Skip to content

Commit 2c39202

Browse files
v-regandownerv-regandowner
authored
Merge pull request #218428 from SnehaSudhirG/15Nov-AUMDocupdate
Updated the query logs article as per the UI
2 parents a5a45c9 + ca9c6b0 commit 2c39202

File tree

1 file changed

+76
-95
lines changed

1 file changed

+76
-95
lines changed

‎articles/automation/update-management/query-logs.md

Lines changed: 76 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Query Azure Automation Update Management logs
33
description: This article tells how to query the logs for Update Management in your Log Analytics workspace.
44
services: automation
55
ms.subservice: update-management
6-
ms.date: 09/24/2020
6+
ms.date: 12/13/2022
77
ms.topic: conceptual
88
---
99

@@ -17,149 +17,130 @@ You can also customize the log queries or use them from different clients. See [
1717

1818
Update Management collects records for Windows and Linux VMs and the data types that appear in log search results. The following sections describe those records.
1919

20-
### Query required updates
21-
22-
A record with a type of `RequiredUpdate` is created that represents updates required by a machine. These records have the properties in the following table:
23-
24-
| Property | Description |
25-
|----------|-------------|
26-
| Computer | Fully-qualified domain name of reporting machine. |
27-
| KBID | Knowledge base article ID for the Windows update. |
28-
| ManagementGroupName | Name of the Operations Manager management group or Log Analytics workspace. |
29-
| Product | The products for which the update is applicable for. |
30-
| PublishDate | The date the update is ready to be downloaded and installed from Windows Update. |
31-
| Server | |
32-
| SourceHealthServiceId | Unique identifier representing the Log Analytics Windows agent ID. |
33-
| SourceSystem | *OperationsManager* |
34-
| TenantId | Unique identifier representing your organizations instance of Azure Active Directory. |
35-
| TimeGenerated | Date and time that the record was created. |
36-
| Type | *Update* |
37-
| UpdateClassification | Indicates the type of updates that can be applied. For Windows:<br> *Critical updates*<br> *Security updates*<br> *Update rollups*<br> *Feature packs*<br> *Service packs*<br> *Definition updates*<br> *Tools*<br> *Updates*. For Linux:<br> *Critical and security updates*<br> *Other* |
38-
| UpdateSeverity | Severity rating for the vulnerability. Values are:<br> *Critical*<br> *Important*<br> *Moderate*<br> *Low* |
39-
| UpdateTitle | The title of the update.|
4020

4121
### Query Update record
4222

4323
A record with a type of `Update` is created that represents updates available and their installation status for a machine. These records have the properties in the following table:
4424

