Home

Application Gateway Logs not shown in Azure Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-787989%22%20slang%3D%22en-US%22%3EApplication%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-787989%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20an%20Application%20Gateway%2C%20with%20WAF%20enabled%20and%20set%20to%20detection%20mode%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20613px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125593iBA90AF5E1770774D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22WAF_Settings.PNG%22%20title%3D%22WAF_Settings.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EI%20want%20to%20show%20and%20query%20%22ApplicationGatewayAccessLog%22%2C%20%22ApplicationGatewayPerformanceLog%22%20and%20%22ApplicationGatewayFirewallLog%22%20using%20the%20Azure%20Log%20Analytics.%3C%2FP%3E%3CP%3ETherefor%20I%20enabled%20logging%20using%20the%20following%20configuration%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20771px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125592i201826133E08349B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Diagnostics_Settings.PNG%22%20title%3D%22Diagnostics_Settings.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EI%20can%20see%20that%20diagnostics%20is%20enabled%20for%20the%20Application%20Gateway%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20780px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125596iB9CDE47AD7F2985A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22diagnostics_enabled.PNG%22%20title%3D%22diagnostics_enabled.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20If%20I%20search%20with%20one%20of%20the%20following%20Queries%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-javascript%22%3E%3CCODE%3EAzureDiagnostics%20%7C%20limit%2050%20%20%20%2F%2F%20Should%20show%20at%20least%20that%20there%20is%20a%20AzureDiagnostics%20table%0A%0AAzureDiagnostics%20%7C%20where%20Category%20%3D%3D%20%22ApplicationGatewayFirewallLog%22%20%2F%2F%20Should%20show%20the%20firewall%20logs%20i%20want%20to%20see%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20always%20get%20the%20same%20error%20message%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3E'take'%20operator%3A%20Failed%20to%20resolve%20table%20or%20column%20expression%20named%20'AzureDiagnostics'%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20if%20there%20is%20no%20data%20available.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EAm%20I%20missing%20a%20configuration%20detail%3F%20%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3EDo%20I%20need%20to%20search%20using%20another%20query%3F%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIm%20thankful%20for%20any%20pointer%20in%20the%20right%20direction.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-787989%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Gateway%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-788098%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-788098%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F387358%22%20target%3D%22_blank%22%3E%40TardigradeX%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHow%20long%20did%20you%20wait%20between%20between%20enabling%20and%20running%20the%20query%20(your%20queries%20look%20good%2C%20some%20other%20examples%20here%3A%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Frobdavies%2F2017%2F12%2F29%2Fmonitoring-application-gateway-with-azure-log-analytics%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Frobdavies%2F2017%2F12%2F29%2Fmonitoring-application-gateway-with-azure-log-analytics%2F%3C%2FA%3E%26nbsp%3B%20)%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20will%20show%20what%20(if%20any)%20categories%20you%20have%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20summarize%20by%20Category%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3EYou%20should%20also%20see%20AzureDiagnostics%20in%20the%20schema%2C%20if%20you%20don't%20no%20data%20has%20been%20sent%20(or%20was%20blocked)%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20596px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125606i86B751F9EF31F275%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-08-05%20140654.jpg%22%20title%3D%22Annotation%202019-08-05%20140654.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-788181%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-788181%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20for%20your%20response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes%2C%20the%20WAF%20is%20active%20and%20Logging%20is%20enabled%20since%203-4%20hours%20now.%3C%2FP%3E%3CP%3EI%20can%20see%20AzureDiagnostics%20in%20the%20schema%2C%20but%20every%20query%20to%20this%20table%20throws%20an%20error%20as%20if%20it%20does%20not%20exist.%3C%2FP%3E%3CP%3EYou%20can%20see%20everything%20here%2C%20where%20I%20tried%20the%20category%20query%20you%20suggested%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F125610i859DD141D3227750%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Unbenannt.PNG%22%20title%3D%22Unbenannt.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-788293%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-788293%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F387358%22%20target%3D%22_blank%22%3E%40TardigradeX%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20have%20full%20access%20to%20that%20schema%20Table%20(can%20someone%20else%20try)%3F%26nbsp%3B%20Can%20you%20see%20other%20tables%20and%20query%20them%20under%20%3CSTRONG%3ELogManagement%3C%2FSTRONG%3E%26nbsp%3B%20-%20like%20%3CSTRONG%3EAlert%3C%2FSTRONG%3Eor%20%3CSTRONG%3EAzureActivity%3C%2FSTRONG%3E%3F%26nbsp%3B%20Is%20table%20level%20RBAC%20set%20(however%20if%20it%20was%20that%20I%20would%20expect%20a%20different%20message)%3F%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-access%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-access%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20might%20need%20to%20%22copy%20request%20id%20to%20clipboard%22%20and%20raise%20a%20support%20ticket%20-%20unless%20anyone%20else%20has%20an%20idea%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-789836%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-789836%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20opened%20a%20support%20ticket%20and%20with%20their%20help%20I%20was%20able%20to%20solve%20the%20problem.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20had%20to%20go%20to%20the%20Log%20Analytics%20Workspace%2C%20to%20which%20I%20configured%20the%20application%20gateway%20to%20send%20its%20log%20too.%20There%20I%20could%20query%20for%20the%20logs%20and%20all%20tables%20were%20in%20place.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20I%20did%20before%20was%20going%20to%3A%26nbsp%3B%20%22Application%20Gateway%20Resource%20-%26gt%3B%20Monitoring%20-%26gt%3B%20log%22%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20log%20there%20is%20empty%20and%20missing%20tables%20and%20is%20not%20connected%20to%20the%20Log%20Analytics%20Workspace%20I%20created%20on%20the%20gateway%20resource.%3C%2FP%3E%3CP%3EThis%20is%20a%20kind%20of%20confusing%20UI%20design%2C%20but%20now%20I%20know%20how%20to%20access%2Fquery%20the%20log.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20again%20for%20your%20input.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-798973%22%20slang%3D%22en-US%22%3ERe%3A%20Application%20Gateway%20Logs%20not%20shown%20in%20Azure%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-798973%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3EIt%20seems%20like%20you%20did%20the%20right%20things%20and%20it%20should%20work%20without%20going%20to%20the%20workspace.%20I%20will%20investigate%20what%20happened%20in%20your%20case.%3CBR%20%2F%3E%3CBR%20%2F%3ESorry%20for%20that%2C%3CBR%20%2F%3EMeir%20from%20the%20Azure%20Monitor%20Logs%20team%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
TardigradeX
New Contributor

