SOLVED

Alerts on specific commands applied to Mariadb using log analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-1025912%22%20slang%3D%22en-US%22%3EAlerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1025912%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20activate%20alerts%20when%20certain%20commands%20are%20applied%20to%20our%20Mariadb%20database%20hosted%20on%20Azure.%20I%20have%20diagnostic%20logs%20(which%20record%20the%20string%20of%20query%20text%20used)%20and%20I%20am%20pushing%20them%20into%20my%20log%20analytics%20workspace.%20I%20am%20now%20trying%20to%20configure%20the%20search%20query%20logic%20and%20struggling.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20search%20I%20would%20like%20to%20perform%20is%20below%20but%20I%20would%20really%20appreciate%20if%20someone%20could%20shed%20some%20light%20on%20how%20this%20can%20be%20amended%20into%20the%20style%20necessary%20for%20the%20search%20query%20logic%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3Esearch%3C%2FSPAN%3E%3CSPAN%3E%20in%20(AzureDiagnostics)%20%3C%2FSPAN%3E%3CSPAN%3E%22drop%22%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%20%3CSPAN%3E%22alter%22%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%20%3CSPAN%3E%22update%22%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%20%3CSPAN%3E%22insert%22%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%20%3CSPAN%3E%22delete%22%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%20%3CSPAN%3E%22merge%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EThank%20you%20in%20advance!%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ELaura%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1025912%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECustom%20Logs%20and%20Custom%20Fields%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1025961%22%20slang%3D%22en-US%22%3ERe%3A%20Alerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1025961%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F465605%22%20target%3D%22_blank%22%3E%40laurakate_young%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20would%20be%20good%20to%20know%20what%20columns%20of%20data%20you%20are%20looking%20at.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FDemoLogsBlade%2FresourceId%2F%252FDemo%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAA3OsKi1KdclMTM%25252FLLy7JTC7m5apRyMnMzSxRMOTlAgBjJQ9DHQAAAA%25253D%25253D%2Ftimespan%2FP1D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CDIV%3E%0A%3CTABLE%20cellspacing%3D%221%22%20cellpadding%3D%225%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTH%3ETenantId%3C%2FTH%3E%0A%3CTH%3ESourceSystem%3C%2FTH%3E%0A%3CTH%3EMG%3C%2FTH%3E%0A%3CTH%3EManagementGroupName%3C%2FTH%3E%0A%3CTH%3ETimeGenerated%3C%2FTH%3E%0A%3CTH%3EComputer%3C%2FTH%3E%0A%3CTH%3EtargetVmNicDetails_s%3C%2FTH%3E%0A%3CTH%3EPolicyTimeZone_s%3C%2FTH%3E%0A%3CTH%3EtrustedService_s%3C%2FTH%3E%0A%3CTH%3Eaudit_schema_version_d%3C%2FTH%3E%0A%3CTH%3Eevent_time_t%3C%2FTH%3E%0A%3CTH%3Esequence_number_d%3C%2FTH%3E%0A%3CTH%3Esucceeded_s%3C%2FTH%3E%0A%3CTH%3Eis_column_permission_s%3C%2FTH%3E%0A%3CTH%3Esession_id_d%3C%2FTH%3E%0A%3CTH%3Eserver_principal_id_d%3C%2FTH%3E%0A%3CTH%3Edatabase_principal_id_d%3C%2FTH%3E%0A%3CTH%3Etarget_server_principal_id_d%3C%2FTH%3E%0A%3CTH%3Etarget_database_principal_id_d%3C%2FTH%3E%0A%3CTH%3Eobject_id_d%3C%2FTH%3E%0A%3CTH%3Euser_defined_event_id_d%3C%2FTH%3E%0A%3CTH%3Etransaction_id_d%3C%2FTH%3E%0A%3CTH%3Eduration_milliseconds_d%3C%2FTH%3E%0A%3CTH%3Eresponse_rows_d%3C%2FTH%3E%0A%3CTH%3Eaffected_rows_d%3C%2FTH%3E%0A%3CTH%3Eaction_id_s%3C%2FTH%3E%0A%3CTH%3Eaction_name_s%3C%2FTH%3E%0A%3CTH%3Eclass_type_s%3C%2FTH%3E%0A%3CTH%3Eclass_type_description_s%3C%2FTH%3E%0A%3CTH%3Esecurable_class_type_s%3C%2FTH%3E%0A%3CTH%3Eclient_ip_s%3C%2FTH%3E%0A%3CTH%3Epermission_bitmask_s%3C%2FTH%3E%0A%3CTH%3Esequence_group_id_g%3C%2FTH%3E%0A%3CTH%3Esession_server_principal_name_s%3C%2FTH%3E%0A%3CTH%3Eserver_principal_name_s%3C%2FTH%3E%0A%3CTH%3Eserver_principal_sid_s%3C%2FTH%3E%0A%3CTH%3Edatabase_principal_name_s%3C%2FTH%3E%0A%3CTH%3Etarget_server_principal_name_s%3C%2FTH%3E%0A%3CTH%3Etarget_server_principal_sid_s%3C%2FTH%3E%0A%3CTH%3Etarget_database_principal_name_s%3C%2FTH%3E%0A%3CTH%3Eserver_instance_name_s%3C%2FTH%3E%0A%3CTH%3Edatabase_name_s%3C%2FTH%3E%0A%3CTH%3Eschema_name_s%3C%2FTH%3E%0A%3CTH%3Eobject_name_s%3C%2FTH%3E%0A%3CTH%3Estatement_s%3C%2FTH%3E%0A%3CTH%3Eadditional_information_s%3C%2FTH%3E%0A%3CTH%3Euser_defined_information_s%3C%2FTH%3E%0A%3CTH%3Eapplication_name_s%3C%2FTH%3E%0A%3CTH%3Edata_sensitivity_information_s%3C%2FTH%3E%0A%3CTH%3Ehost_name_s%3C%2FTH%3E%0A%3CTH%3Econnection_id_g%3C%2FTH%3E%0A%3CTH%3Eevent_id_g%3C%2FTH%3E%0A%3CTH%3Eis_server_level_audit_s%3C%2FTH%3E%0A%3CTH%3EcollectionName_s%3C%2FTH%3E%0A%3CTH%3EdatabaseRid_s%3C%2FTH%3E%0A%3CTH%3EoriginalHost_s%3C%2FTH%3E%0A%3CTH%3EkeyType_s%3C%2FTH%3E%0A%3CTH%3EsubnetId_s%3C%2FTH%3E%0A%3CTH%3Elock_mode_s%3C%2FTH%3E%0A%3CTH%3Eresource_owner_type_s%3C%2FTH%3E%0A%3CTH%3Eblocked_process_filtered_s%3C%2FTH%3E%0A%3CTH%3EtrackingReference_s%3C%2FTH%3E%0A%3CTH%3EDeploymentUnit_s%3C%2FTH%3E%0A%3CTH%3EInstanceName_s%3C%2FTH%3E%0A%3CTH%3EValue_s%3C%2FTH%3E%0A%3CTH%3EmultiVmGroupName_s%3C%2FTH%3E%0A%3CTH%3ElastSuccessfulTestFailoverTime_t%3C%2FTH%3E%0A%3CTH%3ELevel_d%3C%2FTH%3E%0A%3CTH%3EisRequestSuccess_b%3C%2FTH%3E%0A%3CTH%3Elocation_s%3C%2FTH%3E%0A%3CTH%3ElastError_elapsed_d%3C%2FTH%3E%0A%3CTH%3ElastError_source_s%3C%2FTH%3E%0A%3CTH%3ElastError_reason_s%3C%2FTH%3E%0A%3CTH%3ElastError_message_s%3C%2FTH%3E%0A%3CTH%3ElastError_section_s%3C%2FTH%3E%0A%3CTH%3Emethod_s%3C%2FTH%3E%0A%3CTH%3Eurl_s%3C%2FTH%3E%0A%3CTH%3EresponseCode_d%3C%2FTH%3E%0A%3CTH%3EresponseSize_d%3C%2FTH%3E%0A%3CTH%3Ecache_s%3C%2FTH%3E%0A%3CTH%3EclientTime_d%3C%2FTH%3E%0A%3CTH%3EclientProtocol_s%3C%2FTH%3E%0A%3CTH%3EpartitionId_s%3C%2FTH%3E%0A%3CTH%3EactivityId_g%3C%2FTH%3E%0A%3CTH%3ErequestResourceType_s%3C%2FTH%3E%0A%3CTH%3ErequestResourceId_s%3C%2FTH%3E%0A%3CTH%3EcollectionRid_s%3C%2FTH%3E%0A%3CTH%3EstatusCode_s%3C%2FTH%3E%0A%3CTH%3Eduration_s%3C%2FTH%3E%0A%3CTH%3EclientIpAddress_s%3C%2FTH%3E%0A%3CTH%3ErequestCharge_s%3C%2FTH%3E%0A%3CTH%3ErequestLength_s%3C%2FTH%3E%0A%3CTH%3EresponseLength_s%3C%2FTH%3E%0A%3CTH%3EresourceTokenUserRid_s%3C%2FTH%3E%0A%3CTH%3Eregion_s%3C%2FTH%3E%0A%3CTH%3EpartitionId_g%3C%2FTH%3E%0A%3CTH%3ETenant_s%3C%2FTH%3E%0A%3CTH%3ErequestBytes_s%3C%2FTH%3E%0A%3CTH%3EresponseBytes_s%3C%2FTH%3E%0A%3CTH%3EtimeTaken_s%3C%2FTH%3E%0A%3CTH%3EsecurityProtocol_s%3C%2FTH%3E%0A%3CTH%3EroutingRuleName_s%3C%2FTH%3E%0A%3CTH%3EhttpStatusCode_s%3C%2FTH%3E%0A%3CTH%3EhttpStatusDetails_s%3C%2FTH%3E%0A%3CTH%3ERunOn_s%3C%2FTH%3E%0A%3CTH%3Eidentity_claim_ipaddr_s%3C%2FTH%3E%0A%3CTH%3Eidentity_claim_http_schemas_microsoft_com