue-or-what-changed-on-a-server.aspx

    - System Update Assessment for tracking overall patch status

    The new platform allows more data types and scenarios and is still evolving.

  19. Allow for more than 1 tile for Azure Automation

    currently the automation tile is limited to show the status of a single Automation account,

    there is going to be a need for more than 1 Automation tile as people create more Automation accounts in there subscription.

    10 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Workspace Settings / Administration  ·  Flag idea as inappropriate…  ·  Admin →
  20. Horizontal Scroll Bar

    Add a horizontal scroll bar to the table view, or anywhere else that columns are re-sizeable.

    5 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    0 comments  ·  Alert Management Solution  ·  Flag idea as inappropriate…  ·  Admin →

    Maybe, but nested scrolling in web pages/frames becomes not very usable very quickly.

    Please check the related ideas with regards to how we are approaching ‘columns’ in table view.

    http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519229-allow-resize-of-columns-in-table-view-for-aggregate

    http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519220-columns-in-search

  • Don't see your idea?

Feedback and Knowledge Base