Log Analytic workspace weird behavior

Question

Hello Team,

I hope you're doing fine,

I created recently a dcr to collect Error logs on a virtual Machine, here is the configuration :

The DCR is writing to a log analytic workspace.

When i try to query the events from the workspace, i'm having this weird result :

Event level = 2
Event levelname = Warning

Normally, Event level = 2 is error not warning, for a reason it appearing as warning, and i don't know why
Any help? thanks

Answer 1

The query that i'm using is :

Event
| where Computer == 'ComputerName'

Answer 2

Hello @Mohamed jihad bayali ,

Just tested in my lab and managed to reproduce the same:

Answer 3

Hello George,

Thank you for taking time to reproduce the issue, and thanks for the feedback,

That's a weird behavior

The eventLevel =2 is correct (2 = Error, 3=Warning) but the EventLevelName is wrong.

I created Alerts using the EventLevel, and not the EventLevelName to bypass the anomaly

Answer 4

Follow the workaround:

Event  
| extend MyEventLevel = case (tostring(EventLevel) == "3", "Warning", tostring(EventLevel) == "4", "Information","Error")  
| project Source, EventData, EventLevel, MyEventLevel