Queries for the MNFDeviceUpdates table

Artikel
09/17/2024

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Find all entries where value is active

Components state updates events are projected from devices. This query will list out all logs where value is active.

MNFDeviceUpdates
| where EventCategory == "ComponentStateUpdates"
| where Properties has "ACTIVE"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Find all entries where value is up

Interface status updates are projected from devices. This query will list out all logs where value is up.

MNFDeviceUpdates
| where EventCategory == "InterfaceStateUpdates"
| where Properties !has "DOWN"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Find all events of the type VxlanVlanToVniVlan

Interface vxlan updates events are projected from devices. This query will list out all the logs where events is of the type VxlanVlanToVniVlan.

MNFDeviceUpdates
| where EventCategory == "InterfaceVxlanUpdates"
| where Properties has "VxlanVlanToVniVlan"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Find all entries where afisafiname is not of the type L2VPN_EVPN

Network instance neighbor updates that happened between routers during a BGP communication are listed with types of afisafiname. This is the query to filter the logs where afisafiname is not of the type L2VPN_EVPN.

MNFDeviceUpdates
| where EventCategory == "NetworkInstanceBgpNeighborUpdates"
| where Properties !has "L2VPN_EVPN"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Find all entries where network instance name is of the type workload-mgmt

Network instance updates events from device will be reported here with different instance name. This query filters all network instances of the type workload-mgmt.

MNFDeviceUpdates
| where EventCategory == "NetworkInstanceUpdates"
| where Properties has "WORKLOAD-MGMT"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Delen via