_claims_authnmethodsreferences_s%3C%2FTH%3E%0A%3CTH%3Etags_businessowner_s%3C%2FTH%3E%0A%3CTH%3Etags_compositeApp_s%3C%2FTH%3E%0A%3CTH%3Etags_costCode_s%3C%2FTH%3E%0A%3CTH%3Eerror_state_d%3C%2FTH%3E%0A%3CTH%3ERecoveryJobRPLocation_s%3C%2FTH%3E%0A%3CTH%3EJobOperationSubType_s%3C%2FTH%3E%0A%3CTH%3EAlertConsolidationStatus_s%3C%2FTH%3E%0A%3CTH%3ECountOfAlertsConsolidated_s%3C%2FTH%3E%0A%3CTH%3EAlertRaisedOn_s%3C%2FTH%3E%0A%3CTH%3EAlertCode_s%3C%2FTH%3E%0A%3CTH%3ERecommendedAction_s%3C%2FTH%3E%0A%3CTH%3EBackupItemAppVersion_s%3C%2FTH%3E%0A%3CTH%3EBackupItemSourceSize_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerName_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ErrorJobs_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_s%3C%2FTH%3E%0A%3CTH%3EProtectedInstanceCount_s%3C%2FTH%3E%0A%3CTH%3EStorageUniqueId_s%3C%2FTH%3E%0A%3CTH%3EStorageConsumedInMBs_s%3C%2FTH%3E%0A%3CTH%3EOldestRecoveryPointTime_s%3C%2FTH%3E%0A%3CTH%3EOldestRecoveryPointLocation_s%3C%2FTH%3E%0A%3CTH%3ELatestRecoveryPointTime_s%3C%2FTH%3E%0A%3CTH%3ELatestRecoveryPointLocation_s%3C%2FTH%3E%0A%3CTH%3EStorageType_s%3C%2FTH%3E%0A%3CTH%3EStorageName_s%3C%2FTH%3E%0A%3CTH%3EClusterName_s%3C%2FTH%3E%0A%3CTH%3ENodeRole_s%3C%2FTH%3E%0A%3CTH%3EMachineName_s%3C%2FTH%3E%0A%3CTH%3EAppName_s%3C%2FTH%3E%0A%3CTH%3EAppTypeName_s%3C%2FTH%3E%0A%3CTH%3EAdHocOrScheduledJob_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerOSType_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerOSVersion_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerUniqueId_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerFriendlyName_s%3C%2FTH%3E%0A%3CTH%3EAgentVersion_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerWorkloadType_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerName_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerProtectionState_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerLocation_s%3C%2FTH%3E%0A%3CTH%3EProtectedContainerType_s%3C%2FTH%3E%0A%3CTH%3EBackupItemProtectionState_s%3C%2FTH%3E%0A%3CTH%3EisAccessPolicyMatch_b%3C%2FTH%3E%0A%3CTH%3ELogBackupFrequency_s%3C%2FTH%3E%0A%3CTH%3ELogBackupRetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EResourceGroupName_s%3C%2FTH%3E%0A%3CTH%3EuploadRPOInSeconds_d%3C%2FTH%3E%0A%3CTH%3EuploadRPOUpdateTime_t%3C%2FTH%3E%0A%3CTH%3EprocessedRPOInSeconds_d%3C%2FTH%3E%0A%3CTH%3EprocessedRPOUpdateTime_t%3C%2FTH%3E%0A%3CTH%3EtimeStamp_t%3C%2FTH%3E%0A%3CTH%3ElastRecoveryPoint_t%3C%2FTH%3E%0A%3CTH%3ElatestAppConsistentRecoveryPoint_t%3C%2FTH%3E%0A%3CTH%3EreplicatingDisksCount_d%3C%2FTH%3E%0A%3CTH%3Etags_LogicAppsCategory_s%3C%2FTH%3E%0A%3CTH%3EProviderName_s%3C%2FTH%3E%0A%3CTH%3ETaskName_s%3C%2FTH%3E%0A%3CTH%3EkeyProperties_type_s%3C%2FTH%3E%0A%3CTH%3EkeyProperties_curve_s%3C%2FTH%3E%0A%3CTH%3EkeyProperties_operations_s%3C%2FTH%3E%0A%3CTH%3EkeyProperties_attributes_enabled_b%3C%2FTH%3E%0A%3CTH%3EkeyProperties_size_d%3C%2FTH%3E%0A%3CTH%3EkeyProperties_attributes_exp_d%3C%2FTH%3E%0A%3CTH%3EvaultProperties_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb4_Linux_60cf5ef0_42db_4036_bf34_8ad5dfb950f7_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb0_Linux_de6f0bed_8942_4674_9826_7ae305c7d534_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb3_Linux_20a30155_a894_441b_8012_858c00572623_g%3C%2FTH%3E%0A%3CTH%3ErecoveryServicesProviderId_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ErrorJobs_G0_Win2016_1_afbdb526_62b5_4d56_a7f6_79ed4440d868_s%3C%2FTH%3E%0A%3CTH%3EdatabaseName_s%3C%2FTH%3E%0A%3CTH%3Emetric_s%3C%2FTH%3E%0A%3CTH%3Eimpact_s%3C%2FTH%3E%0A%3CTH%3Edetections_s%3C%2FTH%3E%0A%3CTH%3ErootCauseAnalysis_s%3C%2FTH%3E%0A%3CTH%3EintervalStartTime_t%3C%2FTH%3E%0A%3CTH%3EintervalEndTme_t%3C%2FTH%3E%0A%3CTH%3EissueId_d%3C%2FTH%3E%0A%3CTH%3Evalue_d%3C%2FTH%3E%0A%3CTH%3Euser_defined_b%3C%2FTH%3E%0A%3CTH%3Eerror_number_d%3C%2FTH%3E%0A%3CTH%3ESeverity%3C%2FTH%3E%0A%3CTH%3Estate_d%3C%2FTH%3E%0A%3CTH%3Elogical_io_writes_d%3C%2FTH%3E%0A%3CTH%3Emax_logical_io_writes_d%3C%2FTH%3E%0A%3CTH%3Ephysical_io_reads_d%3C%2FTH%3E%0A%3CTH%3Emax_physical_io_reads_d%3C%2FTH%3E%0A%3CTH%3Elogical_io_reads_d%3C%2FTH%3E%0A%3CTH%3Emax_logical_io_reads_d%3C%2FTH%3E%0A%3CTH%3Eexecution_type_d%3C%2FTH%3E%0A%3CTH%3Ecpu_time_d%3C%2FTH%3E%0A%3CTH%3Emax_cpu_time_d%3C%2FTH%3E%0A%3CTH%3Edop_d%3C%2FTH%3E%0A%3CTH%3Emax_dop_d%3C%2FTH%3E%0A%3CTH%3Erowcount_d%3C%2FTH%3E%0A%3CTH%3Emax_rowcount_d%3C%2FTH%3E%0A%3CTH%3Equery_max_used_memory_d%3C%2FTH%3E%0A%3CTH%3Emax_query_max_used_memory_d%3C%2FTH%3E%0A%3CTH%3Eduration_d%3C%2FTH%3E%0A%3CTH%3Emax_duration_d%3C%2FTH%3E%0A%3CTH%3Enum_physical_io_reads_d%3C%2FTH%3E%0A%3CTH%3Emax_num_physical_io_reads_d%3C%2FTH%3E%0A%3CTH%3Elog_bytes_used_d%3C%2FTH%3E%0A%3CTH%3Emax_log_bytes_used_d%3C%2FTH%3E%0A%3CTH%3Ewait_type_s%3C%2FTH%3E%0A%3CTH%3Estart_utc_date_t%3C%2FTH%3E%0A%3CTH%3Eend_utc_date_t%3C%2FTH%3E%0A%3CTH%3Edelta_max_wait_time_ms_d%3C%2FTH%3E%0A%3CTH%3Edelta_signal_wait_time_ms_d%3C%2FTH%3E%0A%3CTH%3Edelta_wait_time_ms_d%3C%2FTH%3E%0A%3CTH%3Edelta_waiting_tasks_count_d%3C%2FTH%3E%0A%3CTH%3ELogicalServerName_s%3C%2FTH%3E%0A%3CTH%3EElasticPoolName_s%3C%2FTH%3E%0A%3CTH%3EDatabaseName_s%3C%2FTH%3E%0A%3CTH%3Ewait_category_s%3C%2FTH%3E%0A%3CTH%3Eis_parameterizable_s%3C%2FTH%3E%0A%3CTH%3Estatement_type_s%3C%2FTH%3E%0A%3CTH%3Estatement_key_hash_s%3C%2FTH%3E%0A%3CTH%3Equery_hash_s%3C%2FTH%3E%0A%3CTH%3Equery_plan_hash_s%3C%2FTH%3E%0A%3CTH%3Estatement_sql_handle_s%3C%2FTH%3E%0A%3CTH%3Einterval_start_time_d%3C%2FTH%3E%0A%3CTH%3Einterval_end_time_d%3C%2FTH%3E%0A%3CTH%3Eexec_type_d%3C%2FTH%3E%0A%3CTH%3Etotal_query_wait_time_ms_d%3C%2FTH%3E%0A%3CTH%3Emax_query_wait_time_ms_d%3C%2FTH%3E%0A%3CTH%3Equery_id_d%3C%2FTH%3E%0A%3CTH%3Eplan_id_d%3C%2FTH%3E%0A%3CTH%3Equery_param_type_d%3C%2FTH%3E%0A%3CTH%3Ecount_executions_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_ErrorJobs_ContosoWeb2_ebea0ce7_21cf_4689_8641_e7b2087f188d_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ErrorJobs_ContosoWeb3_62ae68a6_a33c_4945_9324_dcb7c7c5c5f8_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ErrorJobs_ContosoIT2_c4469c89_da43_40e1_b6d7_b5125f304da6_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ErrorJobs_ContosoWeb1_ContosoRetail_com_102df91d_ae46_40ec_a30d_cd690b612b89_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_G0_Win2016_1_afbdb526_62b5_4d56_a7f6_79ed4440d868_g%3C%2FTH%3E%0A%3CTH%3EreplicationHealthErrors_s%3C%2FTH%3E%0A%3CTH%3EeventType_s%3C%2FTH%3E%0A%3CTH%3Edescription_s%3C%2FTH%3E%0A%3CTH%3EhealthErrors_s%3C%2FTH%3E%0A%3CTH%3ElogId_g%3C%2FTH%3E%0A%3CTH%3EtimeOfOccurence_t%3C%2FTH%3E%0A%3CTH%3ErecoveryNetworkId_s%3C%2FTH%3E%0A%3CTH%3EfailoverHealthErrors_s%3C%2FTH%3E%0A%3CTH%3ElastRpoCalculatedTime_t%3C%2FTH%3E%0A%3CTH%3ErpoInSeconds_d%3C%2FTH%3E%0A%3CTH%3EagentVersion