Queries for the MNFSystemSessionHistoryUpdates table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Find all entries where session update user is admin

System session history update events are projected from devices. This query will list out all logs where session update user is admin.

MNFSystemSessionHistoryUpdates
| where EventCategory == "SystemSessionHistoryUpdates"
| project EventName, EventCategory, DeviceId, DeviceName, FabricId, TimeGenerated, DiffTimeStamp, GnmiTimeStamp, SessionUpdateSessionId, SessionUpdateUser, SessionDiffs
| sort by TimeGenerated desc
| limit 100