Forum Discussion

João Henrique Mortati Fuzinelli's avatar
João Henrique Mortati Fuzinelli
Brass Contributor
Oct 10, 2017
Solved

Log analytics results is late for South Brazil

I'm trying to use OMS alerts for heartbeat of my servers. On the old Log analytics, i readed an article saying thats the agent reports each 60 seconds for the OMS and the results of the queries is no...
azure monitor
Query Language
  • Stanislav_Zhelyazkov's avatar
    Stanislav_Zhelyazkov
    Oct 11, 2017

    Hi

    If you are quering this way

     

    Heartbeat

    You will get inconsistant alerts. With the new query langauge you have to specify the sorting. In the old one sorting was always done on TimeGenerated if not specified. So you have to do query like this to get the latest data

     

    Heartbeat | sort by TimeGenerated desc

    Otherwise there is no change on how logs are ingested into Log Analytics.

Tore Grøneng's avatar
Tore Grøneng
Copper Contributor
Apr 15, 2018

hi,

 

Also had a client that experienced latency in ingestion for among other things Heartbeat. Currently Azure Alert has a public preview where they will make the heartbeats sent from the agents available as a metric in Azure (<5 minutes latency). Log analytics will still ingest the heartbeats, however more slowly. Currently there are a limitation that you have to create a Azure Alert rule for each compute object, however that can be scripted with PowerShell. Look me up on Twitter (@ToreGroneng) and I will share the script with anyone interested. In the near future, the Alert team will address this, so that you can have a single rule for all your computer objects. 

 

Cheers 

 

Tore