Log analytics workspace

Revanth Thavidishetty 1

Is there a way to see all resources sending logs to a log analytics workspace?

2 answers

bharathn-msft 5,086 Reputation points Microsoft Employee

2020-06-15T21:36:09.707+00:00
Hi @Revanth Thavidishetty ,

Thank you for reaching out.

If you are looking for which all Azure Resources are sending Azure Diagnostic logs to your Log Analytics Workspace, you can run the below query with in workspace logs.

AzureDiagnostics | distinct ResourceType, Resource

** You can limit it to ResourceType as well if you don't need the actual Resource

Hope above information helps, if you are looking for any other scenarios please revert back.
Please sign in to rate this answer.
Revanth Thavidishetty 1 Reputation point

2020-06-15T23:30:22.967+00:00

Thanks for looking into it @bharathn-msft . I am getting the below result when i tried the above query.

Tried changing the time range to last 7 days still same.

bharathn-msft 5,086 Reputation points Microsoft Employee

2020-06-16T00:09:49.757+00:00

Thank you @RevnathThavidishetty-7222 for reverting back. If you don't have any recent diagnostic data ingesting into Log Analytics Workspace you might not see any records. Can you please go back in history probably use the custom filters to go back probably a month or two and see if you see the same results. If you still see 0 records, you need to make sure at least one of the Azure resource diagnostic setting is enabled to send logs to Log Analytics workspace and once configured you can rerun the query and see the resources.

Revanth Thavidishetty 1 Reputation point

2020-06-16T00:50:21.697+00:00

@bharathn-msft Tried changing the date back to a month. still i got the same output. and Azure resource diagnostic setting is enabled in most of the resources and i checked by querying the resources like checking hearbeat etc. those queries are working. Actually i won't to know how many of my resources are using this workspace.

bharathn-msft 5,086 Reputation points Microsoft Employee

2020-06-19T01:24:37.837+00:00

@Revanth Thavidishetty Thank you for circling back on this. Heartbeat is something coming from machines which have the agents installed and they are sending heartbeat message to Log Analytics work space. For Diagnostic logs being enabled , can you please share which resource you have it enabled and is any traffic generating for that resource to log diagnostic data.

bharathn-msft 5,086 Reputation points Microsoft Employee

2020-06-23T17:11:35.703+00:00

@Revanth Thavidishetty Hope you had a chance to review the above information. Please revert back if you have any further queries. Thank you
Sign in to comment
Oleg Ananiev (MSFT) 81 Reputation points Microsoft Employee

2020-07-11T06:46:43.013+00:00

While many resources send to AzureDiagnostics, newer integrations use resource specific tables
You can start by doing
union *
| distinct _ResourceId
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

Log analytics workspace

2 answers