Log Analytics: Running log query delivers no results

%3CLINGO-SUB%20id%3D%22lingo-sub-1584922%22%20slang%3D%22en-US%22%3ELog%20Analytics%3A%20Running%20log%20query%20delivers%20no%20results%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1584922%22%20slang%3D%22en-US%22%3E%3CP%3EI%20created%20a%20Log%20Analytics%20Workspace.%20Also%20I%20connected%20a%20linux%20vm%20and%20enabled%20the%20performance%20counters.%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20when%20I%20run%20a%20log%20query%20to%20retrieve%20performance%20logs%20I%20receive%20no%20data.%20Please%20take%20a%20look%20on%20the%20screenhots%20below.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENo%20my%20question%20is%20why%20I%20receive%20no%20data%3F%20Is%20something%20else%20missing%2C%20for%20example%20further%20config%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20in%20advance.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22001_vm-is-connected.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212080i1C0953A3ACF0D013%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22001_vm-is-connected.png%22%20alt%3D%22001_vm-is-connected.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22002_performance-counters-configured.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212082iE55B91017FFF971A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22002_performance-counters-configured.png%22%20alt%3D%22002_performance-counters-configured.png%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22003_logs-query-no-result.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212081i9227972488EA86B9%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22003_logs-query-no-result.png%22%20alt%3D%22003_logs-query-no-result.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1586444%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%3A%20Running%20log%20query%20delivers%20no%20results%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1586444%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F757469%22%20target%3D%22_blank%22%3E%40cloudexplorer%3C%2FA%3E%26nbsp%3BDoes%20a%20simple%20Heartbeat%20query%20return%20any%20results%20%3F%3C%2FP%3E%3CP%3EIf%20so%2C%20then%20try%20adding%20in%20the%20computer%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHeartbeat%3C%2FP%3E%3CP%3E%7C%20where%20Computer%20%3D~%20'lm-01'%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E(It%20think%20that's%20your%20VM%20name%20from%20what%20I%20can%20see)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1586659%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%3A%20Running%20log%20query%20delivers%20no%20results%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1586659%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F452208%22%20target%3D%22_blank%22%3E%40JK_UK%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20for%20your%20answer.%20I%20tried%20that%20already%20but%20the%20same%20behavior%20occurs%20%3D%26gt%3B%20no%20result.%3C%2FP%3E%3CP%3EAlso%20I%20would%20not%20like%20to%20restrict%20the%20query%20to%20a%20certain%20machine.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20you%20can%20see%20in%20the%20below%20screenshot%20below%20it%20works%20for%20heartbeat%20without%20to%20specify%20a%20certain%20machine.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22004_heartbeat-logs-query-ok.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212212i2C99322AA9DFCBED%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22004_heartbeat-logs-query-ok.png%22%20alt%3D%22004_heartbeat-logs-query-ok.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1586688%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%3A%20Running%20log%20query%20delivers%20no%20results%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1586688%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F757469%22%20target%3D%22_blank%22%3E%40cloudexplorer%3C%2FA%3E%26nbsp%3B%20Looking%20at%20your%20screen%20pic%20again%2C%20I%20don't%20think%20you%20have%20actually%20added%20the%20counters%2C%20you%20need%20to%20click%20add%20the%20performance%20counters%2C%20it%20should%20look%20something%20like%20this%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22JK_UK_0-1597321922471.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212214i7B0DBC3F8C647778%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22JK_UK_0-1597321922471.png%22%20alt%3D%22JK_UK_0-1597321922471.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1586856%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%3A%20Running%20log%20query%20delivers%20no%20results%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1586856%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F452208%22%20target%3D%22_blank%22%3E%40JK_UK%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAgain%20many%20thanks%20for%20your%20support.%20I%20checked%20the%20advanced%20settings%20where%20performance%20params%20being%20set.%20You%20have%20write%20they%20were%20cheked%20but%20added.%20But%20I%20think%20that%20the%20issue%20was%20that%20the%20vm%20was%20down%20and%20I%20don't%20know%20why.%20Anyway%20I%20can%20get%20the%20performance%20logs.%20I%20deactivated%20the%20settings%20for%20the%20performance%20counters%20to%20see%20whether%20I%20will%20still%20get%20a%20result%20or%20not%20as%20I%20remember%20that%20performance%20logs%20will%20be%20automatically%20collected.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAgain%20many%20thanks%20and%20have%20a%20nice%20day.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

I created a Log Analytics Workspace. Also I connected a linux vm and enabled the performance counters. 

But when I run a log query to retrieve performance logs I receive no data. Please take a look on the screenhots below.

 

No my question is why I receive no data? Is something else missing, for example further config?

 

Thank you in advance.

 

001_vm-is-connected.png002_performance-counters-configured.png003_logs-query-no-result.png

4 Replies

@cloudexplorer Does a simple Heartbeat query return any results ?

If so, then try adding in the computer:

 

Heartbeat

| where Computer =~ 'lm-01'    

 

(It think that's your VM name from what I can see)

@JK_UK 

Thank you for your answer. I tried that already but the same behavior occurs => no result.

Also I would not like to restrict the query to a certain machine. 

 

As you can see in the screenshot below it works for heartbeat without to specify a certain machine.004_heartbeat-logs-query-ok.png

@cloudexplorer  Looking at your screen pic again, I don't think you have actually added the counters, you need to click add the performance counters, it should look something like this:

 

JK_UK_0-1597321922471.png

 

@JK_UK 

Again many thanks for your support. I checked the advanced settings where performance params being set. You have write they were cheked but added. But I think that the issue was that the vm was down and I don't know why. Anyway I can get the performance logs. I deactivated the settings for the performance counters to see whether I will still get a result or not as I remember that performance logs will be automatically collected. 

 

Again many thanks and have a nice day.