_s%3C%2FTH%3E%0A%3CTH%3ErecoveryRegion_s%3C%2FTH%3E%0A%3CTH%3EmultiVmGroupCreateOption_s%3C%2FTH%3E%0A%3CTH%3EtargetStorageAccountId_s%3C%2FTH%3E%0A%3CTH%3EtargetStorageAccountName_s%3C%2FTH%3E%0A%3CTH%3EmultiVmSyncStatus_s%3C%2FTH%3E%0A%3CTH%3EreplicationHealth_s%3C%2FTH%3E%0A%3CTH%3EfailoverHealth_s%3C%2FTH%3E%0A%3CTH%3Ename_s%3C%2FTH%3E%0A%3CTH%3EprimaryFabricName_s%3C%2FTH%3E%0A%3CTH%3ErecoveryFabricName_s%3C%2FTH%3E%0A%3CTH%3EprimaryFabricType_s%3C%2FTH%3E%0A%3CTH%3ErecoveryFabricType_s%3C%2FTH%3E%0A%3CTH%3EprimaryContainerName_s%3C%2FTH%3E%0A%3CTH%3ErecoveryContainerName_s%3C%2FTH%3E%0A%3CTH%3EprotectionState_s%3C%2FTH%3E%0A%3CTH%3EactiveLocation_s%3C%2FTH%3E%0A%3CTH%3EpolicyName_s%3C%2FTH%3E%0A%3CTH%3EreplicationProviderName_s%3C%2FTH%3E%0A%3CTH%3EosFamily_s%3C%2FTH%3E%0A%3CTH%3EitemType_s%3C%2FTH%3E%0A%3CTH%3EmultiVmGroupId_g%3C%2FTH%3E%0A%3CTH%3EmultiVmGroupName_g%3C%2FTH%3E%0A%3CTH%3Eid_g%3C%2FTH%3E%0A%3CTH%3ElastHeartbeat_t%3C%2FTH%3E%0A%3CTH%3EinitialReplicationProgressPercentage_d%3C%2FTH%3E%0A%3CTH%3EaffectedResourceId_s%3C%2FTH%3E%0A%3CTH%3EaffectedResourceName_s%3C%2FTH%3E%0A%3CTH%3EaffectedResourceType_s%3C%2FTH%3E%0A%3CTH%3Eversion_s%3C%2FTH%3E%0A%3CTH%3EaffectedResourceId_g%3C%2FTH%3E%0A%3CTH%3ElogId_d%3C%2FTH%3E%0A%3CTH%3Ehost_s%3C%2FTH%3E%0A%3CTH%3ELogScheduleFreqInMins_s%3C%2FTH%3E%0A%3CTH%3ELogRetentionType_s%3C%2FTH%3E%0A%3CTH%3ELogRetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb2_Linux_7dfa0c0e_9b8d_491d_80b8_0c284e85e40c_g%3C%2FTH%3E%0A%3CTH%3EpublicIpAddress_s%3C%2FTH%3E%0A%3CTH%3Eport_d%3C%2FTH%3E%0A%3CTH%3EtotalDipCount_d%3C%2FTH%3E%0A%3CTH%3EdipDownCount_d%3C%2FTH%3E%0A%3CTH%3EhealthPercentage_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb1_Dev_ca942d23_8d7b_4a08_a7b0_6df217fc60d9_g%3C%2FTH%3E%0A%3CTH%3EPolicyUniqueId_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoAzADDS1_ContosoRetail_com_69666b76_bf16_4b8a_bce6_00f683865c57_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoADDS1_ContosoRetail_com_6fd68e14_f18a_45de_8d26_50f76855b1ce_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoAzADDS2_e652ac47_3731_480d_8c45_06115a929da3_g%3C%2FTH%3E%0A%3CTH%3ERegion_s%3C%2FTH%3E%0A%3CTH%3EGatewayId_g%3C%2FTH%3E%0A%3CTH%3EhsmPoolPropertiesStatus_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_Contosoweb_Linux_81422fdd_5aa4_49d9_aa86_5e78139aa8e7_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoIT2_c4469c89_da43_40e1_b6d7_b5125f304da6_g%3C%2FTH%3E%0A%3CTH%3EretryHistory_s%3C%2FTH%3E%0A%3CTH%3Eerror_code_s%3C%2FTH%3E%0A%3CTH%3Eerror_message_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb2_Linux_7a1f664e_7e77_413b_b5da_9d01970c781b_g%3C%2FTH%3E%0A%3CTH%3EworkflowId_s%3C%2FTH%3E%0A%3CTH%3E_schema_s%3C%2FTH%3E%0A%3CTH%3Estatus_s%3C%2FTH%3E%0A%3CTH%3Eresource_resourceGroupName_s%3C%2FTH%3E%0A%3CTH%3Eresource_workflowName_s%3C%2FTH%3E%0A%3CTH%3Eresource_runId_s%3C%2FTH%3E%0A%3CTH%3Eresource_originRunId_s%3C%2FTH%3E%0A%3CTH%3Eresource_location_s%3C%2FTH%3E%0A%3CTH%3Ecorrelation_clientTrackingId_s%3C%2FTH%3E%0A%3CTH%3Eresource_actionName_s%3C%2FTH%3E%0A%3CTH%3Ecode_s%3C%2FTH%3E%0A%3CTH%3Eresource_triggerName_s%3C%2FTH%3E%0A%3CTH%3Eresource_subscriptionId_g%3C%2FTH%3E%0A%3CTH%3Eresource_workflowId_g%3C%2FTH%3E%0A%3CTH%3Ecorrelation_actionTrackingId_g%3C%2FTH%3E%0A%3CTH%3EstartTime_t%3C%2FTH%3E%0A%3CTH%3EendTime_t%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_Store001Web1_2306024f_1425_42f9_a7c3_e33bcdf13837_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb_0823cacc_acfc_4b50_9695_05f338c05061_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_StoreSrv003_394e7211_f2c1_4851_a2ff_efb9b4656ab5_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb2_ebea0ce7_21cf_4689_8641_e7b2087f188d_g%3C%2FTH%3E%0A%3CTH%3EAlertUniqueId_s%3C%2FTH%3E%0A%3CTH%3EAlertType_s%3C%2FTH%3E%0A%3CTH%3EAlertStatus_s%3C%2FTH%3E%0A%3CTH%3EAlertOccurrenceDateTime_s%3C%2FTH%3E%0A%3CTH%3EAlertSeverity_s%3C%2FTH%3E%0A%3CTH%3ECloudStorageInBytes_s%3C%2FTH%3E%0A%3CTH%3EProtectedInstances_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb1_Linux_05d47a4f_8462_4dfc_adf3_f0be0f98f926_g%3C%2FTH%3E%0A%3CTH%3EJobOperation_s%3C%2FTH%3E%0A%3CTH%3EJobStatus_s%3C%2FTH%3E%0A%3CTH%3EJobFailureCode_s%3C%2FTH%3E%0A%3CTH%3EJobStartDateTime_s%3C%2FTH%3E%0A%3CTH%3EBackupStorageDestination_s%3C%2FTH%3E%0A%3CTH%3EJobDurationInSecs_s%3C%2FTH%3E%0A%3CTH%3EDataTransferredInMB_s%3C%2FTH%3E%0A%3CTH%3EJobUniqueId_g%3C%2FTH%3E%0A%3CTH%3EPolicyName_s%3C%2FTH%3E%0A%3CTH%3EBackupFrequency_s%3C%2FTH%3E%0A%3CTH%3EBackupTimes_s%3C%2FTH%3E%0A%3CTH%3EBackupDaysOfTheWeek_s%3C%2FTH%3E%0A%3CTH%3ERetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EDailyRetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EDailyRetentionTimes_s%3C%2FTH%3E%0A%3CTH%3EWeeklyRetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EWeeklyRetentionTimes_s%3C%2FTH%3E%0A%3CTH%3EWeeklyRetentionDaysOfTheWeek_s%3C%2FTH%3E%0A%3CTH%3EMonthlyRetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EMonthlyRetentionTimes_s%3C%2FTH%3E%0A%3CTH%3EMonthlyRetentionFormat_s%3C%2FTH%3E%0A%3CTH%3EMonthlyRetentionDaysOfTheWeek_s%3C%2FTH%3E%0A%3CTH%3EMonthlyRetentionWeeksOfTheMonth_s%3C%2FTH%3E%0A%3CTH%3EYearlyRetentionDuration_s%3C%2FTH%3E%0A%3CTH%3EYearlyRetentionTimes_s%3C%2FTH%3E%0A%3CTH%3EYearlyRetentionMonthsOfTheYear_s%3C%2FTH%3E%0A%3CTH%3EYearlyRetentionFormat_s%3C%2FTH%3E%0A%3CTH%3EYearlyRetentionDaysOfTheWeek_s%3C%2FTH%3E%0A%3CTH%3EYearlyRetentionWeeksOfTheMonth_s%3C%2FTH%3E%0A%3CTH%3EVaultName_s%3C%2FTH%3E%0A%3CTH%3EAzureDataCenter_s%3C%2FTH%3E%0A%3CTH%3EVaultTags_s%3C%2FTH%3E%0A%3CTH%3EStorageReplicationType_s%3C%2FTH%3E%0A%3CTH%3ERegisteredContainerId_s%3C%2FTH%3E%0A%3CTH%3EProtectedServerType_s%3C%2FTH%3E%0A%3CTH%3EProtectedServerFriendlyName_s%3C%2FTH%3E%0A%3CTH%3EBackupManagementServerUniqueId_s%3C%2FTH%3E%0A%3CTH%3EAzureBackupAgentVersion_s%3C%2FTH%3E%0A%3CTH%3EEventName_s%3C%2FTH%3E%0A%3CTH%3EBackupItemUniqueId_s%3C%2FTH%3E%0A%3CTH%3EBackupItemId_s%3C%2FTH%3E%0A%3CTH%3EBackupItemName_s%3C%2FTH%3E%0A%3CTH%3EBackupItemFriendlyName_s%3C%2FTH%3E%0A%3CTH%3EBackupItemType_s%3C%2FTH%3E%0A%3CTH%3EProtectedServerName_s%3C%2FTH%3E%0A%3CTH%3EProtectionState_s%3C%2FTH%3E%0A%3CTH%3ESchemaVersion_s%3C%2FTH%3E%0A%3CTH%3EState_s%3C%2FTH%3E%0A%3CTH%3EBackupManagementType_s%3C%2FTH%3E%0A%3CTH%3ELevel%3C%2FTH%3E%0A%3CTH%3EProtectedServerUniqueId_s%3C%2FTH%3E%0A%3CTH%3EVaultUniqueId_s%3C%2FTH%3E%0A%3CTH%3EPolicyUniqueId_g%3C%2FTH%3E%0A%3CTH%3EEventId_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb3_62ae68a6_a33c_4945_9324_dcb7c7c5c5f8_g%3C%2FTH%3E%0A%3CTH%3EDscResourceId_s%3C%2FTH%3E%0A%3CTH%3EDscResourceName_s%3C%2FTH%3E%0A%3CTH%3EDscResourceStatus_s%3C%2FTH%3E%0A%3CTH%3EDscModuleName_s%3C%2FTH%3E%0A%3CTH%3EDscModuleVersion_s%3C%2FTH%3E%0A