SOLVED

Work Space Register - Query Shutdown-Start-VMs-By-Resource-Group Errors

%3CLINGO-SUB%20id%3D%22lingo-sub-564024%22%20slang%3D%22en-US%22%3EWork%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-564024%22%20slang%3D%22en-US%22%3E%3CP%3EI%20need%20query%20to%20show%20error%C2%B4s%20in%20the%3C%2FP%3E%3CH2%20id%3D%22toc-hId-1736128959%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%20id%3D%22toc-hId-1736128960%22%3EShutdown-Start-VMs-By-Resource-Group%3C%2FH2%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20create%20an%20alert%20in%20the%20Work%20Space%2C%20because%20de%20runbook%20is%20complete%20but%20generate%20error%C2%B4s%20and%20the%20VM%20not%20power%20on.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-564024%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Insights%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESolutions%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-565015%22%20slang%3D%22en-US%22%3ERe%3A%20Work%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-565015%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F341467%22%20target%3D%22_blank%22%3E%40alejandro_contreras%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eyou%20can%20check%20your%20runbook%20status%20with%3C%2FP%3E%0A%3CPRE%3EAzureDiagnostics%0A%7C%20where%20ResourceProvider%20%3D%3D%20%22MICROSOFT.AUTOMATION%22%20and%20Category%20%3D%3D%20%22JobLogs%22%20%0A%7C%20summarize%20count()%20by%20ResultType%20%3C%2FPRE%3E%0A%3CP%3EYou%20then%20probably%20want%20to%20alter%20this%20to%20just%20look%20at%20%22Failed%22%20and%20maybe%20the%20specific%20runbook%20name%3F%3C%2FP%3E%0A%3CPRE%3EAzureDiagnostics%0A%7C%20where%20ResourceProvider%20%3D%3D%20%22MICROSOFT.AUTOMATION%22%20and%20Category%20%3D%3D%20%22JobLogs%22%20%0A%20%20%20%20and%20(ResultType%20%3D%3D%20%22Failed%22%20or%20ResultType%20%3D%3D%20%22Stopped%22%20or%20ResultType%20%3D%3D%20%22Suspended%22%20or%20ResultType%20%3D%3D%20%22Pending%22%20or%20ResultType%20%3D%3D%20%22Started%22)%0A%7C%20project%20TimeGenerated%20%2C%20RunbookName_s%20%2C%20ResultType%20%2C%20Resource%3C%2FPRE%3E%0A%3CP%3ESo%20for%20use%20in%20an%20Azure%20Monitor%20Alert%20it%20would%20be%20something%20like%20this%3A%3C%2FP%3E%0A%3CPRE%3EAzureDiagnostics%0A%7C%20where%20ResourceProvider%20%3D%3D%20%22MICROSOFT.AUTOMATION%22%20and%20Category%20%3D%3D%20%22JobLogs%22%20%0A%20%20%20%20and%20(ResultType%20%3D%3D%20%22Failed%22)%0A%20%20%20%20%2F%2F%20and%20RunbookName_s%20%3D%3D%20%22Shutdown-Start-VMs-By-Resource-Group%22%0A%7C%20summarize%20count()%20by%20ResultType%20%3C%2FPRE%3E%0A%3CP%3EYou%20can%20force%20a%20value%20to%20be%200%20or%201%20by%20changing%20the%20last%20line%20to%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAzureDiagnostics%0A%7C%20where%20ResourceProvider%20%3D%3D%20%22MICROSOFT.AUTOMATION%22%20and%20Category%20%3D%3D%20%22JobLogs%22%20%0A%20%20%20%20and%20(ResultType%20%3D%3D%20%22Failed%22)%0A%20%20%20%20%2F%2F%20and%20RunbookName_s%20%3D%3D%20%22Shutdown-Start-VMs-By-Resource-Group%22%0A%7C%20summarize%20count()%20by%20ResultType%20%0A%7C%20where%20count_%20%26gt%3B%201%20%20%20%20%20%20%20%20%20%20%20%20%20%2F%2F%20put%20in%20your%20own%20threshold%20here%0A%7C%20extend%20AggregatedValue%20%3D%201%20%20%20%2F%2F%20set%20this%20to%20One%2F1%20if%20the%20threshold%20is%20breached%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-566450%22%20slang%3D%22en-US%22%3ERe%3A%20Work%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-566450%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%20thank%C2%B4s%20for%20your%20answer%20.%20I%20verify%20and%20send%20the%20comments%20later.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-566697%22%20slang%3D%22en-US%22%3ERe%3A%20Work%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-566697%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%26nbsp%3B%20The%20query%C2%B4s%20they%20work%20perfect%20%2C%20but%20in%20the%20Registre%20of%20Work%20Space%26nbsp%3B%20only%20show%20me%20last%20day.%26nbsp%3B%20I%20modify%20the%20time%20range%20for%20last%207%20seven%20days%20but%20not%20function.%20For%20solution%20i%20need%20show%20me%20more%20days%20in%20the%20query%C2%B4s.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-566702%22%20slang%3D%22en-US%22%3ERe%3A%20Work%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-566702%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%20The%20query%C2%B4s%20they%20work%20perfect%20%2C%20but%20in%20the%20Registre%20of%20Work%20Space%20only%20show%20me%20last%20day.%20I%20modify%20the%20time%20range%20for%20last%207%20seven%20days%20but%20not%20function.%20For%20solution%20i%20need%20show%20me%20more%20days%20in%20the%20query%C2%B4s.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-568434%22%20slang%3D%22en-US%22%3ERe%3A%20Work%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-568434%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F341467%22%20target%3D%22_blank%22%3E%40alejandro_contreras%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20need%20to%20add%20an%20extra%20line%2C%20assuming%20you%20have%2030days%20of%20data%2C%20if%20you%20have%20more%20increase%20the%20value%20%3A)%3C%2Fimg%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAzureDiagnostics%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(30d)%20%20%2F%2F%20from%20time%20you%20run%20the%20query%20untilthe%20same%20time%2030days%20ago%0A%0A%2F%2For%0A%0AAzureDiagnostics%0A%7C%20where%20TimeGenerated%20%26gt%3B%20startofday(ago(30d))%20%20%2F%2F%20from%20midnight%20on%20that%20day%20-%20full%20day%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-569520%22%20slang%3D%22en-US%22%3ERe%3A%20Work%20Space%20Register%20-%20Query%20Shutdown-Start-VMs-By-Resource-Group%20Errors%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-569520%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BThanks%20....%26nbsp%3B%20Perfect%20!%20I%20created%20the%20alert.%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20907px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F113374iCD14290D131B2B88%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22ErrorLog1.JPG%22%20title%3D%22ErrorLog1.JPG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F113375i051715C33989309C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22ErrorLog2.JPG%22%20title%3D%22ErrorLog2.JPG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20565px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F113373iFD6E049D7830CC2C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22ErrorLog3.JPG%22%20title%3D%22ErrorLog3.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

