Forum Discussion
Are you getting the most out of your Azure Log Analytics Workspace (LAW) investment?
Using a LAW is a great way to consolidate various types of data (performance, events, security, etc.) and signals from multiple sources. That's the easy part - mining this data for actionable insights is often the real challenge.
One way we did this was by surfacing events related to disks across our physical server estate. We were already sending event data to our LAW; it was just a matter of parsing it with KQL and adding to a Power Bi dashboard for additional visibility.
The snippet from the Power Bi dashboard shows when the alert was first triggered and when the disk was eventually replaced.
Here's the KQL query we came up with.
let start_time=ago(30d);
let end_time=now();
Event
| where TimeGenerated > start_time and TimeGenerated < end_time
| where EventLog contains 'System'
| where Source contains 'Storage Agents'
| where RenderedDescription contains 'Drive Array Physical Drive Status Change'
| parse kind=relaxed RenderedDescription with * 'Drive Array Physical Drive Status Change. The ' Drive ' with serial number ""' Serial '"", has a new status of ' Status '. (Drive status values:'*
| project Computer, Drive, Serial, Status, TimeGenerated, EventLevelName
You can of course set up alerting with Alerts for Azure Monitor.
I hope this example helps you get more value from your LAW.
5 Replies
Optimizing data and getting meaningful insights always makes a big difference when working with Azure Log Analytics Workspace. I’ve found that the same idea applies when organizing public information and resources like https://mainecourtrecords.org make it much easier to locate structured records efficiently. Having reliable data sources saves time and supports better decision making in any workflow. Great topic to bring attention to.
Great point. Many organizations focus on collecting logs but don't always spend enough time reviewing how the data supports day-to-day decisions and long-term planning. I also came across https://sedgwickcountycourts.org while researching public information resources and it reminded me how valuable well organized data can be for quick access. Regular reviews and better data management can make a noticeable difference over time.
Azure Log Analytics Workspace plays a key role in monitoring, tracking insights, and improving operational visibility for many organizations. Having access to accurate records and organized information can help users make better decisions and resources like https://jackson-county-court.org can also support research needs by providing useful public information. Reviewing available data sources regularly helps maintain efficiency and reliability.
Hi Adeelaziz ,
Thank you for the insight and the demonstration of the implementation with PowerBI.
Please allow me to ask further questions that might make things clearer for me and perhaps other readers:
- Have you connected the (physical) servers via Azure ARC?
- Do you also use alerts (Azure Monitoring)?
Thanks
Matthias
Hi Matthias-Braun,
Yes, we're using Azure Arc and also Alerts in Azure Monitor. Please note Azure Arc is not required for this specific use case. We collect events from servers via the Azure Monitoring Agent and have them sent to our LA workspace. Having Azure Arc enabled does help with other tasks such as automation, update management etc.