4525
| Property | Description |
4626
|----------|-------------|
47-
| ApprovalSource | Applies to Windows operating system only. Source of approval for the record. The value is Microsoft Update. |
48-
| Approved | True if the record is approved, or False otherwise. |
49-
| Classification | Approval classification. The value is Updates. |
50-
| Computer | Fully-qualified domain name of reporting machine. |
51-
| ComputerEnvironment | Environment. Possible values are Azure or Non-Azure. |
52-
| MSRCBulletinID | Security bulletin ID number. |
53-
| MSRCSeverity | Severity rating for the vulnerability. Values are:<br> Critical<br> Important<br> Moderate<br> Low |
54-
| KBID | Knowledge base article ID for the Windows update. |
55-
| ManagementGroupName | Name of the Operations Manager management group or the Log Analytics workspace. |
56-
| UpdateID | Unique identifier of the software update. |
57-
| RevisionNumber | The revision number of a specific revision of an update. |
58-
| Optional | True if the record is optional, or False otherwise. |
59-
| RebootBehavior | The reboot behavior after installing/uninstalling an update. |
60-
| _ResourceId | Unique identifier for the resource associated with the record. |
61-
| Type | Record type. The value is Update. |
62-
| VMUUID | Unique identifier for the virtual machine. |
63-
| MG | Unique identifier for the management group or Log Analytics workspace. |
64-
| TenantId | Unique identifier representing your organization's instance of Azure Active Directory. |
27+
| TenantId| Unique identifier representing your organization's instance of Azure Active Directory. |
6528
| SourceSystem | The source system for the record. The value is `OperationsManager`. |
6629
| TimeGenerated | Date and time of record creation. |
6730
| SourceComputerId | Unique identifier representing the source computer. |
6831
| Title | The title of the update. |
32+
| Classification | Approval classification. The value is Updates. |
6933
| PublishedDate (UTC) | The date when the update is ready to be downloaded and installed from Windows Update. |
34+
| Computer | Fully-qualified domain name of reporting machine. |
7035
| UpdateState | The current state of the update. |
7136
| Product | The products for which the update is applicable. |
37+
| OSType |Type of operating system. Values are Windows or Linux. |
38+
| ProductVersion| Version of the update. |
39+
| Product Arch| Applicable machine architecture |
40+
| CVENumbers| Common Vulnerabilities and Exposures number |
41+
| BulletinUrl | URL of the Bulletin|
42+
| BulletinID | Bulletin ID number. |
43+
| PackageRepository | Repository info of the package.|
44+
| PackageSeverity | Severity of the update. |
45+
| OSName | Type of operating system. Values are Windows or Linux.|
46+
| OSVersion | The version of the operating system. |
47+
| OSFullName | Name of operating system. |
7248
| SubscriptionId | Unique identifier for the Azure subscription. |
7349
| ResourceGroup | Name of the resource group to which the resource belongs. |
7450
| ResourceProvider | The resource provider. |
7551
| Resource | Name of the resource. |
52+
| ResourceId | Unique identifier for the resource associated with the record. |
7653
| ResourceType | The resource type. |
77-
78-
### Query Update Agent record
79-
80-
A record with a type of `UpdateAgent` is created that provides details of the update agent on the machine. These records have the properties in the following table:
81-
82-
| Property | Description |
83-
|----------|-------------|
84-
| AgeofOldestMissingRequiredUpdate | |
85-
| AutomaticUpdateEnabled | |
86-
| Computer | Fully-qualified domain name of reporting machine. |
87-
| DaySinceLastUpdateBucket | |
88-
| ManagementGroupName | Name of the Operations Manager management group or Log Analytics workspace. |
89-
| OSVersion | The version of the operating system. |
90-
| Server | |
91-
| SourceHealthServiceId | Unique identifier representing the Log Analytics Windows agent ID. |
92-
| SourceSystem | The source system for the record. The value is `OperationsManager`. |
93-
| TenantId | Unique identifier representing your organization's instance of Azure Active Directory. |
94-
| TimeGenerated | Date and time of record creation. |
54+
| ComputerEnvironment | Environment. Possible values are Azure or Non-Azure. |
55+
| VMUUID | Unique identifier for the virtual machine. |
56+
| MG | Unique identifier for the management group or Log Analytics workspace. |
57+
| ManagementGroupName | Name of the Operations Manager management group or the Log Analytics workspace. |
58+
| MSRCSeverity | Severity rating for the vulnerability. Values are:<br> Critical<br> Important<br> Moderate<br> Low |
59+
| KBID | Knowledge base article ID for the Windows update. |
60+
| UpdateID | Unique identifier of the software update. |
61+
| RevisionNumber | The revision number of a specific revision of an update. |
62+
| Optional | True if the record is optional, or False otherwise. |
63+
| RebootBehavior | The reboot behavior after installing/uninstalling an update. |
64+
| MSRCBulletinID | Security bulletin ID number. |
65+
| Approved | True if the record is approved, or False otherwise. |
66+
| ApprovalSource | Applies to Windows operating system only. Source of approval for the record. The value is Microsoft Update. |
67+
| InstallTimePredictionSeconds | |
68+
| InstallTimeDeviationRangeSeconds| |
69+
| InstallTimeAvailable| |
9570
| Type | Record type. The value is Update. |
96-
| WindowsUpdateAgentVersion | Version of the Windows Update agent. |
97-
| WSUSServer | Errors if the Windows Update agent has a problem, to assist with troubleshooting. |
71+
9872

9973
### Query Update Deployment Status record
10074

10175
A record with a type of `UpdateRunProgress` is created that provides update deployment status of a scheduled deployment by machine. These records have the properties in the following table:
10276

