Is it possible to find which query was running at particular time with azure log analytics

Question

Is it possible to find which query was running at particular time with azure log analytics

Ingle, Mahesh 21

Is it possible to find which query was running at particular time with azure log analytics?
I need to prepare one dashboard where I can see this information.

Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-09T18:09:57.27+00:00

Hi @Ingle, Mahesh Thank you for posting your question on Microsoft Q&A. It is not possible to find which query was running at particular time with Log analytics. You can only audit queries in azure monitor logs. Query auditing is enabled with a diagnostic setting on the log Analytics workspace. You can find more details in Audits queries in Azure monitor Logs.

Regards,
Oury
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-12T16:10:18.987+00:00

Hi @Ingle, Mahesh I wanted to check if you have any additional query that we can help you with.?

Regards,
Oury
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-13T21:36:59.867+00:00

Hi @Ingle, Mahesh I haven't heard back from you and would like to know if there is any further query regarding the above.

Regards,
Oury
.
Ingle, Mahesh 21 Reputation points

2021-07-14T15:06:10.12+00:00

Could you please help me with detailed about SQL audit queries?
Also let me know if we can combine with dashboard.
Ingle, Mahesh 21 Reputation points

2021-07-19T14:47:09.483+00:00

II have implemented same thing but unable to see any queries running out there.
Please assist.

Mahesh Ingle
(Phone number redacted)
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-19T22:58:09.92+00:00

Hi @Ingle, Mahesh Thanks for accepting answer and for the giving us good rating. In response the the comment above. (unable to see any queries)
Did you wait at least 20 minutes?

Regards,
Oury
Ingle, Mahesh 21 Reputation points

2021-07-20T16:21:45.26+00:00

Yes. I waited for a long time but still could not see any queries.
Could you please forward me AzureDiagnostics query.
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-22T16:36:16.647+00:00

Hi @Ingle, Mahesh You can use the same query I shared below.
AzureDiagnostics
Where Category == " "
where ResourceId == " "
AUDITDBTEST
project
event_time_t,
statement_s,
succeeded_s,
affected_rows_d,
server_prinicpal_name_s,
client_ip_s,

Please let me know if you run into any issues.

Regards,
Oury

Accepted answer

0 additional answers

Your answer

Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-09T18:09:57.27+00:00

Hi @Ingle, Mahesh Thank you for posting your question on Microsoft Q&A. It is not possible to find which query was running at particular time with Log analytics. You can only audit queries in azure monitor logs. Query auditing is enabled with a diagnostic setting on the log Analytics workspace. You can find more details in Audits queries in Azure monitor Logs.

Regards,
Oury
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-12T16:10:18.987+00:00

Hi @Ingle, Mahesh I wanted to check if you have any additional query that we can help you with.?

Regards,
Oury
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-13T21:36:59.867+00:00

Hi @Ingle, Mahesh I haven't heard back from you and would like to know if there is any further query regarding the above.

Regards,
Oury
.
Ingle, Mahesh 21 Reputation points

2021-07-14T15:06:10.12+00:00

Could you please help me with detailed about SQL audit queries?
Also let me know if we can combine with dashboard.
Ingle, Mahesh 21 Reputation points

2021-07-19T14:47:09.483+00:00

II have implemented same thing but unable to see any queries running out there.
Please assist.

Mahesh Ingle
(Phone number redacted)
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-19T22:58:09.92+00:00

Hi @Ingle, Mahesh Thanks for accepting answer and for the giving us good rating. In response the the comment above. (unable to see any queries)
Did you wait at least 20 minutes?

Regards,
Oury
Ingle, Mahesh 21 Reputation points

2021-07-20T16:21:45.26+00:00

Yes. I waited for a long time but still could not see any queries.
Could you please forward me AzureDiagnostics query.
Oury Ba-MSFT 20,911 Reputation points Microsoft Employee Moderator

2021-07-22T16:36:16.647+00:00

Hi @Ingle, Mahesh You can use the same query I shared below.
AzureDiagnostics
Where Category == " "
where ResourceId == " "
AUDITDBTEST
project
event_time_t,
statement_s,
succeeded_s,
affected_rows_d,
server_prinicpal_name_s,
client_ip_s,

Please let me know if you run into any issues.

Regards,
Oury

Answer 1

Hi @Ingle, Mahesh our PG was able to validate that you can see SQL statements in Log Analytics:
So they created a database and enabled auditing using Log Analytics. and ran this query:

--AUDIT Is it possible to find which query was running at particular time with azure log analytics
select getdate()

And a few minutes later (you don’t always see results immediately)
You can view the audit logs in the portal:

Please let me know if that is not what you are looking for

Regards,
Oury

Share via

Is it possible to find which query was running at particular time with azure log analytics

0 additional answers

Your answer