I'll paste that code in, sign in with my administrative credential. Yes,
I'm trying to sign in to Azure Connected Machine agent.
Great! Let's click Close.
Let's go back to our PowerShell terminal. Successfully onboarded the resource
to Azure, good. Looks like it's just finishing up here.
Okay, yeah, that's what we want to see.
Excellent! So let me exit out of my console.
Let's come back to Azure Arc and refresh the view.
So now I've got this machine connected.
What can you do here?
Well, you can service the off‑cloud machine via the VM extension model.
So, one other way that we can onboard monitoring for this Azure
Arc‑enabled server would be to go to Add, and then we could deploy the
Log Analytics agent for Azure Arc. I don't need to do that here because
I'm already hooked into the workspace.
I just want to show you these possibilities.
All right, what about the log search experience?
Well, you can do that from the workspace.
We also can go to Azure Monitor, and we'll want to look for Logs.
I'm just going to click it right here. And after we get rid of the
introductory video, we'll be asked to select a search scope.
You can be as wide and intentional or as targeted as you want.
I'm going to scope mine to the entire subscription, and now we're
given this interface to begin writing our queries.
We can see it left all of the virtual tables.
Now, the list of virtual tables you have is going to depend
entirely on what resources you've deployed in Azure.
Here's a good tip for you. Go to Queries, and you can group these
by Resource type, by Category, whatever. I'm going to come down all
the way down to Virtual machines. And these are pre‑built queries
that Microsoft has created.
Let's see, Chart CPU usage trends. That I think would be useful.
So let's just take a look at this sample query. Notice that
KQL uses a C# style line comment notation.
So in this case, we're doing perf as our table. That happens to be the
virtual table that tracks Windows Performance Monitor counters, and then
we're doing where CounterName is Processor Time,
the object is Processor, and we're doing a summarization.
Let me move up so we can see the toolbar. We can change the time
range, either in the query, or we can adjust it here.
I'm going to back it out to seven days. There's a whole
notation here or a syntax to the language. I would suggest
that you look in the Pluralsight library.
My Pluralsight colleague, Robert Cain, has created at least two courses on
KQL. He'll definitely sort you out getting comfortable with the language.
Let's run this query and see what comes back.
No results.
Okay, well that's a little bit disappointing, actually. The render here,
you can render your data as a time chart or just a table result.
Let me go back here. Let me zoom out, Queries.
Let's try a more general query. What data is being
collected? Let's load that to the editor.
This is just a very basic query.
I'm going to select just those lines and click Run.
So this is just mentioning, well, that makes sense.
It's bringing back basic Performance Monitor counter data that
I've specified in my agent configuration.
What about virtual machine disk space?
Let's load that into the editor. And to run just this query,
I'll select those lines and click Run.
Wow, that's really disappointing! Let me go back to Select scope.
Maybe I should be more intentional here. Let's go and select my AZ‑801
resource group or see if we can select specific machines.
Yeah,
well, I don't want just the machine, actually. I want to bring in that
resource group, so let's apply that, rerun the query.
Yeah, I guess not enough time has elapsed.
So what I want to do, I'm going to proceed.
I want to give you a heads up that there's a really nice query playground.
If you point your browser to portal.loganalytics.io/demo, this is a
sandbox environment that's free for your use. The thing to note about
this query playground is that you have to sign into it with either your
Azure AD credential or your Microsoft account. Once there though, you
can run KQL queries against Microsoft's sample dataset. I'm having some
DNS issues here.
The so‑called demo gods are not working with me here at all.
I'm kind of bummed.
Okay, well if at first you don't succeed, try, try again.
I was able to finally load up the Log Analytics query
playground on another computer.
So, here we go.
I'm using the Log Analytics scope demo here as my search scope,
and I've run that CPU usage patterns by virtual machine here. And
again, notice it's rendering a chart.
There's a live chart that's really potentially useful.
There's a lot being plotted on this particular one.
We can change the results to see the table view, and this allows us then to
come in here and edit the query to our heart's content.
I'm going to throw in another where clause where Computer =, say, "JBOX10".
Put that in double quotes, and then let's run that again. And now we see the
CPU usage trends for just a single machine. That's running pretty darn high,
actually. Wow! So this actually is a good example of how we can feed a log search query into an alert rule.