I'm using Azure ARC and update management. When a machine retries a certain update for to many times that update job gets "Suspended". This marks the update job as failed, but since there has been no Update failure "UpdateRunProgress" wont catch it.
Im able to filter out the Suspended job using below in Log Analytics:
"
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and ResourceType == "AUTOMATIONACCOUNTS"
| where ResultDescription has_any ("[AUM][IS][level=Error][message=Get-StatusFromException:","Status = FailedToStart. Exception: Job was suspended. ")
"
Issue here is that above does not give me a computer/device name i cleartext, so setting up an alert for this would not really give me any information except "a job was suspended".
I've noticed that i can find the computers name in cleartext by searching for the Jobid_g that above code provides, but i don't know enough about Kusto to be able to put it in the same "search".
(If it was powershell id save it in a variable and then search for that specific Jobid_g to find the computer name)
Code used to find device name:
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and ResourceType == "AUTOMATIONACCOUNTS"
| where ResultType == "Started"
| distinct JobId_g, ResultType , ResultDescription, RunOn_s
Is what im trying to do possible in Log Analytics or should i look towards other means to catch this error?