%3CTH%3EDscConfigurationName_s%3C%2FTH%3E%0A%3CTH%3EErrorCode_s%3C%2FTH%3E%0A%3CTH%3EErrorMessage_s%3C%2FTH%3E%0A%3CTH%3EDscResourceDuration_d%3C%2FTH%3E%0A%3CTH%3ENodeName_s%3C%2FTH%3E%0A%3CTH%3ENodeComplianceStatus_s%3C%2FTH%3E%0A%3CTH%3EDscReportStatus_s%3C%2FTH%3E%0A%3CTH%3EConfigurationMode_s%3C%2FTH%3E%0A%3CTH%3EHostName_s%3C%2FTH%3E%0A%3CTH%3EIPAddress%3C%2FTH%3E%0A%3CTH%3ENodeId_g%3C%2FTH%3E%0A%3CTH%3EDscReportId_g%3C%2FTH%3E%0A%3CTH%3ELastSeenTime_t%3C%2FTH%3E%0A%3CTH%3EReportStartTime_t%3C%2FTH%3E%0A%3CTH%3EReportEndTime_t%3C%2FTH%3E%0A%3CTH%3ENumberOfResources_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_ChildJobs_ContosoWeb1_ContosoRetail_com_102df91d_ae46_40ec_a30d_cd690b612b89_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_value_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_PSComputerName_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_PSSourceJobInstanceId_g%3C%2FTH%3E%0A%3CTH%3EresultDescription_PSShowComputerName_b%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_EndDateTimeUtc_t%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_DurationInMinutes_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_MachineId_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_MachineName_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_ScheduleName_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_EndDateTimeUtc_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_DurationInMinutes_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_Status_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_StatusDescription_s%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_StartDateTimeUtc_t%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_RebootRequired_b%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_InitialRequiredUpdatesCount_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_TotalUpdatesInstalled_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_TotalUpdatesFailed_d%3C%2FTH%3E%0A%3CTH%3EresultDescription_Summary_InstallPercentage_d%3C%2FTH%3E%0A%3CTH%3Eidentity_claim_http_schemas_microsoft_com_identity_claims_scope_s%3C%2FTH%3E%0A%3CTH%3Eidentity_claim_http_schemas_xmlsoap_org_ws_2005_05_identity_claims_upn_s%3C%2FTH%3E%0A%3CTH%3ECallerIPAddress%3C%2FTH%3E%0A%3CTH%3EclientInfo_s%3C%2FTH%3E%0A%3CTH%3Eid_s%3C%2FTH%3E%0A%3CTH%3EOperationVersion%3C%2FTH%3E%0A%3CTH%3EResultSignature%3C%2FTH%3E%0A%3CTH%3EDurationMs%3C%2FTH%3E%0A%3CTH%3Eidentity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g%3C%2FTH%3E%0A%3CTH%3Eidentity_claim_appid_g%3C%2FTH%3E%0A%3CTH%3EhttpStatusCode_d%3C%2FTH%3E%0A%3CTH%3EclientIP_s%3C%2FTH%3E%0A%3CTH%3EhttpMethod_s%3C%2FTH%3E%0A%3CTH%3ErequestQuery_s%3C%2FTH%3E%0A%3CTH%3EuserAgent_s%3C%2FTH%3E%0A%3CTH%3EhttpVersion_s%3C%2FTH%3E%0A%3CTH%3EsslEnabled_s%3C%2FTH%3E%0A%3CTH%3EclientPort_d%3C%2FTH%3E%0A%3CTH%3EhttpStatus_d%3C%2FTH%3E%0A%3CTH%3EreceivedBytes_d%3C%2FTH%3E%0A%3CTH%3EsentBytes_d%3C%2FTH%3E%0A%3CTH%3EtimeTaken_d%3C%2FTH%3E%0A%3CTH%3EclientIp_s%3C%2FTH%3E%0A%3CTH%3EclientPort_s%3C%2FTH%3E%0A%3CTH%3ErequestUri_s%3C%2FTH%3E%0A%3CTH%3EruleSetType_s%3C%2FTH%3E%0A%3CTH%3EruleSetVersion_s%3C%2FTH%3E%0A%3CTH%3EruleId_s%3C%2FTH%3E%0A%3CTH%3EMessage%3C%2FTH%3E%0A%3CTH%3Eaction_s%3C%2FTH%3E%0A%3CTH%3Esite_s%3C%2FTH%3E%0A%3CTH%3Edetails_message_s%3C%2FTH%3E%0A%3CTH%3Edetails_data_s%3C%2FTH%3E%0A%3CTH%3Edetails_file_s%3C%2FTH%3E%0A%3CTH%3Edetails_line_s%3C%2FTH%3E%0A%3CTH%3Econditions_protocols_s%3C%2FTH%3E%0A%3CTH%3Econditions_destinationPortRange_s%3C%2FTH%3E%0A%3CTH%3Econditions_sourcePortRange_s%3C%2FTH%3E%0A%3CTH%3Econditions_sourceIP_s%3C%2FTH%3E%0A%3CTH%3Econditions_destinationIP_s%3C%2FTH%3E%0A%3CTH%3Econditions_None_s%3C%2FTH%3E%0A%3CTH%3Epriority_d%3C%2FTH%3E%0A%3CTH%3EsubnetPrefix_s%3C%2FTH%3E%0A%3CTH%3EmacAddress_s%3C%2FTH%3E%0A%3CTH%3EprimaryIPv4Address_s%3C%2FTH%3E%0A%3CTH%3EruleName_s%3C%2FTH%3E%0A%3CTH%3Edirection_s%3C%2FTH%3E%0A%3CTH%3Etype_s%3C%2FTH%3E%0A%3CTH%3EsystemId_g%3C%2FTH%3E%0A%3CTH%3EvnetResourceGuid_g%3C%2FTH%3E%0A%3CTH%3EmatchedConnections_d%3C%2FTH%3E%0A%3CTH%3EinstanceId_s%3C%2FTH%3E%0A%3CTH%3EhealthyHostCount_d%3C%2FTH%3E%0A%3CTH%3EunHealthyHostCount_d%3C%2FTH%3E%0A%3CTH%3ErequestCount_d%3C%2FTH%3E%0A%3CTH%3Elatency_d%3C%2FTH%3E%0A%3CTH%3EfailedRequestCount_d%3C%2FTH%3E%0A%3CTH%3Ethroughput_d%3C%2FTH%3E%0A%3CTH%3EStreamType_s%3C%2FTH%3E%0A%3CTH%3EResourceId%3C%2FTH%3E%0A%3CTH%3EOperationName%3C%2FTH%3E%0A%3CTH%3EResultType%3C%2FTH%3E%0A%3CTH%3EResultDescription%3C%2FTH%3E%0A%3CTH%3ERunbookName_s%3C%2FTH%3E%0A%3CTH%3ECaller_s%3C%2FTH%3E%0A%3CTH%3ECategory%3C%2FTH%3E%0A%3CTH%3ESubscriptionId%3C%2FTH%3E%0A%3CTH%3EResourceGroup%3C%2FTH%3E%0A%3CTH%3EResourceProvider%3C%2FTH%3E%0A%3CTH%3EResource%3C%2FTH%3E%0A%3CTH%3EResourceType%3C%2FTH%3E%0A%3CTH%3ETenant_g%3C%2FTH%3E%0A%3CTH%3ECorrelationId%3C%2FTH%3E%0A%3CTH%3EJobId_g%3C%2FTH%3E%0A%3CTH%3EType%3C%2FTH%3E%0A%3CTH%3E_ResourceId%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3Eb438b4f6-912a-46d5-9cb1-b44069212abc%3C%2FTD%3E%0A%3CTD%3EAzure%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E2019-11-21T14%3A15%3A32.843Z%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E10.6.0.0%2F24%3C%2FTD%3E%0A%3CTD%3E00-0D-3A-70-8D-0A%3C%2FTD%3E%0A%3CTD%3E10.6.0.6%3C%2FTD%3E%0A%3CTD%3EDefaultRule_AllowVnetOutBound%3C%2FTD%3E%0A%3CTD%3EOut%3C%2FTD%3E%0A%3CTD%3Eallow%3C%2FTD%3E%0A%3CTD%3Ea938471e-4080-49a9-9055-b66ec742b7f0%3C%2FTD%3E%0A%3CTD%3E01b6eaff-e962-4c22-b5a3-4d54f26adbdc%3C%2FTD%3E%0A%3CTD%3E18651%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3Enull%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%2FSUBSCRIPTIONS%2FE4272367-5645-4C4E-9C67-3B74B59A6982%2FRESOURCEGROUPS%2FCONTOSOAZUREHQ%2FPROVIDERS%2FMICROSOFT.NETWORK%2FNETWORKSECURITYGROUPS%2FCONTOSOWEB1NSG%3C%2FTD%3E%0A%3CTD%3ENetworkSecurityGroupCounters%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3ENetworkSecurityGroupRuleCounter%3C%2FTD%3E%0A%3CTD%3Ee4272367-5645-4c4e-9c67-3b74b59a6982%3C%2FTD%3E%0A%3CTD%3ECONTOSOAZUREHQ%3C%2FTD%3E%0A%3CTD%3EMICROSOFT.NETWORK%3C%2FTD%3E%0A%3CTD%3ECONTOSOWEB1NSG%3C%2FTD%3E%0A%3CTD%3ENETWORKSECURITYGROUPS%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%3EAzureDiagnostics%3C%2FTD%3E%0A%3CTD%3E%2Fsubscriptions%2Fe4272367-5645-4c4e-9c67-3b74b59a6982%2Fresourcegroups%2Fcontosoazurehq%2Fproviders%2Fmicrosoft.network%2Fnetworksecuritygroups%2Fcontosoweb1nsg%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%20you%20for%20example%20the%20data%20was%20in%20the%20OperationName%20column%20you%20could%20do%2C%20one%20of%20these%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20where%20OperatioName%20%20%3D%3D%20%20%22drop%22%0A%0AAzureDiagnostics%0A%7C%20where%20OperatioName%20%20contains%20%20%22drop%22%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eor%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20where%20OperatioName%20%20%3D%3D%20%20%22drop%22%20or%20OperatioName%20%20%3D%3D%20%22Insert%22%0A%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20don't%20have%20any%20MariaDB%20but%20you%20may%20want%20to%20add%20a%20check%20for%20that%20-%20something%20like%20this%20before%20the%20query%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20where%20Resource%20%3D%3D%20%22MariaDB%22%0A...