Azure Monitor DCR Associated Resource List

Question

Azure Monitor DCR Associated Resource List

Ravi Gupta 21

Hi,

I have Azure Monitor DCR created and associated some VMs to it. Now I would like to create a Dashboard with below details. Appreciate if some could help and provide me some pointers.

VM Names associated with specific DCR.
VM names, which are not heart beating in last 24 hours.
VM names which are not sending any performance data in last 24 hours.

I could write KQL for last 2 items, if i could get List of VMs associated with specific DCR but that detail is not available neither in Log Analytic Workspace nor in Resource Graph Explorer Namespaces.

I also tried PowerShell Cmdlet (below) but not sure how to use that, while writing KQL queries to filter the data.
Ref: https://github.com/Azure/azure-powershell/blob/main/src/Monitor/Monitor/help/Get-AzDataCollectionRuleAssociation.md

Appreciate, if someone could help me for the same !!

Regards, Ravi

Bruno Gabrielli 0 Reputation points Microsoft Employee

2024-04-09T14:37:16.1733333+00:00

Hello Ravi as part of the built-in AMA Health workbook, you can find a tab specific for Data Collections Rules. In this tab you view all the DCR in the selected subscriptions, all the VMs associated (for both Azure and Arc Enabled once a DCR is selected) and the list of associated DCR for a specific VM (both Azure and Arc Enabled).

Hope that helps.

Thanks,

Bruno.

Answer accepted by question author

1 additional answer

Your answer

Bruno Gabrielli 0 Reputation points Microsoft Employee

2024-04-09T14:37:16.1733333+00:00

Hello Ravi as part of the built-in AMA Health workbook, you can find a tab specific for Data Collections Rules. In this tab you view all the DCR in the selected subscriptions, all the VMs associated (for both Azure and Arc Enabled once a DCR is selected) and the list of associated DCR for a specific VM (both Azure and Arc Enabled).

Hope that helps.

Thanks,

Bruno.

Answer 1

Predrag Oparnica 80 Microsoft Employee

insightsresources
| where type == "microsoft.insights/datacollectionruleassociations"
| parse properties with * '/' PROP'"'*
| extend PROPdetails = split(PROP, "/")
| extend DCRstring = tostring(PROPdetails[7])
| extend fullline = strcat(DCRstring,"",id)
| extend fulllinedetails = split(fullline,"/")
| extend DCRname = tostring(fulllinedetails[0])
| extend Computer = tostring(fulllinedetails[8])
| project DCRname, Computer
| distinct DCRname, Computer

Answer 2

SwathiDhanwada-MSFT 19,073 Moderator

@Ravi Gupta Welcome to Microsoft Q & A Community Forum. To retrieve the list of virtual machines that are linked to data collection rule, you could use the PowerShell command Get-AzDataCollectionRuleAssociation ( which you are already aware ). However , if you want to retrieve this information using KQL query , its not possible .

One workaround is that Azure Dashboard also visualizes data that is retrieved using Azure REST API. Use Azure Monitor REST API to retrieve the list of vm's associated with specific DCR and visualize it accordingly.

Ravi Gupta 21 Reputation points

2022-01-17T09:00:10.97+00:00

Hi Swathi,

Thanks for the information !!!

Appreciate, if you could share any link which would have some sample (may be json code) which would help me understand how to utilize REST API in Azure Dashboard.

Regards, Ravi
SwathiDhanwada-MSFT 19,073 Reputation points Moderator

2022-01-17T12:49:17.163+00:00

@Ravi Gupta Kindly check this youtube video on how to utilize REST API.
Scott 0 Reputation points

2023-11-30T14:46:54.3733333+00:00

So there is no way to query this in Resource Graph?

Clive Watson 7,871 MVP Volunteer Moderator

I was about to say no not in ARG then discovered you can (I cant recall if I've used this before, it could be new-ish?), so a sample ARG query would be :

insightsresources
| where type == "microsoft.insights/datacollectionruleassociations"
| parse id with *'machines/' sComputerName '/providers'*
| parse properties with * 'dataCollectionRules/' sDCRname '"'*
| where isnotempty(sDCRname)
| project sComputerName, sDCRname, id, properties

or

insightsresources
| where type == "microsoft.insights/datacollectionruleassociations"
| parse id with *'machines/' sComputerName '/providers'*
| parse properties with * 'dataCollectionRules/' sDCRname '"'*
| where isnotempty(sDCRname) and isnotempty( sComputerName)
| summarize countComputer=dcount(sComputerName), listComputers=make_set(sComputerName) by sDCRname
| order by countComputer desc

This second example gives a nicer (I think) result:
User's image

You also have

resources
| where type =~ 'microsoft.insights/datacollectionrules'

Clive Watson 7,871 MVP Volunteer Moderator

insightsresources
| where type == "microsoft.insights/datacollectionruleassociations"
| parse id with *'machines/' sComputerName '/providers'*
| parse properties with * 'dataCollectionRules/' sDCRname '"'*
| where isnotempty(sDCRname) and isnotempty( sComputerName)
| summarize countComputer=dcount(sComputerName), listComputers=make_set(sComputerName) by sDCRname
| order by countComputer desc

Ravi Gupta 21 Reputation points

2023-12-01T10:19:54.1666667+00:00

Great ...Thanks!!

jacobg 25

Minor adjustment to your query since azure sometimes messes up the formatting of the namespace. Parsing "id" as tolower ensures that we get a match.

insightsresources
| where type == "microsoft.insights/datacollectionruleassociations"
| parse tolower(id) with *'machines/' sComputerName '/providers'*
| parse properties with * 'dataCollectionRules/' sDCRname '"'*
| where isnotempty(sDCRname)
| summarize countComputer=dcount(sComputerName), listComputers=make_set(sComputerName) by sDCRname
| order by countComputer desc

Share via

Azure Monitor DCR Associated Resource List

1 additional answer

Your answer