Skip to content

Commit 40ebf2c

Browse files
osalzbergosalzberg
committed
update
1 parent 9221686 commit 40ebf2c

File tree

1 file changed

+189
-0
lines changed

1 file changed

+189
-0
lines changed

‎articles/azure-monitor/logs/azure-monitor-troubleshooting-logs.md

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
---
2+
title: Azure Monitor Troubleshooting logs
3+
description: Use Azure Monitor to quickly, or periodically investigate issues, troubleshoot code or configuration problems or address support cases, which often rely upon searching over high volume of data for specific insights.
4+
author: osalzberg
5+
ms.author: bwren
6+
ms.reviewer: bwren
7+
ms.subservice: logs
8+
ms.topic: conceptual
9+
ms.date: 12/29/2020
10+
11+
---
12+
13+
# Azure Monitor Troubleshooting logs (Preview)
14+
15+
Troubleshooting Logs is a new flavor of logs that would be offered in Azure Monitor Logs side by side to the existing monitoring and analytics logs. Troubleshooting logs are relevant for container logs and application traces where customers send large volume of verbose logs, not for analytics but to be able to troubleshoot their systems. Such logs will be much cheaper to ingest while their queries will be less performant and not available for alerting. Azure Monitor Logs is becoming a comprehensive log solution that supports all kind of logs using the same query language, experience, and the ability to cross-correlate them. There is no need for a customer to operate several different log solutions to monitor their applications and infrastructure.
16+
17+
Customers will be able to mark their AppTraces and ContainerLog/ContainerLogV2 tables as troubleshooting logs. By default, these tables would remain as there are today. Current troubleshooting logs performance settings are:
18+
* Max query time range of two days. Queries that involve troubleshooting logs that have larger time span will be adjusted for two days.
19+
* Up to two concurrent queries per user will be allowed for these tables. Dashboards that contain many parts that query these logs will load slower.
20+
* Alerts will not support queries over troubleshooting logs.
21+
* [Purge](https://docs.microsoft.com/rest/api/loganalytics/workspacepurge/purge) command will not be available for this data.
22+
23+
## Preview terms
24+
During the first half of 2021, Troubleshooting logs will be offered as a private preview. The provisional price for these logs will be $0.50/GB with four days of retention included. Customers can extend the retention for these tables at the standard $0.10/GB/month cost. During the first period of the preview, until May 2021, no charging will be made for these logs.
25+
26+
## Troubleshoot and query your code or configuration issues
27+
Use Azure Monitor Troubleshooting Logs to fetch your records and investigate problems and issues in a simpler and cheaper way using KQL.
28+
Troubleshooting Logs decrees your charges by giving you basic capabilities for troubleshooting.
29+
30+
> [!NOTE]
31+
>* By default, the tables inherits the workspace retention. To avoid additional charges, it is recommended to change these tables retention. [Click here to learn how to change table retention](https://docs.microsoft.com//azure/azure-monitor/platform/manage-cost-storage).
32+
>* This feature is available only for subscriptions that were added to the feature allow-list.
33+
34+
## Turn on Troubleshooting Logs on your tables
35+
36+
To turn on Troubleshooting Logs in your workspace, you need to use the following API call.
37+
```http
38+
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2020-10-01
39+
40+
(With body in the form of a GET single table request response)
41+
42+
Response:
43+
44+
{
45+
"properties": {
46+
"retentionInDays": 40,
47+
"isTroubleshootingAllowed": true,
48+
"isTroubleshootEnabled": true
49+
},
50+
"id": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}",
51+
"name": "{tableName}"
52+
}
53+
```
54+
## Check if the Troubleshooting logs feature is enabled for a given table
55+
To check whether the Troubleshooting Log is enabled for a given table, you can use the following API call.
56+
57+
```http
58+
GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2020-10-01
59+
60+
Response:
61+
"properties": {
62+
"retentionInDays": 30,
63+
"isTroubleshootingAllowed": true,
64+
"isTroubleshootEnabled": true,
65+
"lastTroubleshootDate": "Thu, 19 Nov 2020 07:40:51 GMT"
66+
},
67+
"id": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.operationalinsights/workspaces/{workspaceName}/tables/{tableName}",
68+
"name": " {tableName}"
69+
70+
```
71+