%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20article%20might%20also%20help%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FTip-Easily-use-JSON-fields-in-Sentinel%2Fba-p%2F768747%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FTip-Easily-use-JSON-fields-in-Sentinel%2Fba-p%2F768747%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eand%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-gb%2Fazure%2Fazure-monitor%2Flog-query%2Fget-started-portal%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-gb%2Fazure%2Fazure-monitor%2Flog-query%2Fget-started-portal%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1035493%22%20slang%3D%22en-US%22%3ERe%3A%20Alerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1035493%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20so%20much%20for%20answering%20my%20question.%20I%20ran%20the%20query%20you%20suggested%20to%20find%20the%20columns%20which%20are%20in%20the%20attachment.%20I%20also%20tried%20to%20run%20your%20operation%20name%20queries%20with%20no%20luck%20and%20the%20check%20for%20the%20resource%20of%20mariadb%20also%20seems%20not%20to%20work!%20Could%20this%20indicate%20that%20the%20mariadb%20logs%20are%20not%20reaching%20the%20log%20analytics%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3ELaura%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1035601%22%20slang%3D%22en-US%22%3ERe%3A%20Alerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1035601%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F465605%22%20target%3D%22_blank%22%3E%40laurakate_young%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20may%20not%20have%20the%20data%20or%20are%20looking%20at%20the%20wrong%20thing%20(I%20just%20guessed%20the%20Resource%20name)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMaybe%20try%20one%20of%20these%2C%20you%20need%20to%20find%20a%20column%20that%20identifies%20the%20data%20(if%20it%20exists).%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20summarize%20count()%20by%20Resource%0A%0AAzureDiagnostics%0A%7C%20search%20%22maria%22%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1036283%22%20slang%3D%22en-US%22%3ERe%3A%20Alerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1036283%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20was%20the%20problem!%20Rather%20than%20mariadb%20it%20needed%20to%20be%20the%20specific%20name%20of%20the%20resource.%20Within%20the%20mariadb%20resource%20the%20sql%20commands%20are%20given%20under%20%22sql_text_s%22%20so%20I%20have%20run%20a%20query%20on%20that%20for%20the%20commands%20drop%20and%20delete%20and%20counting%20the%20number%20seems%20to%20work.%20However%20when%20I%20set%20the%20alert%20condition%20to%20greater%20than%200%20in%20the%20last%205%20minutes%20(in%20my%20mind%20indicating%20that%20one%20of%20these%20commands%20has%20been%20used)%2C%20I%20receive%20emails%20every%205%20minutes%20following%20a%20test%20of%20one%20of%20the%20commands.%20If%20I%20change%20the%20condition%20to%20greater%20than%201%20and%20run%20the%20same%20test%2C%20I%20don't%20receive%20any%20emails.%20Any%20ideas%3F%20Thanks%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EAzureDiagnostics%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Resource%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22name%20of%20database%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20sql_text_s%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E%22drop%22%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%3CSPAN%3E%20sql_text_s%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E%22delete%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1036489%22%20slang%3D%22en-US%22%3ERe%3A%20Alerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1036489%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F465605%22%20target%3D%22_blank%22%3E%40laurakate_young%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20would%20have%20thought%20there%20would%20be%20one%20column%20that%20was%20unique%20to%20MariaDB%2C%20like%20there%20is%20for%20SQL%20-%20with%20ResourceProvider.%26nbsp%3B%20Anyway%20moving%20on...%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F159198i82D448FF0F08B50F%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnyway%20you%20may%20want%20to%20assign%20a%20count%20to%20AggregatedValue%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20where%20Resource%20%3D%3D%20%22CONTOSOSQL1NSG%22%0A%7C%20where%20sql_text_s%20contains%20%22drop%22%20or%20sql_text_s%20contains%20%22delete%22%0A%7C%20summarize%20AggregatedValue%20%20%3D%20count()%20by%20bin(TimeGenerated%2C%205m)%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eor%20just%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20where%20Resource%20%3D%3D%20%22CONTOSOSQL1NSG%22%0A%7C%20where%20sql_text_s%20contains%20%22drop%22%20or%20sql_text_s%20contains%20%22delete%22%0A%7C%20summarize%20AggregatedValue%20%20%3D%20count()%20%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere%20a%20great%20series%20of%20post%20on%20Alerts%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fcloudadministrator.net%2F2019%2F08%2F15%2Fazure-monitor-alerts-series-part-1%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcloudadministrator.net%2F2019%2F08%2F15%2Fazure-monitor-alerts-series-part-1%2F%3C%2FA%3E%26nbsp%3B%20especially%20part%207%20%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fcloudadministrator.net%2F2019%2F10%2F07%2Fazure-monitor-alert-series-part-7%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcloudadministrator.net%2F2019%2F10%2F07%2Fazure-monitor-alert-series-part-7%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1037746%22%20slang%3D%22en-US%22%3ERe%3A%20Alerts%20on%20specific%20commands%20applied%20to%20Mariadb%20using%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1037746%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESome%20great%20news.%20Your%20last%20suggestion%20has%20fixed%20the%20problem%20and%20my%20alerts%20are%20all%20running%20as%20they%20should%20be!%20Thank%20you%20also%20for%20the%20blog%20series%20link%20-%20it%20was%20very%20helpful.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20again%2C%3C%2FP%3E%3CP%3ELaura%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi,

 

I am trying to activate alerts when certain commands are applied to our Mariadb database hosted on Azure. I have diagnostic logs (which record the string of query text used) and I am pushing them into my log analytics workspace. I am now trying to configure the search query logic and struggling. 

 

The search I would like to perform is below but I would really appreciate if someone could shed some light on how this can be amended into the style necessary for the search query logic:

 

search in (AzureDiagnostics) "drop" or "alter" or "update" or "insert" or "delete" or "merge"
 
Thank you in advance!
Laura
6 Replies

Hi @laurakate_young 

 

It would be good to know what columns of data you are looking at. 

 

Go to Log Analytics and Run Query

TenantId SourceSystem MG ManagementGroupName TimeGenerated Computer targetVmNicDetails_s PolicyTimeZone_s trustedService_s audit_schema_version_d event_time_t sequence_number_d succeeded_s is_column_permission_s session_id_d server_principal_id_d database_principal_id_d target_server_principal_id_d target_database_principal_id_d object_id_d user_defined_event_id_d transaction_id_d duration_milliseconds_d response_rows_d affected_rows_d action_id_s action_name_s class_type_s class_type_description_s securable_class_type_s client_ip_s permission_bitmask_s sequence_group_id_g session_server_principal_name_s server_principal_name_s server_principal_sid_s database_principal_name_s target_server_principal_name_s target_server_principal_sid_s target_database_principal_name_s server_instance_name_s database_name_s schema_name_s object_name_s statement_s additional_information_s user_defined_information_s application_name_s data_sensitivity_information_s host_name_s connection_id_g event_id_g is_server_level_audit_s collectionName_s databaseRid_s originalHost_s keyType_s subnetId_s lock_mode_s resource_owner_type_s blocked_process_filtered_s trackingReference_s DeploymentUnit_s InstanceName_s Value_s multiVmGroupName_s lastSuccessfulTestFailoverTime_t Level_d isRequestSuccess_b location_s lastError_elapsed_d lastError_source_s lastError_reason_s lastError_message_s lastError_section_s method_s url_s responseCode_d responseSize_d cache_s clientTime_d clientProtocol_s partitionId_s activityId_g requestResourceType_s requestResourceId_s collectionRid_s statusCode_s duration_s clientIpAddress_s requestCharge_s requestLength_s responseLength_s resourceTokenUserRid_s region_s partitionId_g Tenant_s requestBytes_s responseBytes_s timeTaken_s securityProtocol_s routingRuleName_s httpStatusCode_s httpStatusDetails_s RunOn_s identity_claim_ipaddr_s identity_claim_http_schemas_microsoft_com_claims_authnmethodsreferences_s tags_businessowner_s tags_compositeApp_s tags_costCode_s error_state_d RecoveryJobRPLocation_s JobOperationSubType_s AlertConsolidationStatus_s CountOfAlertsConsolidated_s AlertRaisedOn_s AlertCode_s RecommendedAction_s BackupItemAppVersion_s BackupItemSourceSize_s ProtectedContainerName_g resultDescription_ErrorJobs_s resultDescription_ChildJobs_s ProtectedInstanceCount_s StorageUniqueId_s StorageConsumedInMBs_s OldestRecoveryPointTime_s OldestRecoveryPointLocation_s LatestRecoveryPointTime_s LatestRecoveryPointLocation_s StorageType_s StorageName_s ClusterName_s NodeRole_s MachineName_s AppName_s AppTypeName_s AdHocOrScheduledJob_s ProtectedContainerOSType_s ProtectedContainerOSVersion_s ProtectedContainerUniqueId_s ProtectedContainerFriendlyName_s AgentVersion_s ProtectedContainerWorkloadType_s ProtectedContainerName_s ProtectedContainerProtectionState_s ProtectedContainerLocation_s ProtectedContainerType_s BackupItemProtectionState_s isAccessPolicyMatch_b LogBackupFrequency_s LogBackupRetentionDuration_s ResourceGroupName_s uploadRPOInSeconds_d uploadRPOUpdateTime_t processedRPOInSeconds_d processedRPOUpdateTime_t timeStamp_t lastRecoveryPoint_t latestAppConsistentRecoveryPoint_t replicatingDisksCount_d tags_LogicAppsCategory_s ProviderName_s TaskName_s keyProperties_type_s keyProperties_curve_s keyProperties_operations_s keyProperties_attributes_enabled_b keyProperties_size_d keyProperties_attributes_exp_d vaultProperties_s resultDescription_ChildJobs_ContosoWeb4_Linux_60cf5ef0_42db_4036_bf34_8ad5dfb950f7_g resultDescription_ChildJobs_ContosoWeb0_Linux_de6f0bed_8942_4674_9826_7ae305c7d534_g resultDescription_ChildJobs_ContosoWeb3_Linux_20a30155_a894_441b_8012_858c00572623_g recoveryServicesProviderId_g resultDescription_ErrorJobs_G0_Win2016_1_afbdb526_62b5_4d56_a7f6_79ed4440d868_s databaseName_s metric_s impact_s detections_s rootCauseAnalysis_s intervalStartTime_t intervalEndTme_t issueId_d value_d user_defined_b error_number_d Severity state_d logical_io_writes_d max_logical_io_writes_d physical_io_reads_d max_physical_io_reads_d logical_io_reads_d max_logical_io_reads_d execution_type_d cpu_time_d max_cpu_time_d dop_d max_dop_d rowcount_d max_rowcount_d query_max_used_memory_d max_query_max_used_memory_d duration_d max_duration_d num_physical_io_reads_d max_num_physical_io_reads_d log_bytes_used_d max_log_bytes_used_d wait_type_s start_utc_date_t end_utc_date_t delta_max_wait_time_ms_d delta_signal_wait_time_ms_d delta_wait_time_ms_d delta_waiting_tasks_count_d LogicalServerName_s ElasticPoolName_s DatabaseName_s wait_category_s is_parameterizable_s statement_type_s statement_key_hash_s query_hash_s query_plan_hash_s statement_sql_handle_s interval_start_time_d interval_end_time_d exec_type_d total_query_wait_time_ms_d max_query_wait_time_ms_d query_id_d plan_id_d query_param_type_d count_executions_d resultDescription_ErrorJobs_ContosoWeb2_ebea0ce7_21cf_4689_8641_e7b2087f188d_s resultDescription_ErrorJobs_ContosoWeb3_62ae68a6_a33c_4945_9324_dcb7c7c5c5f8_s resultDescription_ErrorJobs_ContosoIT2_c4469c89_da43_40e1_b6d7_b5125f304da6_s resultDescription_ErrorJobs_ContosoWeb1_ContosoRetail_com_102df91d_ae46_40ec_a30d_cd690b612b89_s resultDescription_ChildJobs_G0_Win2016_1_afbdb526_62b5_4d56_a7f6_79ed4440d868_g replicationHealthErrors_s eventType_s description_s healthErrors_s logId_g timeOfOccurence_t recoveryNetworkId_s failoverHealthErrors_s lastRpoCalculatedTime_t rpoInSeconds_d agentVersion_s recoveryRegion_s multiVmGroupCreateOption_s targetStorageAccountId_s targetStorageAccountName_s multiVmSyncStatus_s replicationHealth_s failoverHealth_s name_s primaryFabricName_s recoveryFabricName_s primaryFabricType_s recoveryFabricType_s primaryContainerName_s recoveryContainerName_s protectionState_s activeLocation_s policyName_s replicationProviderName_s osFamily_s itemType_s multiVmGroupId_g multiVmGroupName_g id_g lastHeartbeat_t initialReplicationProgressPercentage_d affectedResourceId_s affectedResourceName_s affectedResourceType_s version_s affectedResourceId_g logId_d host_s LogScheduleFreqInMins_s LogRetentionType_s LogRetentionDuration_s resultDescription_ChildJobs_ContosoWeb2_Linux_7dfa0c0e_9b8d_491d_80b8_0c284e85e40c_g publicIpAddress_s port_d totalDipCount_d dipDownCount_d healthPercentage_d resultDescription_ChildJobs_ContosoWeb1_Dev_ca942d23_8d7b_4a08_a7b0_6df217fc60d9_g PolicyUniqueId_s resultDescription_ChildJobs_ContosoAzADDS1_ContosoRetail_com_69666b76_bf16_4b8a_bce6_00f683865c57_g