Apr 26 2018 11:52 AM
Apr 26 2018 11:52 AM
We use the Windows Analytics modules, therefore do not have any agents (yet). All of our Data relies on Windows Telemetry. Is there any way to list machines that have not uploaded telemetry data in a certain number of days?
Apr 27 2018 04:52 AMSolution
You can use the same logic like Heartbeat query for not reporting Computers. Of course some things needs to be changed. For example:
Heartbeat | where TimeGenerated > ago(7d) | summarize LastCall=max(TimeGenerated) by Computer | where LastCall < ago(15m)
For the Heartbeat we are looking at data for the last 7 days and check for computers that hasn't reported in the last 15 minutes:
For Windows Analytics module it could be:
WaaSDeploymentStatus | where TimeGenerated > ago(7d) | summarize LastCall=max(TimeGenerated) by Computer | where LastCall < ago(2d)
It is best to check against Table that all computers report on certain intervals. I am not sure which table is that Windows Analytics but feel free to suggest if there is a better one. Here we can look for machines that haven't reported for 2 days. As Windows Analytics is send on bigger intervals than Heartbeat you will need to accommodate to that.
Hope this helps.
May 04 2018 03:19 PM
For Upgrade Readiness, you can use UAComputer.LastScan. So, for example, a query like this might give you what you are looking for:
UAComputer | where TimeGenerated==toscalar(UAComputer | summarize max (TimeGenerated)) | summarize count() by LastScan
For more information on the Windows Analytics schema and sample queries, see https://techcommunity.microsoft.com/t5/Windows-Analytics-resources/Windows-Analytics-Extensibility/m...
May 18 2018 10:38 AM
let snapShot = toscalar(UAComputer | summarize max(TimeGenerated));
search in (UAComputer) TimeGenerated==snapShot and (LastScan < now() - time(10))
May 21 2018 07:52 PM
Found this in the OMS FAQ:
How can I be notified when data collection stops?
A: Use the steps described in create an alert rule to be notified when data collection stops.
When creating the alert for when data collection stops, set the:
This alert will fire when the query returns results only if you have heartbeat missing for more than 15 minutes. Use the steps described in add actions to alert rules configure an e-mail, webhook, or runbook action for the alert rule.