Forum Discussion
Monitoring missing logs and log anomalies
Short of writing some code that queries the API directly, does anyone have suggestions for monitoring tables for missing logs?
We used to use union * across tables to look for tables that were missing logs, however we're no longer able to create those scheduled alert rules - https://github.com/Azure/Azure-Sentinel/issues/1437
Failed to save analytics rule 'Sentinel table missing logs'. Invalid data model. [Properties.Query: Scheduled alert rule query should not contain 'search' or 'union *']
// Find tables that previously had logs that are now missing logs
let lookback = 2d;
let IgnoreTables = dynamic(['AzureMetrics', 'BehaviorAnalytics', 'ProtectionStatus', 'SecurityAlert', 'SecurityBaseline', 'Update', 'UpdateSummary', 'Usage', 'UserAccessAnalytics', 'UserPeerAnalytics']);
let AllTables = union withsource=tbl *
| where TimeGenerated > ago(lookback)
| where tbl !in (IgnoreTables);
AllTables
| where TimeGenerated < ago(lookback/2)
| summarize Previous = count() by tbl
| join kind=leftanti (
AllTables
| where TimeGenerated > ago(lookback/2)
// Ignore weekends
| where dayofweek(TimeGenerated)/1d between (1 .. 5)
| summarize Current = count() by tbl
) on tbl
| extend
timestamp = now(),
HostCustomEntity = tbl,
Current = 0
pemontto Can you use the query in a workbook ,or look at the Data Collection Health Monitoring workbook to see if that works? Granted you won't get the incident generated or any playbooks kicked off but you can check it daily.