resultDescription_ChildJobs_ContosoADDS1_ContosoRetail_com_6fd68e14_f18a_45de_8d26_50f76855b1ce_g resultDescription_ChildJobs_ContosoAzADDS2_e652ac47_3731_480d_8c45_06115a929da3_g Region_s GatewayId_g hsmPoolPropertiesStatus_d resultDescription_ChildJobs_Contosoweb_Linux_81422fdd_5aa4_49d9_aa86_5e78139aa8e7_g resultDescription_ChildJobs_ContosoIT2_c4469c89_da43_40e1_b6d7_b5125f304da6_g retryHistory_s error_code_s error_message_s resultDescription_ChildJobs_ContosoWeb2_Linux_7a1f664e_7e77_413b_b5da_9d01970c781b_g workflowId_s _schema_s status_s resource_resourceGroupName_s resource_workflowName_s resource_runId_s resource_originRunId_s resource_location_s correlation_clientTrackingId_s resource_actionName_s code_s resource_triggerName_s resource_subscriptionId_g resource_workflowId_g correlation_actionTrackingId_g startTime_t endTime_t resultDescription_ChildJobs_Store001Web1_2306024f_1425_42f9_a7c3_e33bcdf13837_g resultDescription_ChildJobs_ContosoWeb_0823cacc_acfc_4b50_9695_05f338c05061_g resultDescription_ChildJobs_StoreSrv003_394e7211_f2c1_4851_a2ff_efb9b4656ab5_g resultDescription_ChildJobs_ContosoWeb2_ebea0ce7_21cf_4689_8641_e7b2087f188d_g AlertUniqueId_s AlertType_s AlertStatus_s AlertOccurrenceDateTime_s AlertSeverity_s CloudStorageInBytes_s ProtectedInstances_s resultDescription_ChildJobs_ContosoWeb1_Linux_05d47a4f_8462_4dfc_adf3_f0be0f98f926_g JobOperation_s JobStatus_s JobFailureCode_s JobStartDateTime_s BackupStorageDestination_s JobDurationInSecs_s DataTransferredInMB_s JobUniqueId_g PolicyName_s BackupFrequency_s BackupTimes_s BackupDaysOfTheWeek_s RetentionDuration_s DailyRetentionDuration_s DailyRetentionTimes_s WeeklyRetentionDuration_s WeeklyRetentionTimes_s WeeklyRetentionDaysOfTheWeek_s MonthlyRetentionDuration_s MonthlyRetentionTimes_s MonthlyRetentionFormat_s MonthlyRetentionDaysOfTheWeek_s MonthlyRetentionWeeksOfTheMonth_s YearlyRetentionDuration_s YearlyRetentionTimes_s YearlyRetentionMonthsOfTheYear_s YearlyRetentionFormat_s YearlyRetentionDaysOfTheWeek_s YearlyRetentionWeeksOfTheMonth_s VaultName_s AzureDataCenter_s VaultTags_s StorageReplicationType_s RegisteredContainerId_s ProtectedServerType_s ProtectedServerFriendlyName_s BackupManagementServerUniqueId_s AzureBackupAgentVersion_s EventName_s BackupItemUniqueId_s BackupItemId_s BackupItemName_s BackupItemFriendlyName_s BackupItemType_s ProtectedServerName_s ProtectionState_s SchemaVersion_s State_s BackupManagementType_s Level ProtectedServerUniqueId_s VaultUniqueId_s PolicyUniqueId_g EventId_d resultDescription_ChildJobs_ContosoWeb3_62ae68a6_a33c_4945_9324_dcb7c7c5c5f8_g DscResourceId_s DscResourceName_s DscResourceStatus_s DscModuleName_s DscModuleVersion_s DscConfigurationName_s ErrorCode_s ErrorMessage_s DscResourceDuration_d NodeName_s NodeComplianceStatus_s DscReportStatus_s ConfigurationMode_s HostName_s IPAddress NodeId_g DscReportId_g LastSeenTime_t ReportStartTime_t ReportEndTime_t NumberOfResources_d resultDescription_ChildJobs_ContosoWeb1_ContosoRetail_com_102df91d_ae46_40ec_a30d_cd690b612b89_g resultDescription_value_s resultDescription_PSComputerName_s resultDescription_PSSourceJobInstanceId_g resultDescription_PSShowComputerName_b resultDescription_Summary_EndDateTimeUtc_t resultDescription_Summary_DurationInMinutes_d resultDescription_Summary_MachineId_s resultDescription_Summary_MachineName_s resultDescription_Summary_ScheduleName_s resultDescription_Summary_EndDateTimeUtc_s resultDescription_Summary_DurationInMinutes_s resultDescription_Summary_Status_s resultDescription_Summary_StatusDescription_s resultDescription_Summary_StartDateTimeUtc_t resultDescription_Summary_RebootRequired_b resultDescription_Summary_InitialRequiredUpdatesCount_d resultDescription_Summary_TotalUpdatesInstalled_d resultDescription_Summary_TotalUpdatesFailed_d resultDescription_Summary_InstallPercentage_d identity_claim_http_schemas_microsoft_com_identity_claims_scope_s identity_claim_http_schemas_xmlsoap_org_ws_2005_05_identity_claims_upn_s CallerIPAddress clientInfo_s id_s OperationVersion ResultSignature DurationMs identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g identity_claim_appid_g httpStatusCode_d clientIP_s httpMethod_s requestQuery_s userAgent_s httpVersion_s sslEnabled_s clientPort_d httpStatus_d receivedBytes_d sentBytes_d timeTaken_d clientIp_s clientPort_s requestUri_s ruleSetType_s ruleSetVersion_s ruleId_s Message action_s site_s details_message_s details_data_s details_file_s details_line_s conditions_protocols_s conditions_destinationPortRange_s conditions_sourcePortRange_s conditions_sourceIP_s conditions_destinationIP_s conditions_None_s priority_d subnetPrefix_s macAddress_s primaryIPv4Address_s ruleName_s direction_s type_s systemId_g vnetResourceGuid_g matchedConnections_d instanceId_s healthyHostCount_d unHealthyHostCount_d requestCount_d latency_d failedRequestCount_d throughput_d StreamType_s ResourceId OperationName ResultType ResultDescription RunbookName_s Caller_s Category SubscriptionId ResourceGroup ResourceProvider Resource ResourceType Tenant_g CorrelationId JobId_g Type _ResourceId
b438b4f6-912a-46d5-9cb1-b44069212abc Azure     2019-11-21T14:15:32.843Z         null null null     null null null null null null null null null null null                                                                                   null null null   null             null null   null                                                           null                                                                             null       null null null null null null null null             null null null                       null null null null null null null null null null null null null null null null null null null null null null null null null null null null null   null null null null null null                     null null null null null null null null null                     null     null null                                                 null null           null             null null null null               null                                           null null                                                                                                                                   null                   null                 null null null null         null null null               null null null null null null               null     null             null null null null null                                       null 10.6.0.0/24 00-0D-3A-70-8D-0A 10.6.0.6 DefaultRule_AllowVnetOutBound Out allow a938471e-4080-49a9-9055-b66ec742b7f0 01b6eaff-e962-4c22-b5a3-4d54f26adbdc 18651   null null null null null null   /SUBSCRIPTIONS/E4272367-5645-4C4E-9C67-3B74B59A6982/RESOURCEGROUPS/CONTOSOAZUREHQ/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/CONTOSOWEB1NSG NetworkSecurityGroupCounters         NetworkSecurityGroupRuleCounter e4272367-5645-4c4e-9c67-3b74b59a6982 CONTOSOAZUREHQ MICROSOFT.NETWORK CONTOSOWEB1NSG NETWORKSECURITYGROUPS       AzureDiagnostics /subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourcegroups/contosoazurehq/providers/microsoft.network/networksecuritygroups/contosoweb1nsg