10377
| Property | Description |
10478
|----------|-------------|
105-
| Computer | Fully-qualified domain name of reporting machine. |
106-
| ComputerEnvironment | Environment. Values are Azure or Non-Azure. |
107-
| CorrelationId | Unique identifier of the runbook job run for the update. |
108-
| EndTime | The time when the synchronization process ended. *This property is currently not used. See TimeGenerated.* |
79+
| TenantId | Unique identifier representing your organization's instance of Azure Active Directory.|
80+
| SourceSystem | Source system for the record. The value is `OperationsManager`. |
81+
| TimeGenerated | Date and time of record creation. |
82+
| MG | Unique identifier for the management group or Log Analytics workspace. |
83+
| ManagementGroupName | Name of the Operations Manager management group or Log Analytics workspace. |
84+
| SourceComputerId | Unique identifier representing the source computer. |
85+
| KBID | Knowledge base article ID for the Windows update. |
86+
| UpdateId | Unique identifier of the software update. |
87+
| SucceededOnRetry | Value indicating if the update execution failed on the first attempt and the current operation is a retry attempt. |
10988
| ErrorResult | Windows Update error code generated if an update fails to install. |
89+
| UpdateRunName| Name of the update schedule.|
11090
| InstallationStatus | The possible installation states of an update on the client computer,<br> `NotStarted` - job not triggered yet.<br> `Failed` - job started but failed with an exception.<br> `InProgress` - job in progress.<br> `MaintenanceWindowExceeded` - if execution was remaining but maintenance window interval reached.<br> `Succeeded` - job succeeded.<br> `InstallFailed` - update failed to install successfully.<br> `NotIncluded` - the corresponding update's classification doesn't match with customer's entries in input classification list.<br> `Excluded` - user enters a KBID in excluded list. While patching, if KBID in excluded list matches with the system detected update KB ID, it is marked as excluded. |
111-
| KBID | Knowledge base article ID for the Windows update. |
112-
| ManagementGroupName | Name of the Operations Manager management group or Log Analytics workspace. |
113-
| OSType | Type of operating system. Values are Windows or Linux. |
91+
| Computer | Fully-qualified domain name of reporting machine. |
92+
| Title | The title of the update. |
11493
| Product | The products for which the update is applicable. |
94+
| OSType | Type of operating system. Values are Windows or Linux. |
95+
| StartTime (UTC) | Time when the update is scheduled to be installed. *This property is currently not used. See TimeGenerated.* |
96+
| EndTime (UTC) | The time when the synchronization process ended. *This property is currently not used. See TimeGenerated.* |
97+
| CorrelationId | Unique identifier of the runbook job run for the update. |
98+
| SubscriptionId | Unique identifier for the Azure subscription. |
99+
| ResourceGroup| Name of the resource group to which the resource belongs.|
100+
| ResourceProvider | The resource provider. |
115101
| Resource | Name of the resource. |
116102
| ResourceId | Unique identifier for the resource associated with the record. |
117-
| ResourceProvider | The resource provider. |
118103
| ResourceType | Resource type. |
119-
| SourceComputerId | Unique identifier representing the source computer. |
120-
| SourceSystem | Source system for the record. The value is `OperationsManager`. |
121-
| StartTime | Time when the update is scheduled to be installed. *This property is currently not used. See TimeGenerated.* |
122-
| SubscriptionId | Unique identifier for the Azure subscription. |
123-
| SucceededOnRetry | Value indicating if the update execution failed on the first attempt and the current operation is a retry attempt. |
124-
| TimeGenerated | Date and time of record creation. |
125-
| Title | The title of the update. |
126-
| Type | The type of update. The value is `UpdateRunProgress`. |
127-
| UpdateId | Unique identifier of the software update. |
104+
| ComputerEnvironment | Environment. Values are Azure or Non-Azure. |
128105
| VMUUID | Unique identifier for the virtual machine. |
129-
| ResourceId | Unique identifier for the resource associated with the record. |
106+
| Type | The type of update. The value is `UpdateRunProgress`. |
107+
| _ResourceId | Unique identifier for the resource associated with the record. |
130108

131109
### Query Update Summary record
132110

133111
A record with a type of `UpdateSummary` is created that provides update summary by machine. These records have the properties in the following table:
134112

