Home

Application Gateway Logs not shown in Azure Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-787989%22%20slang%3D%22en-US%22%3EApplication%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-787989%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20an%20Application%20Gateway%2C%20with%20WAF%20enabled%20and%20set%20to%20detection%20mode%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20613px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125593iBA90AF5E1770774D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22WAF_Settings.PNG%22%20title%3D%22WAF_Settings.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EI%20want%20to%20show%20and%20query%20%22ApplicationGatewayAccessLog%22%2C%20%22ApplicationGatewayPerformanceLog%22%20and%20%22ApplicationGatewayFirewallLog%22%20using%20the%20Azure%20Log%20Analytics.%3C%2FP%3E%3CP%3ETherefor%20I%20enabled%20logging%20using%20the%20following%20configuration%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20771px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125592i201826133E08349B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Diagnostics_Settings.PNG%22%20title%3D%22Diagnostics_Settings.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EI%20can%20see%20that%20diagnostics%20is%20enabled%20for%20the%20Application%20Gateway%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20780px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125596iB9CDE47AD7F2985A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22diagnostics_enabled.PNG%22%20title%3D%22diagnostics_enabled.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20If%20I%20search%20with%20one%20of%20the%20following%20Queries%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-javascript%22%3E%3CCODE%3EAzureDiagnostics%20%7C%20limit%2050%20%20%20%2F%2F%20Should%20show%20at%20least%20that%20there%20is%20a%20AzureDiagnostics%20table%0A%0AAzureDiagnostics%20%7C%20where%20Category%20%3D%3D%20%22ApplicationGatewayFirewallLog%22%20%2F%2F%20Should%20show%20the%20firewall%20logs%20i%20want%20to%20see%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20always%20get%20the%20same%20error%20message%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3E'take'%20operator%3A%20Failed%20to%20resolve%20table%20or%20column%20expression%20named%20'AzureDiagnostics'%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20if%20there%20is%20no%20data%20available.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EAm%20I%20missing%20a%20configuration%20detail%3F%20%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3EDo%20I%20need%20to%20search%20using%20another%20query%3F%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIm%20thankful%20for%20any%20pointer%20in%20the%20right%20direction.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-787989%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Gateway%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-788098%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-788098%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F387358%22%20target%3D%22_blank%22%3E%40TardigradeX%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHow%20long%20did%20you%20wait%20between%20between%20enabling%20and%20running%20the%20query%20(your%20queries%20look%20good%2C%20some%20other%20examples%20here%3A%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Frobdavies%2F2017%2F12%2F29%2Fmonitoring-application-gateway-with-azure-log-analytics%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Frobdavies%2F2017%2F12%2F29%2Fmonitoring-application-gateway-with-azure-log-analytics%2F%3C%2FA%3E%26nbsp%3B%20)%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20will%20show%20what%20(if%20any)%20categories%20you%20have%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20summarize%20by%20Category%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3EYou%20should%20also%20see%20AzureDiagnostics%20in%20the%20schema%2C%20if%20you%20don't%20no%20data%20has%20been%20sent%20(or%20was%20blocked)%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20596px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125606i86B751F9EF31F275%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-08-05%20140654.jpg%22%20title%3D%22Annotation%202019-08-05%20140654.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-788181%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-788181%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20for%20your%20response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes%2C%20the%20WAF%20is%20active%20and%20Logging%20is%20enabled%20since%203-4%20hours%20now.%3C%2FP%3E%3CP%3EI%20can%20see%20AzureDiagnostics%20in%20the%20schema%2C%20but%20every%20query%20to%20this%20table%20throws%20an%20error%20as%20if%20it%20does%20not%20exist.%3C%2FP%3E%3CP%3EYou%20can%20see%20everything%20here%2C%20where%20I%20tried%20the%20category%20query%20you%20suggested%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125610i859DD141D3227750%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Unbenannt.PNG%22%20title%3D%22Unbenannt.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-788293%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-788293%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F387358%22%20target%3D%22_blank%22%3E%40TardigradeX%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20have%20full%20access%20to%20that%20schema%20Table%20(can%20someone%20else%20try)%3F%26nbsp%3B%20Can%20you%20see%20other%20tables%20and%20query%20them%20under%20%3CSTRONG%3ELogManagement%3C%2FSTRONG%3E%26nbsp%3B%20-%20like%20%3CSTRONG%3EAlert%3C%2FSTRONG%3Eor%20%3CSTRONG%3EAzureActivity%3C%2FSTRONG%3E%3F%26nbsp%3B%20Is%20table%20level%20RBAC%20set%20(however%20if%20it%20was%20that%20I%20would%20expect%20a%20different%20message)%3F%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-access%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-access%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20might%20need%20to%20%22copy%20request%20id%20to%20clipboard%22%20and%20raise%20a%20support%20ticket%20-%20unless%20anyone%20else%20has%20an%20idea%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-789836%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-789836%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20opened%20a%20support%20ticket%20and%20with%20their%20help%20I%20was%20able%20to%20solve%20the%20problem.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20had%20to%20go%20to%20the%20Log%20Analytics%20Workspace%2C%20to%20which%20I%20configured%20the%20application%20gateway%20to%20send%20its%20log%20too.%20There%20I%20could%20query%20for%20the%20logs%20and%20all%20tables%20were%20in%20place.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20I%20did%20before%20was%20going%20to%3A%26nbsp%3B%20%22Application%20Gateway%20Resource%20-%26gt%3B%20Monitoring%20-%26gt%3B%20log%22%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20log%20there%20is%20empty%20and%20missing%20tables%20and%20is%20not%20connected%20to%20the%20Log%20Analytics%20Workspace%20I%20created%20on%20the%20gateway%20resource.%3C%2FP%3E%3CP%3EThis%20is%20a%20kind%20of%20confusing%20UI%20design%2C%20but%20now%20I%20know%20how%20to%20access%2Fquery%20the%20log.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20again%20for%20your%20input.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-798973%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-798973%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3EIt%20seems%20like%20you%20did%20the%20right%20things%20and%20it%20should%20work%20without%20going%20to%20the%20workspace.%20I%20will%20investigate%20what%20happened%20in%20your%20case.%3CBR%20%2F%3E%3CBR%20%2F%3ESorry%20for%20that%2C%3CBR%20%2F%3EMeir%20from%20the%20Azure%20Monitor%20Logs%20team%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
TardigradeX
New Contributor

Hello,

 

I have an Application Gateway, with WAF enabled and set to detection mode:

WAF_Settings.PNG

I want to show and query "ApplicationGatewayAccessLog", "ApplicationGatewayPerformanceLog" and "ApplicationGatewayFirewallLog" using the Azure Log Analytics.

Therefor I enabled logging using the following configuration:

 

Diagnostics_Settings.PNG

I can see that diagnostics is enabled for the Application Gateway:

 

diagnostics_enabled.PNG

 

But If I search with one of the following Queries:

 

 

 

AzureDiagnostics | limit 50   // Should show at least that there is a AzureDiagnostics table

AzureDiagnostics | where Category == "ApplicationGatewayFirewallLog" // Should show the firewall logs i want to see

 

 

I always get the same error message:

 

'take' operator: Failed to resolve table or column expression named 'AzureDiagnostics'

 

As if there is no data available.

 

Am I missing a configuration detail?

Do I need to search using another query?

 

Im thankful for any pointer in the right direction.

5 Replies

@TardigradeX 

 

How long did you wait between between enabling and running the query (your queries look good, some other examples here:  https://blogs.technet.microsoft.com/robdavies/2017/12/29/monitoring-application-gateway-with-azure-l...  )?  Is this an active WAF with data that will generate log entries?

 

This will show what (if any) categories you have

 

AzureDiagnostics
| summarize by Category

 

You should also see AzureDiagnostics in the schema, if you don't no data has been sent (or was blocked)

Annotation 2019-08-05 140654.jpg

 

You can test queries (in the meantime) in the demo portal: Go to Log Analytics and Run Query 

@Clive Watson 

 

Thank you for your response.

 

Yes, the WAF is active and Logging is enabled since 3-4 hours now.

I can see AzureDiagnostics in the schema, but every query to this table throws an error as if it does not exist.

You can see everything here, where I tried the category query you suggested:

Unbenannt.PNG

@TardigradeX 

 

If you have full access to that schema Table (can someone else try)?  Can you see other tables and query them under LogManagement  - like Alert or AzureActivity?  Is table level RBAC set (however if it was that I would expect a different message)?

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access

 

You might need to "copy request id to clipboard" and raise a support ticket - unless anyone else has an idea?

@Clive Watson

 

I opened a support ticket and with their help I was able to solve the problem.

 

I had to go to the Log Analytics Workspace, to which I configured the application gateway to send its log too. There I could query for the logs and all tables were in place.

 

What I did before was going to:  "Application Gateway Resource -> Monitoring -> log" 

The log there is empty and missing tables and is not connected to the Log Analytics Workspace I created on the gateway resource.

This is a kind of confusing UI design, but now I know how to access/query the log.

 

Thanks again for your input.

Hi,
It seems like you did the right things and it should work without going to the workspace. I will investigate what happened in your case.

Sorry for that,
Meir from the Azure Monitor Logs team