There is a built-in Azure Monitor Workbook (many Dashboards are now moved or are moving to Workbooks) called "Agent Health". All Workbooks can be adapted to suit and you can look at the Log Analytics query as well, for ideas or to adjust.
Also remember HeartBeat isn't necessarily offline / online. e.g. of a machine goes offline without updating the agent there will be no HeartBeat until it comes online again. There is a similar Workbook for VM Availability.
In a Workbook you can also perform an Azure Resource Graph (ARG) query, also based on KQL. See here for a sample workbook: https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-and-azure-arc/ba-p/999379So for any Azure resource (such as a VM); you can get an immediate status - this is a workbook that shows Security data about a VM as a sample. there is also a ARG example at the end of the post.
This would also show Hybrid and VMs and their status.
From the ARG Explorer (in the Azure Portal)
resources
| where type in( "microsoft.hybridcompute/machines" , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
//| summarize count(name) by type
Thanks]for that. I'm in the Workbooks and see this
Problem is I have no idea what to do next. Could you give some pointers please
Many thanks
Ok, try this step by step guide.
Start with the "Agent Health" one, click on it to open it,
After it loads you need to set your Subscription and Workspace from the Parameter drop downs
The main view is quite useful (assuming you have Heartbeat data).
------------------------------------------------
Now if you wanted to update that Workbook. Click on EDIT
Lets now update the Title. There are EDIT buttons located (normally) below each section, so press the one marked.
You can now add some changed Text - press "done Editing" when you have finished with the Text box. Its the [done editing] that relates to the section you want to press, not the overall one at the very top
Now lets use that Azure Resource Graph query I supplied.
Scroll to the bottom, and press "Add Query"
Swap the "data Source" to Azure Resource Graph"
Then paste, this text into the form
resources
| where type in( "microsoft.hybridcompute/machines" , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
//| summarize count(name) by type Next, you need to tell the Query where to get its Data. The Workspace name is on the drop down we used earlier, so set the "Subscriptions" option to "workspace" - essentially, whatever workspace name is selected will be used.
You should get some data back:
To make it more readable, let do two things:
1. Un-comment the last line of code, so it looks like this - remove the "//":
resources
| where type in( "microsoft.hybridcompute/machines" , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
| summarize count(name) by type Then press "Run Query"
2. Lets now turn that data into a Pie Chart - click [Visualizations] , and then [Pie Chart]
Press [Done Editing] again, and you should have something like:
Finally, press the top "Done Editing" -
then SAVE - and other details.
You should have something that looks like this.
Does that help, a phase two would be to, maybe have a Drop Down Parameter - that allows you to select a computer you can see by the graph is having issues. e.g.
There are quite a few examples within this community.
You can also see other examples, when you open a new Logs Pane in Log Analytics - just press run to see what they do:
Top tip: Use the free demo workspace for the above - as its fully (in most cases) populated https://ms.portal.azure.com/#blade/Microsoft_Azure_Monitoring_Logs/DemoLogsBlade
There are 100s of samples in the Pluralsight course material, open Query Explorer (also from the above demo workspace) source: https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch
Also note:
@CliveWatson
I'd like to point out that while this is a great leap forward (workbooks, ARG, ARC), Workbooks and ARG are severely limited for very large enterprises. For example, in our org:
- The Agent Health workbook times out--we apparently have far too many machines:
- ARG is extremely limited on what it can return in large environments (status from running your query above):
These limiting problems will only be exacerbated when we deploy ARC for servers. Here's to hoping that Microsoft doesn't forget the large enterprises! 🙂