Hello There! I am working with a customer who is exploring LogAnalytics queries to query the following for his Linux VMs
Detect inode errors or file sync errors
Detect any types of disk errors : In the recent times my customer has seen disk entries being missed out in fstab (File System Table) and it has been resulting into disk not being detected when the VM reboots
Users logged in at any time and also the processes run by each user
Thank you for your response. Thanks for the share! I donot have any idea about this. But it looks to me that user related information can be queried from the Facility 'user', I am honestly not sure which Facility can help in collecting the information about disk errors and file sync errors.
If your customer has the data, they they could produce a sample using the datatable KQL operator. Like this, but with some extra columns added.
let dummyData = datatable(Date:datetime, dummyTxt:string)
datetime(now) , "This is yet another test" ,
datetime(now) , "This is yet another test string"
| where dummyTxt == "This is yet another test string"
which looks like this:
Date [UTC] | dummyTxt
2019-06-07T17:53:14.733 | This is yet another test string