SOLVED

Work Space Register - Query Shutdown-Start-VMs-By-Resource-Group Errors

Copper Contributor

I need query to show error´s in the

Shutdown-Start-VMs-By-Resource-Group

 

For create an alert in the Work Space, because de runbook is complete but generate error´s and the VM not power on.

 

6 Replies
best response confirmed by alejandro_contreras (Copper Contributor)
Solution

@alejandro_contreras 

 

you can check your runbook status with

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
| summarize count() by ResultType 

You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started")
| project TimeGenerated , RunbookName_s , ResultType , Resource

So for use in an Azure Monitor Alert it would be something like this:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 

You can force a value to be 0 or 1 by changing the last line to 

 

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 
| where count_ > 1             // put in your own threshold here
| extend AggregatedValue = 1   // set this to One/1 if the threshold is breached

 

@CliveWatson  thank´s for your answer . I verify and send the comments later. 

@Clive Watson   The query´s they work perfect , but in the Registre of Work Space  only show me last day.  I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.

@CliveWatson  The query´s they work perfect , but in the Registre of Work Space only show me last day. I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.

@alejandro_contreras 

 

You need to add an extra line, assuming you have 30days of data, if you have more increase the value :)

 

AzureDiagnostics
| where TimeGenerated > ago(30d)  // from time you run the query untilthe same time 30days ago

//or

AzureDiagnostics
| where TimeGenerated > startofday(ago(30d))  // from midnight on that day - full day

@CliveWatson   Thanks ....  Perfect ! I created the alert. ErrorLog1.JPGErrorLog2.JPGErrorLog3.JPG

1 best response

Accepted Solutions
best response confirmed by alejandro_contreras (Copper Contributor)
Solution

@alejandro_contreras 

 

you can check your runbook status with

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
| summarize count() by ResultType 

You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started")
| project TimeGenerated , RunbookName_s , ResultType , Resource

So for use in an Azure Monitor Alert it would be something like this:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 

You can force a value to be 0 or 1 by changing the last line to 

 

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" 
    and (ResultType == "Failed")
    // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group"
| summarize count() by ResultType 
| where count_ > 1             // put in your own threshold here
| extend AggregatedValue = 1   // set this to One/1 if the threshold is breached

 

View solution in original post