Hello,

 

I have an Application Gateway, with WAF enabled and set to detection mode:

WAF_Settings.PNG

I want to show and query "ApplicationGatewayAccessLog", "ApplicationGatewayPerformanceLog" and "ApplicationGatewayFirewallLog" using the Azure Log Analytics.

Therefor I enabled logging using the following configuration:

 

Diagnostics_Settings.PNG

I can see that diagnostics is enabled for the Application Gateway:

 

diagnostics_enabled.PNG

 

But If I search with one of the following Queries:

 

 

 

AzureDiagnostics | limit 50   // Should show at least that there is a AzureDiagnostics table

AzureDiagnostics | where Category == "ApplicationGatewayFirewallLog" // Should show the firewall logs i want to see

 

 

I always get the same error message:

 

'take' operator: Failed to resolve table or column expression named 'AzureDiagnostics'

 

As if there is no data available.

 

Am I missing a configuration detail?

Do I need to search using another query?

 

Im thankful for any pointer in the right direction.

5 Replies

@TardigradeX 

 

How long did you wait between between enabling and running the query (your queries look good, some other examples here:  https://blogs.technet.microsoft.com/robdavies/2017/12/29/monitoring-application-gateway-with-azure-l...  )?  Is this an active WAF with data that will generate log entries?

 

This will show what (if any) categories you have

 

AzureDiagnostics
| summarize by Category

 

You should also see AzureDiagnostics in the schema, if you don't no data has been sent (or was blocked)

Annotation 2019-08-05 140654.jpg

 

You can test queries (in the meantime) in the demo portal: Go to Log Analytics and Run Query 

@Clive Watson 

 

Thank you for your response.

 

Yes, the WAF is active and Logging is enabled since 3-4 hours now.

I can see AzureDiagnostics in the schema, but every query to this table throws an error as if it does not exist.

You can see everything here, where I tried the category query you suggested:

Unbenannt.PNG

@TardigradeX 

 

If you have full access to that schema Table (can someone else try)?  Can you see other tables and query them under LogManagement  - like Alert or AzureActivity?  Is table level RBAC set (however if it was that I would expect a different message)?

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access

 

You might need to "copy request id to clipboard" and raise a support ticket - unless anyone else has an idea?

@Clive Watson

 

I opened a support ticket and with their help I was able to solve the problem.

 

I had to go to the Log Analytics Workspace, to which I configured the application gateway to send its log too. There I could query for the logs and all tables were in place.

 

What I did before was going to:  "Application Gateway Resource -> Monitoring -> log" 

The log there is empty and missing tables and is not connected to the Log Analytics Workspace I created on the gateway resource.

This is a kind of confusing UI design, but now I know how to access/query the log.

 

Thanks again for your input.

Hi,
It seems like you did the right things and it should work without going to the workspace. I will investigate what happened in your case.

Sorry for that,
Meir from the Azure Monitor Logs team
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies