Log Analytics For Automation Jobs

%3CLINGO-SUB%20id%3D%22lingo-sub-1214887%22%20slang%3D%22en-US%22%3ELog%20Analytics%20For%20Automation%20Jobs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1214887%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20day%2C%3C%2FP%3E%3CP%3EI%20am%20new%20to%20log%20analytics%20and%20I%20have%20a%20runbook%20that%20is%20used%20by%2040ish%20different%20schedules%20with%20different%20inputs.%26nbsp%3B%20I%20am%20able%20to%20get%20success%2Ffailure%20notification%20that%20I%20am%20looking%20for%2C%20but%20so%20far%20I%20can%20only%20seem%20to%20get%20the%20name%20of%20the%20runbook%20in%20the%20query%20on%20Log%20Analytics.%26nbsp%3B%20How%20can%20I%20get%20the%20input%20parameters%20or%20schedule%20name%20to%20into%20the%20query%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%2C%3C%2FP%3E%3CP%3EMichael%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1214887%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1215729%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%20For%20Automation%20Jobs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1215729%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F576323%22%20target%3D%22_blank%22%3E%40Dep67%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlease%20also%20take%20a%20look%20at%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fabcdazure.azurewebsites.net%2Fmonitoring-and-alerting-runbooks-with-log-analytics-and-azure-monitor%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fabcdazure.azurewebsites.net%2Fmonitoring-and-alerting-runbooks-with-log-analytics-and-azure-monitor%2F%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20suspect%20you'll%20also%20need%20another%20data%20sources%20for%20things%20like%20schedule%20etc..%20as%20that%20wouldn't%20be%20a%20logged%20event%20(you%20can%20see%20the%20TimeGenerated%20-%20as%20per%20the%20above%20queries%2C%20which%20tells%20you%20when%20it%20ran%20but%20not%20the%20schedule%20itself).%26nbsp%3B%20This%20is%20remit%20of%20logs%20to%20show%20the%20data%2C%20not%20necessarily%20the%20configuration%20-%20put%20another%20way%2C%20you%20may%20set%20up%20an%20Automation%20runbook%20that%20only%20fires%20once%20a%20year%2C%20and%20if%20you%20only%20keep%2031days%20of%20logs%20you%20wont%20know%20about%20it%20(granted%20you%20can%20alert%20on%20the%20event%20when%20it%20fires)).%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20may%20need%20an%20Azure%20Resource%20Graph%20query%20(ARG)%20that%20get%20the%20info%20from%20the%20Azure%20API.%26nbsp%3B%20e.g.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3Eresources%0A%20%7C%20where%20type%20%3D%3D%20%22microsoft.automation%2Fautomationaccounts%2Frunbooks%22%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%3CBR%20%2F%3EThe%20above%20is%20a%20sample...to%20give%20you%20an%20idea%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2F%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20bring%20that%20ARG%20data%20together%20with%20Log%20Analytics%20within%20a%20Azure%20Monitor%20workbook%2C%20using%20the%20merge%20feature.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Visitor

Good day,

I am new to log analytics and I have a runbook that is used by 40ish different schedules with different inputs.  I am able to get success/failure notification that I am looking for, but so far I can only seem to get the name of the runbook in the query on Log Analytics.  How can I get the input parameters or schedule name to into the query?

 

Thank you,

Michael

1 Reply

@Dep67 

 

Please also take a look at https://abcdazure.azurewebsites.net/monitoring-and-alerting-runbooks-with-log-analytics-and-azure-mo...

 

I suspect you'll also need another data sources for things like schedule etc.. as that wouldn't be a logged event (you can see the TimeGenerated - as per the above queries, which tells you when it ran but not the schedule itself).  This is remit of logs to show the data, not necessarily the configuration - put another way, you may set up an Automation runbook that only fires once a year, and if you only keep 31days of logs you wont know about it (granted you can alert on the event when it fires)).

You may need an Azure Resource Graph query (ARG) that get the info from the Azure API.  e.g.

resources
 | where type == "microsoft.automation/automationaccounts/runbooks"


The above is a sample...to give you an idea https://docs.microsoft.com/en-us/azure/governance/resource-graph/

You can bring that ARG data together with Log Analytics within a Azure Monitor workbook, using the merge feature.