I need query to show error´s in the

Shutdown-Start-VMs-By-Resource-Group

 

For create an alert in the Work Space, because de runbook is complete but generate error´s and the VM not power on.

 

6 Replies
Highlighted
Solution

@alejandro_contreras 

 

you can check your runbook status with

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
| summarize count() by ResultType 

You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started")
| project TimeGenerated , RunbookName_s , ResultType , Resource

So for use in an Azure Monitor Alert it would be something like this:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 

You can force a value to be 0 or 1 by changing the last line to 

 

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 
| where count_ > 1             // put in your own threshold here
| extend AggregatedValue = 1   // set this to One/1 if the threshold is breached

 

Highlighted

@Clive Watson  thank´s for your answer . I verify and send the comments later. 

Highlighted

@Clive Watson   The query´s they work perfect , but in the Registre of Work Space  only show me last day.  I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.

Highlighted

@Clive Watson  The query´s they work perfect , but in the Registre of Work Space only show me last day. I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.

Highlighted

@alejandro_contreras 

 

You need to add an extra line, assuming you have 30days of data, if you have more increase the value :)

 

AzureDiagnostics
| where TimeGenerated > ago(30d)  // from time you run the query untilthe same time 30days ago

//or

AzureDiagnostics
| where TimeGenerated > startofday(ago(30d))  // from midnight on that day - full day
Highlighted

@Clive Watson   Thanks ....  Perfect ! I created the alert. ErrorLog1.JPGErrorLog2.JPGErrorLog3.JPG