Queries for the ASCDeviceEvents table

Article
07/30/2024

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Azure Sphere device authentication and attestation failures

A list of Azure Sphere device authentication and attestation failures for the last week, sorted by time.

ASCDeviceEvents
| where OperationName == "DeviceCertificateEvent" and
        Properties.EventType == "DeviceAttestationFailure" or Properties.EventType == "DeviceCertificateEvent" and
        ResultType == "Failure" // Filter by time by adding " | where TimeGenerated > ago(7d) " for last 7 days of data or using time picker in the UI
| project TimeGenerated, DeviceId, Properties, ResultDescription, Location
| sort by TimeGenerated desc
| limit 100

Azure Sphere device events timeline

A sorted timeline of all events generated by an Azure Sphere device during the last week, to monitor and troubleshoot any unexpected failures.

ASCDeviceEvents
| where OperationName == "DeviceCertificateEvent" or Properties.DeviceTelemetryEventCategory == "AppCrash" // Remove/Add filters to see all/specific events. Filter data by Device by adding " | where DeviceId == "Your Device ID" " 
| project TimeGenerated, OperationName, ResultType, ResultDescription, Properties, Location
| sort by TimeGenerated desc
| limit 100

Azure Sphere device heartbeat events timechart

A timechart of all certificate generation events initiated by Azure Sphere devices over the last week, to continuously monitor device health and see trends.

let Interval = timespan(1d); // Interval for the Chart 
ASCDeviceEvents
| where OperationName == "DeviceCertificateEvent" and 
        Properties.EventType == "DeviceCertificatesGenerate" and 
        ResultType == "Success"
| summarize Device_Heartbeat_Events=count() by bin(TimeGenerated, Interval)
| render timechart

Azure Sphere devices not updated to latest OS

A list of Azure Sphere devices that have not been updated to the latest OS version over the last week.

ASCDeviceEvents
| where OperationName == "DeviceUpdateEvent" and  
        todouble(Properties.InstalledOSVersion) != todouble(Properties.TargetedOSVersion) // Filter by time by adding " | where TimeGenerated > ago(7d) " for last 7 days of data or using time picker in the UI
| summarize by DeviceId
| limit 100

Azure Sphere device telemetry events summary

A piechart summarizing the share of each of the event categories generated by Azure Sphere Devices over the last week, to monitor the overall device health.

ASCDeviceEvents
| where OperationName == "DeviceTelemetryEvent" // Filter by time by adding " | where TimeGenerated > ago(7d) " for last 7 days of data or using time picker in the UI
| summarize count() by tostring(Properties.DeviceTelemetryEventCategory)
| render piechart

Share via