Forum Discussion

Copper Contributor

May 13, 2019

Solved

Work Space Register - Query Shutdown-Start-VMs-By-Resource-Group Errors

I need query to show error´s in the Shutdown-Start-VMs-By-Resource-Group For create an alert in the Work Space, because de runbook is complete but generate error´s and the VM not power on.

May 13, 2019

you can check your runbook status with

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
| summarize count() by ResultType

You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started")
| project TimeGenerated , RunbookName_s , ResultType , Resource

So for use in an Azure Monitor Alert it would be something like this:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType

You can force a value to be 0 or 1 by changing the last line to

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 
| where count_ > 1             // put in your own threshold here
| extend AggregatedValue = 1   // set this to One/1 if the threshold is breached

CliveWatson

Former Employee

May 13, 2019

alejandro_contreras

you can check your runbook status with

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
| summarize count() by ResultType

You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started")
| project TimeGenerated , RunbookName_s , ResultType , Resource

So for use in an Azure Monitor Alert it would be something like this:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType

You can force a value to be 0 or 1 by changing the last line to

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 
| where count_ > 1             // put in your own threshold here
| extend AggregatedValue = 1   // set this to One/1 if the threshold is breached

alejandro_contreras

Copper Contributor

May 14, 2019

CliveWatson The query´s they work perfect , but in the Registre of Work Space only show me last day. I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.

CliveWatson
Former Employee
May 15, 2019
alejandro_contreras

You need to add an extra line, assuming you have 30days of data, if you have more increase the value :-)

AzureDiagnostics | where TimeGenerated > ago(30d) // from time you run the query untilthe same time 30days ago //or AzureDiagnostics | where TimeGenerated > startofday(ago(30d)) // from midnight on that day - full day
- alejandro_contreras
  Copper Contributor
  May 15, 2019
  CliveWatson Thanks .... Perfect ! I created the alert.