 

 

So you for example the data was in the OperationName column you could do, one of these?

 

AzureDiagnostics
| where OperatioName  ==  "drop"

AzureDiagnostics
| where OperatioName  contains  "drop"

 

or

AzureDiagnostics
| where OperatioName  ==  "drop" or OperatioName  == "Insert"

 

I don't have any MariaDB but you may want to add a check for that - something like this before the query: 

 

AzureDiagnostics
| where Resource == "MariaDB"
...

 

This article might also help: https://techcommunity.microsoft.com/t5/Azure-Sentinel/Tip-Easily-use-JSON-fields-in-Sentinel/ba-p/76...

 

and https://docs.microsoft.com/en-gb/azure/azure-monitor/log-query/get-started-portal 

Hi @Clive Watson 

 

Thank you so much for answering my question. I ran the query you suggested to find the columns which are in the attachment. I also tried to run your operation name queries with no luck and the check for the resource of mariadb also seems not to work! Could this indicate that the mariadb logs are not reaching the log analytics?

 

Thanks,

Laura

@laurakate_young 

 

You may not have the data or are looking at the wrong thing (I just guessed the Resource name)

 

Maybe try one of these, you need to find a column that identifies the data (if it exists). 

 

AzureDiagnostics
| summarize count() by Resource

AzureDiagnostics
| search "maria"

 

@Clive Watson 

 

That was the problem! Rather than mariadb it needed to be the specific name of the resource. Within the mariadb resource the sql commands are given under "sql_text_s" so I have run a query on that for the commands drop and delete and counting the number seems to work. However when I set the alert condition to greater than 0 in the last 5 minutes (in my mind indicating that one of these commands has been used), I receive emails every 5 minutes following a test of one of the commands. If I change the condition to greater than 1 and run the same test, I don't receive any emails. Any ideas? Thanks

 

AzureDiagnostics
| where Resource == "name of database"
| where sql_text_s contains "drop" or sql_text_s contains "delete"
| count

@laurakate_young 

 

I would have thought there would be one column that was unique to MariaDB, like there is for SQL - with ResourceProvider.  Anyway moving on...

clipboard_image_0.png

 

Anyway you may want to assign a count to AggregatedValue 

 

AzureDiagnostics
| where Resource == "CONTOSOSQL1NSG"
| where sql_text_s contains "drop" or sql_text_s contains "delete"
| summarize AggregatedValue  = count() by bin(TimeGenerated, 5m)

 

or just

 

AzureDiagnostics
| where Resource == "CONTOSOSQL1NSG"
| where sql_text_s contains "drop" or sql_text_s contains "delete"
| summarize AggregatedValue  = count() 

 

There a great series of post on Alerts https://cloudadministrator.net/2019/08/15/azure-monitor-alerts-series-part-1/  especially part 7 : https://cloudadministrator.net/2019/10/07/azure-monitor-alert-series-part-7/


 

Best Response confirmed by Clive Watson (Microsoft)
Solution

Hi  @Clive Watson 

 

Some great news. Your last suggestion has fixed the problem and my alerts are all running as they should be! Thank you also for the blog series link - it was very helpful.

 

Thanks again,

Laura