Forum Discussion

danny_grasso's avatar
danny_grasso
Brass Contributor
Sep 01, 2021
Solved

Notify when new version of log analytics agent is available

Hi Azure Monitor Humans,

 

I'm wondering if there is a way to determine when the Log Analytics agent or Azure monitor agent is below the current available version.

I.e. if current version of the Windows agent is 10.20.18018.0 but agent version 10.20.18053.0 is available to install from the log analytics workspace, is there a way to create a query to determine this?

Is this something that could be added to the Insights workbook? Although ideally we would like to alert when agents are out of date.

Thanks

 

Danny

azure monitor
  • CliveWatson's avatar
    CliveWatson
    Sep 09, 2021

    danny_grasso 

     

    The first part (should) just get the newest version from the Heartbeat table

    Heartbeat
    | summarize max(Version)

    If you run the above on its own, I assume you are not getting "10.20.18053.0" as the latest.

    Something like this may solve it (but I need longer to look)

    let max_ = toscalar(Heartbeat
| where TimeGenerated > ago(90d)
| summarize by Version , strlen(Version)
| order by strlen(Version) desc, Version desc);
Heartbeat
| where OSType !="Linux"
| summarize by Version, Computer
| extend isLatest = iif(Version == max_,"Latest version","Upgrade needed?")
| order by isLatest asc

4 Replies

  • CliveWatson's avatar
    CliveWatson
    Former Employee
    Sep 02, 2021

    danny_grasso 

    I had this from a while ago, but never fully tested it...in case it helps? 

     

    let max_ = toscalar(Heartbeat
| summarize max(Version));
Heartbeat
| where OSType !="Linux"
| summarize by Version, Computer
| extend isLatest = iif(Version == max_,"Latest version","Upgrade needed?")
| order by isLatest asc

     

    • danny_grasso's avatar
      danny_grasso
      Brass Contributor
      Sep 09, 2021
      Getting some odd results! Apart from some very old versions in this environment, it doesn't seem to be detecting 10.20.18053.0 as the latest version. I don't understand what the first part of the query is doing before the Heartbeat command. Has something changed where we can't query the current version available to install?

      (Server names removed )

      8.0.11072.0 Latest version
      10.20.18053.0 Upgrade needed?
      10.20.18053.0 Upgrade needed?
      10.20.18053.0 Upgrade needed?
      10.20.18053.0 Upgrade needed?
      10.20.18053.0 Upgrade needed?
      10.20.18001.0 Upgrade needed?
      8.0.11049.0 Upgrade needed?
      10.20.18053.0 Upgrade needed?
      • CliveWatson's avatar
        CliveWatson
        Former Employee
        Sep 09, 2021

        danny_grasso 

         

        The first part (should) just get the newest version from the Heartbeat table

        Heartbeat
        | summarize max(Version)

        If you run the above on its own, I assume you are not getting "10.20.18053.0" as the latest.

        Something like this may solve it (but I need longer to look)

        let max_ = toscalar(Heartbeat
| where TimeGenerated > ago(90d)
| summarize by Version , strlen(Version)
| order by strlen(Version) desc, Version desc);
Heartbeat
| where OSType !="Linux"
| summarize by Version, Computer
| extend isLatest = iif(Version == max_,"Latest version","Upgrade needed?")
| order by isLatest asc

Resources