Log analytics 'No Results Found'

Occasional Contributor

Hi I apologize if this is a repeat of what I just posted.  I think I originally mistakenly  posted to myself

 

@MarkSteben

Hello,  I am still trying to get log information from some of the sample queries in log analytics.  Here is what I have done so far:

 Server: server1.database.windows.net (NOT a vm)

 database within server:  db1

1. Within server1.db1:  built a diagnostic settings instance

   a. had my IT department define a storage account workspace and connected that workspace to diagnostic settings.  

   b had my IT department define a log analytics workspace and connected that workspace to diagnostic settings

  c. Within diagnostic settings I clicked on the following to be logged:

  (under 'log')

     - SQLInsights

     - AutomaticTuning

     - QueryStoreRuntimeStatistics

     - QueryStoreWaitStatistics

     - Errors (the purpose of this effort)

     - DatabaseWaitStatistics

     - Timeouts

     - Blocks

     - Deadlocks

     (under 'metric')

     - basic

     - InstanceAndAppAdvanced

     - Workload Management

2.  Then in the loganalytics workspace I downloaded and installed Windows Agent (64 bit).  This automatically connected my machine to the workspace

3. Also within the loganalytics workspace I ensured that Under Azure Storage my storagte account was connected.

(I have NOT yet connected any Data sources (options include Windows Event Logs, Windows Performance Counters, IIS Logs among other options)

So when I go back to server1.db1.logs and click on any of the sample queries I get the message

 NO RESULTS FOUND (0 records matched)

Also, my IT department gave me: monitoring contributor permission.  

 

Any insights/comments welcomed.  Thank you!

1 Reply

@MarkSteben OK there could be many things gone wrong, and it's a bit hard to debug it blindly, so best path is to open a support ticket. However, a few pointers:

a. Looks like you've setup both Diagnostic settings for your SQL database and an agent on your VM. These are 2 separate things.

b. The first batch of logs takes time, since the table strcuture is being generated for your workspace. That doesn't mean it should take a day, but it could be more than a few minutes (maybe 20-30 minute).

c. Regarding your VM, if you want to see logs you should pick which logs (these are the sources you haven't selected yet).

d. Re SQL, sounds like you did it right (no need to also send it to a storage account, it's completely optional). You settings should look something like this:

 

e. You should be able to open the Logs page from either the resource itself (the sql database) or the workspace you're connecting it to.

f. Type a simple query like 

AzureActivity | take 10

g. If still not working, do contact support...