OperationName is Missing From New Subscription Log Analytics

Fraser Shepherd 20 Reputation points
2024-01-31T12:24:21.7866667+00:00

We are having issues with a new Log Analytics Server setup on a new Subscription in our Azure account whereby it doesn't seem to be recording a "OperationName" value for any log entries that are created.
We have a KQL query we use to extract these logs from the Log Analytics Workspace, which starts as :

AzureActivity
| project-keep SubscriptionId, ResourceGroup, TimeGenerated, _ResourceId, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, CategoryValue
| where CategoryValue in ('Administrative')

In the old Subscription this produces log entries like the following : User's imageHowever when running this KQL in the new Subscription this instead gives entries like : User's image I would guess that a setting has been missed somewhere to record this value, or a filter applied to exclude it, but I'm fairly sure we're using default logging settings on both Subscriptions.
Any idea why this value would not be recorded, where I can check the filtering/setup of the logging?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,685 questions
0 comments No comments
{count} votes

Accepted answer
  1. Clive Watson 5,066 Reputation points MVP
    2024-01-31T17:08:32.2466667+00:00

    Hello,

    Older deployments would have used the legacy ingestion and schema, see here (and read further up the page as well) https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#data-structure-changes

    Your new deployment uses the updated schema

    source: User's image

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful