Using Log Search in Microsoft OMS

  • Article

At the core of Microsoft Operations Manager Suite (OMS) is the log search feature which allows you to combine and correlate machine data from multiple sources within your environment. Solutions are also powered by log search to bring you metrics pivoted around a particular problem area.

On the Search page, you can create a query, and then when you search, you can filter the results by using facet controls. You can also create advanced queries to transform, filter, and report on your results.

Common log search queries appear on most solution pages. Throughout the OMS console, you can click tiles or drill in to other items to view details about the item by using log search.

Getting Started

After logging into your portal, in the top left corner of the home screen you will see the Log Search tile. This is at the core of using OMS.

clip_image002

When you click the Log Search tile you are brought to the following screen:

clip_image003

Here you can use the dropdown to choose the time range you want to search. In the example below we’ll choose 7 days:

clip_image005

When typing in your search string, notice that Autocomplete is available. There are currently three categories of Autocomplete that get suggested to users:

1. Available Fields: This is a partial list of what fields are available to search.

clip_image006

For a reference of fields that are available, see the Search field and facet reference section in the following document in the Microsoft TechNet Library:

OMS search reference

2. Recent Searches: These are items that you searched for recently. This helps you save time when running similar searches.

3. Saved Searches: These are searches that have been saved as useful. By clicking the Save icon after a search is run, you can add that search to this list. The search page features these saved searches, plus some additional searches that get added with each solution pack.

clip_image007

Filtering is available on the left hand side of the search screen. These filters can save a lot of time and effort as when these are selected they add the appropriate syntax to your search string automatically. For example, doing a search on Type=Perf gives the options to narrow it down by Computer, ObjectName, CounterName, InstanceName and CounterPath.

You can also add fields by clicking the +Add button at the lower left hand corner of the search screen to get additional filters that may be of interest, as shown below.

clip_image009

Filtering on time is available by using the time window box in the top left if you want to drill into the data.

clip_image010

Clicking on the bar will drill into that 6-hour time frame so that you can get a better idea of what occurred during that time frame. You can continue to drill down to see a specific time range:

clip_image011

Going further

clip_image012

The corresponding results will be displayed in the search results on the right pane so that you can see what computer, performance counter or other detail that is applicable to that time frame.

Also, once you complete a search, you can export your results to Excel by clicking the Export button at the bottom of the screen. This will create a .csv file of your results.

Additional automated log searches can be done with the Log Search API. See the following for more information:

Automate log searches with the Log Search API

Examples

NOTE The examples below only work if you have enabled the log collection for the data types being discussed, if you get 0 results from these searched verify that you have enabled that data type and your machines are communicating with your OMS workspace successfully.

To search on IIS logs, type the following command into the search: Type=W3CIISLog. To break this down further you can use the Measure command with different functions.

To search near-real time performance data, type the follow command into search: Type = Perf. This will return all performance counters that are being collected for your environment by OMS.

Note that there are two different types of value returned for this search: Logs and Metrics.

Logs are 30 minute aggregated values of the performance counter. These are stored based on your data plan with OMS. See https://www.microsoft.com/en-us/server-cloud/operations-management-suite/pricing.aspx for details on data plans.

Metrics are the raw results for each of the performance counters configured and are stored for 14 days.

To further filter your performance data, you can also add more parameters to your search to find exactly what machine is affected or other things that may interest you. For example, if you want to return all performance data for a specific computer you can use the following:

Type = Perf Computer=”ComputerName”

If you want to return performance data for the Current Disk Queue Length counter across all servers you can run the following:

Type = Perf CounterName=”Current Disk Queue Length”

You can even combine the examples to give you the Current Disk Queue Length counter for one specific machine:

Type = Perf CounterName=”Current Disk Queue Length” Computer=”ComputerName”

You can even drill further into the performance data by decreasing the time range. For example, if you make your time range small enough (e.g. 6 hours or less), the charts will show you live data.

Additional Information

Adrian Doyle | Senior Supportability PM | Microsoft fbTwitterPic

Our Blogs