Azure Log Analytics tile

About Azure Log Analytics tiles

The Azure Log Analytics tile allows you to query Log Analytics data from Azure Monitor(both stand-alone and in the context of objects within SCOM) and display that information as part of your SquaredUp DS dashboard.

Using this tile you can unify data held within SCOM and Azure on the same screen to bring all collected monitoring information together into a single pane of glass.

The Azure Log Analytics tile queries Log Analytics using the query language (KQL).

The ability to render information as a graph is a feature of the Azure portal rather than the Log Analytics Query language itself. Graphs will only be shown if you have selected a suitable graph tile such as the Log Analytics Line Graph or Log Analytics Donut.

Note: If you want to show VM Insights data you need to enable VM Insights first, see How to show VM Insights data with the Azure Log Analytics tile.

How to configure an Azure Log Analytics tile

You need to have an Azure Log Analytics provider before you can configure an Azure Log Analytics tile. If you haven't created a provider yet, see How to add an Azure Log Analytics provider.

  1. Add a new tile to a dashboard and click on Integrations > Azure.
  2. Choose the visualization for your Azure Log Analytics tile:

  3. Scope:
    The scope is optional, and allows you to specify a scope of SCOM objects, which can be used later in the tile configuration to insert SCOM object properties into the query using mustache syntax.
    If you use a scope ensure that it contains objects monitored by Azure Log Analytics.

  4. Provider:
    A provider defines the Log Analytics workspace that you wish to query. Select a provider from the drop-down list.
    If you haven't created a provider yet, see How to add an Azure Log Analytics provider.
  5. Query:
    Test your query in the Log Analytics workspace in the Azure portal to be sure it returns the results expected. You can find many sample queries in this area of the portal.
    Copy and paste the tested query into the Azure Log Analytics tile query box.
  6. Timeframe:

    Here you determine the timeframe for the search query.

    The default timeframe is 24 hours, which means the tile will not return any entries older than 24 hours.

    Take care when using a long timeframe, as this may pull many thousands of entries and significantly impact browser performance.

    If your query doesn't specify a timeframe

    Set the time range to the fixed time range you want to use.

    If your query specifies a timeframe

    If you specify a timeframe in the query (e.g. where timestamp >= ago(2h)), events must satisfy both the timeframe you set here and in the where clause in your query.

    If you want to control the timeframe using only the query, set the tile timeframe to time range > all.

    Note:

    This tile always ignores the dynamic page timeframe set by users.

  7. Configure the settings for your visualization:
  8. Click done to save the tile.

    The tile now shows data according to your settings.

Walkthrough

How to show VM Insights data with the Azure Log Analytics tile

VM Insights allows you to collect additional metrics called guest level metrics from your virtual machines (VMs).

You need to enable VM Insights in your Azure portal for each VM you want to monitor before you can show VM Insights data with the Azure Log Analytics tile.

You can find all information about enabling VM Insights in the Azure documentation.

Where to find KQL queries for showing VM Insights data

You can find useful queries by viewing VM Insights in your Azure portal. You'll see the underlying queries of Performance graphs when you edit them in Azure and can copy them from there. The Dependency Map shown in the Azure portal cannot currently be shown in SquaredUp DS.

Troubleshooting

Attempts to authorize the provider fail

Ensure that you have added the Reply URL to the Azure AD application, and that you have given Azure enough time to replicate the configuration (often takes several minutes).

"The API returned a 400 response" with message "Failed to resolve entity 'xxxxx'

Typically this indicates that a solution is missing from the queried workspace, resulting in it not containing the requested table (such as Update or UpdateSummary missing from workspaces without the Software Management solution enabled).

Was this article helpful?


Have more questions or facing an issue?