How to query azure load balancer logs

[James Quinn]

I have an Azure Load Balancer, I have gone into the Load Balancer resource, Diagnostics logs and ticked 'Send to Log Analytics' and set to my Azure Log Analytics OMS Workspace.

But when I go into the Log Analytics and run:

AzureDiagnostics 
| where Category == "LoadBalancerProbeHealthStatus" and TimeGenerated > ago(3d) 
| project ResourceGroup, Resource, TimeGenerated, port_d, totalDipCount_d, dipDownCount_d, healthPercentage_d

I don't get any results, can anyone help my understand how to make this work?

[#2]

you should run the query against heartbeat table in the OMS workspace

[#3]

Running the following does not return any results.

I do not want the heartbeat of the individual VM's, I want to know the Health Probe for the load balancer.

Heartbeat
| where Category == "LoadBalancerProbeHealthStatus"

[#4]

well James I dont see any such table with name azurediagnostics, can you just query the tables one by one and check which one contains the category you are looking for

[#5]

Thats odd's because I can see azurediagnostics and it has that category, I have raised a case with Azure now to see if they can assist and will update this post as things progress.

[#6]

Come up against the same issue this morning. Did you get anywhere with yours?

[#7]

Raise a case with azure, its a problem at their end, the latest update I got from them on Tuesday 10th July is: 

From Azure Networking there are no logs that we can use to see why the connection between SLB and Azure Insights fails.

Azure Insights is responsible for gathering the logs from Azure SLB.

We are waiting for Azure Insights team to verify what is going on between those 2 Azure modules.

I will keep you posted with our progress.

So if you could also raise a case, gives them more reason to get it fixed if theres more customers waiting for it to be fixed...

[#8]

I have enabled Diagnostics for a public load balancer and able to see the logs of the probe health in App Insights and get email notifications by using Monitors. 
Query : 

AzureDiagnostics

| where Category == "LoadBalancerProbeHealthStatus" and TimeGenerated > ago(3d) and healthPercentage_d < 100

| project ResourceGroup, Resource, TimeGenerated, port_d, totalDipCount_d, dipDownCount_d, healthPercentage_d

(or)

AzureDiagnostics | where Category == 'LoadBalancerProbeHealthStatus' | where healthPercentage_d != (100)

Thanks,

Anuraag