135113
| Property | Description |
136114
|----------|-------------|
137-
| Computer | Fully-qualified domain name of reporting machine. |
138-
| ComputerEnvironment | Environment. Values are Azure or Non-Azure. |
139-
| CriticalUpdatesMissing | Number of applicable critical updates that are missing. |
115+
| TenantId| |
116+
| SourceSystem | Source system for the record. The value is `OpsManager`. |
117+
| TimeGenerated | Date and time of record creation. |
118+
| MG | Unique identifier for the management group or Log Analytics workspace. |
140119
| ManagementGroupName | Name of the Operations Manager management group or Log Analytics workspace. |
141-
| NETRuntimeVersion | Version of .NET Framework installed on the Windows computer. |
142-
| OldestMissingSecurityUpdateBucket | Specifier of the oldest missing security bucket. Values are:<br> Recent if value is less than 30 days<br> 30 days ago<br> 60 days ago<br> 90 days ago<br> 120 days ago<br> 150 days ago<br> 180 days ago<br> Older when value is greater than 180 days. |
120+
| SourceComputerId | Unique identifier for the virtual machine. |
121+
| LastUpdateApplied (UTC)| |
143122
| OldestMissingSecurityUpdateInDays | Total number of days for the oldest update detected as applicable that has not been installed. |
123+
| OldestMissingSecurityUpdateBucket | Specifier of the oldest missing security bucket. Values are:<br> Recent if value is less than 30 days<br> 30 days ago<br> 60 days ago<br> 90 days ago<br> 120 days ago<br> 150 days ago<br> 180 days ago<br> Older when value is greater than 180 days. |
124+
| WindowsUpdateSetting | Status of the Windows Update agent. Possible values are:<br> `Scheduled installation`<br> `Notify before installation`<br> `Error returned from unhealthy WUA agent` |
125+
| WindowsUpdateAgentVersion | Version of the Windows Update agent. |
126+
| WSUSServer | Errors if the Windows Update agent has a problem, to assist with troubleshooting. |
127+
| Computer | Fully-qualified domain name of reporting machine. |
144128
| OsVersion | The version of the operating system. |
129+
| NETRuntimeVersion | Version of .NET Framework installed on the Windows computer. |
130+
| CriticalUpdatesMissing | Number of applicable critical updates that are missing. |
131+
| SecurityUpdatesMissing | Count of missing security updates that are applicable.|
145132
| OtherUpdatesMissing | Count of detected updates missing. |
146-
| Resource | Name of the resource for the record. |
133+
| TotalUpdatesMissing | Total number of missing updates that are applicable. |
134+
| RestartPending | True if a restart is pending, or False otherwise. |
135+
| SubscriptionId | Unique identifier for the Azure subscription. |
147136
| ResourceGroup | Name of the resource group containing the resource. |
148-
| ResourceId | Unique identifier for the resource associated with the record. |
149137
| ResourceProvider | The resource provider. |
138+
| Resource | Name of the resource for the record. |
139+
| ResourceId | Unique identifier for the resource associated with the record. |
150140
| ResourceType | Resource type. |
151-
| RestartPending | True if a restart is pending, or False otherwise. |
152-
| SecurityUpdatesMissing | Count of missing security updates that are applicable.|
153-
| SourceComputerId | Unique identifier for the virtual machine. |
154-
| SourceSystem | Source system for the record. The value is `OpsManager`. |
155-
| SubscriptionId | Unique identifier for the Azure subscription. |
156-
| TimeGenerated | Date and time of record creation. |
157-
| TotalUpdatesMissing | Total number of missing updates that are applicable. |
158-
| Type | Record type. The value is `UpdateSummary`. |
141+
| ComputerEnvironment | Environment. Values are Azure or Non-Azure. |
159142
| VMUUID | Unique identifier for the virtual machine. |
160-
| WindowsUpdateAgentVersion | Version of the Windows Update agent. |
161-
| WindowsUpdateSetting | Status of the Windows Update agent. Possible values are:<br> `Scheduled installation`<br> `Notify before installation`<br> `Error returned from unhealthy WUA agent` |
162-
| WSUSServer | Errors if the Windows Update agent has a problem, to assist with troubleshooting. |
143+
| Type | Record type. The value is `UpdateSummary`. |
163144
| _ResourceId | Unique identifier for the resource associated with the record. |
164145

165146
## Sample queries

0 commit comments

Comments
 (0)