How to troubleshoot MMAExtenstion(for custom logs) + Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-991649%22%20slang%3D%22en-US%22%3EHow%20to%20troubleshoot%20MMAExtenstion(for%20custom%20logs)%20%2B%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-991649%22%20slang%3D%22en-US%22%3E%3CP%3EHi!%3C%2FP%3E%3CP%3EDeployed%20VMSS%20with%20MMAExtension%20and%20DependencyAgentWindows%20extensions.%3C%2FP%3E%3CP%3EIn%20Log%20Analytics%20Created%20Custom%20Log%20params%20with%20log%20directory%20path%20mask%20like%20this%3A%3C%2FP%3E%3CP%3E%22C%3A%5CProgram%20Files%5CProduct.Folder%5Cmyapp*.log%22%3C%2FP%3E%3CP%3ERun%20the%20query%3A%3C%2FP%3E%3CP%3ECustomLogName%20%7C%20limit%2010%3C%2FP%3E%3CP%3Eand%20result%20is%20%3CSPAN%3ENO%20RESULTS%20FOUND%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EExtensions%20logs%20has%20no%20errors.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EHow%20to%20troubleshoot%20this%20behavior%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EPS%20I%20have%208%20windows%20VMSS%20-%20with%20same%20application%20and%20custom%20log%20settings%20-%20some%20are%20working%20-%20and%20query%20returns%20expected%20results.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-991649%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECustom%20Logs%20and%20Custom%20Fields%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-995420%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20troubleshoot%20MMAExtenstion(for%20custom%20logs)%20%2B%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-995420%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F449874%22%20target%3D%22_blank%22%3E%40krot4u%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDo%20you%20have%20HeartBeat%20data%20from%20the%20machine%20you%20put%20the%20agent%20on%2C%20and%20is%20that%20the%20same%20machine%20the%20custom%20log%20is%20on%3F%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fblob%2Fmaster%2Farticles%2Fazure-monitor%2Fplatform%2Fdata-ingestion-time.md%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fblob%2Fmaster%2Farticles%2Fazure-monitor%2Fplatform%2Fdata-ingestion-time.md%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-996006%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20troubleshoot%20MMAExtenstion(for%20custom%20logs)%20%2B%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-996006%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BActually%20-%20the%20problem%20is%20not%20exists%20now.%20The%20logs%20are%20streamed...%20It%20is%20self%20solved...kindly...%20Thanx%20for%20answering%20Clive.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi!

Deployed VMSS with MMAExtension and DependencyAgentWindows extensions.

In Log Analytics Created Custom Log params with log directory path mask like this:

"C:\Program Files\Product.Folder\myapp*.log"

Run the query:

CustomLogName | limit 10

and result is NO RESULTS FOUND

Extensions logs has no errors.

How to troubleshoot this behavior?

 

PS I have 8 windows VMSS - with same application and custom log settings - some are working - and query returns expected results.

2 Replies

@krot4u 

 

Do you have HeartBeat data from the machine you put the agent on, and is that the same machine the custom log is on?  https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/azure-monitor/platform/data-ingesti...

 

 

@CliveWatson Actually - the problem is not exists now. The logs are streamed... It is self solved...kindly... Thanx for answering Clive.