Log Analytics Query for computer last login/active date and time
Hi, I am looking for a query where I can get last login/active date and time for computers in a separate column. I am already using the below query for windows update WaaSDeploymentStatus | where UpdateCategory == "Quality" and TimeGenerated > ago(60d) | summarize arg_max(ReleaseName, DeploymentStatus, DetailedStatus, DetailedStatusLevel, ExpectedInstallDate) by Computer Please suggest what should we add to this query to get a new column which will give me last login/active date and time for computers
Query could not be parsed at 'SecurityEvent' on line.....
We upgraded to the standard tier, but this still isn't working. I can query events, but if I use any queries that involve SecurityEvent it doesn't work. Basically I'm trying to follow this: https://pixelrobots.co.uk/2019/07/query-active-directory-security-events-using-azure-log-analytics-on-the-cheap/
Troubleshooting Microsoft Monitoring Agent issues
I am working with an OMS setup where Custom Log ingestion has been setup. This is working fine for the most part, but occasionally the Custom Log data stops transmitting to OMS. During these times it has been verified that data is still being written to the log on the VM (the client has viewed and verified this) and the MMA heartbeat still occurs (verified via a Log Analytics query), just none of the Custom Log data is being transmitted. When the agent is restarted, data transmission starts working again. Where should we begin troubleshooting this? I assumed that MMA logs INFO, ERROR and WARNING details in the Event Viewer, but I was not able to locate the details in Event Viewer. I also looked into the installation folder to see if a log file was generated there, but to no avail. Any help pointing to where we could look to troubleshoot this would be appreciated! Thank you!
CPU utilization for VMs in past 3 months in different time zone (PST) for Specific working hours
Hi Team, I need a help in getting the average CPU utilization for VMs in last 3 months in different time zone (PST) only for specific time range. i have written the query to fetch the average CPU utilization for last 3 months and i set the time range in portal option. Heartbeat | where SubscriptionId != '' | summarize by TenantId, SubscriptionId, Computer, ResourceGroup=tolower(ResourceGroup), ResourceId=tolower(ResourceId) | where ResourceGroup == "azrg-oc-ame-tds-vm" | join kind=inner ( Perf | where (ObjectName == "Processor" and CounterName == "% Processor Time") | summarize CPUAvg = (avg(CounterValue)) by Computer ) on Computer | project Computer, CPUAvg how can i filter the CPU utilization only for 12 hours\day in PST time zone for last three months. Thanks in advance.