## Check if the Troubleshooting logs feature is enabled for all of the tables in a workspace
72+
To check which tables have the Troubleshooting Log enabled, you can use the following API call.
73+
74+
```http
75+
GET "https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables?api-version=2020-10-01"
76+
77+
Response:
78+
{
79+
"properties": {
80+
"retentionInDays": 30,
81+
"isTroubleshootingAllowed": true,
82+
"isTroubleshootEnabled": true,
83+
"lastTroubleshootDate": "Thu, 19 Nov 2020 07:40:51 GMT"
84+
},
85+
"id": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.operationalinsights/workspaces/{workspaceName}/tables/table1",
86+
"name": "table1"
87+
},
88+
{
89+
"properties": {
90+
"retentionInDays": 7,
91+
"isTroubleshootingAllowed": true
92+
},
93+
"id": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.operationalinsights/workspaces/{workspaceName}/tables/table2",
94+
"name": "table2"
95+
},
96+
{
97+
"properties": {
98+
"retentionInDays": 7,
99+
"isTroubleshootingAllowed": false
100+
},
101+
"id": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.operationalinsights/workspaces/{workspaceName}/tables/table3",
102+
"name": "table3"
103+
}
104+
```
105+
## Turn off Troubleshooting Logs on your tables
106+
107+
To turn off Troubleshooting Logs in your workspace, you need to use the following API call.
108+
```http
109+
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2020-10-01
110+
111+
(With body in the form of a GET single table request response)
112+
113+
Response:
114+
115+
{
116+
"properties": {
117+
"retentionInDays": 40,
118+
"isTroubleshootingAllowed": true,
119+
"isTroubleshootEnabled": false
120+
},
121+
"id": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}",
122+
"name": "{tableName}"
123+
}
124+
```
125+
>[!TIP]
126+
>* You can use any REST API tool to run the commands. [Read More](https://docs.microsoft.com/rest/api/azure/)
127+
>* You need to use the Bearer token for authentication. [Read More](https://social.technet.microsoft.com/wiki/contents/articles/51140.azure-rest-management-api-the-quickest-way-to-get-your-bearer-token.aspx)
128+
129+
>[!NOTE]
130+
>* The "isTroubleshootingAllowed" flag – describes if the table is allowed in the service
131+
>* The "isTroubleshootEnabled" indicates if the feature is enabled for the table - can be switched on or off (true or false)
132+
>* When disabling the "isTroubleshootEnabled" flag for a specific table, re-enabling it is possible only one week after the prior enable date.
133+
>* Currently this is supported only for tables under (some other SKUs will also be supported in the future) - [Read more about pricing](https://docs.microsoft.com/services-hub/health/azure_pricing).
134+
135+
## Schema for Container logs (ContainerLogV2)
136+
As part of Troubleshooting Logs, Azure Monitor for containers is now in Private Preview of new schema for Container logs called ContainerLogV2. As part of this schema, there new fields to make common queries to view AKS (Azure Kubernetes Service) data.
137+
138+
>[!NOTE]
139+
>The new fields are:
140+
>* ContainerName
141+
>* PodName
142+
>* PodNamespace
143+
144+
## ContainerLogV2 schema
145+
```kusto
146+
Computer: string,
147+
ContainerId: string,
148+
ContainerName: string,
149+
PodName: string,
150+
PodNamespace: string,
151+
LogMessage: dynamic,
152+
LogSource: string,
153+
TimeGenerated: datetime
154+
```
155+
## Enable ContainerLogV2 schema
156+
1. Customers can enable ContainerLogV2 schema at cluster level.
157+
2. To enable ContainerLogV2 schema, configure the cluster's configmap, Learn more about [configmap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) in Kubernetes documentation & [Azure Monitor configmap](https://docs.microsoft.com/azure/azure-monitor/insights/container-insights-agent-config#configmap-file-settings-overview).
158+
3. Follow the instructions accordingly when configuring an existing ConfigMap or using a new one.
159+
### Configuring an existing ConfigMap
160+
* When configuring an existing ConfigMap, we have to append the following section in your existing ConfigMap yaml file:
161+
```yml
162+
[log_collection_settings.schema]
163+
# In the absense of this configmap, default value for containerlog_schema_version is "v1"
164+
# Supported values for this setting are "v1","v2"
165+
# See documentation for benefits of v2 schema over v1 schema before opting for "v2" schema
166+
containerlog_schema_version = "v2"
167+
```
168+
### Configuring a new ConfigMap
169+
* Download the new ConfigMap from [here](https://github.com/microsoft/Docker-Provider/blob/ci_prod/kubernetes/container-azm-ms-agentconfig.yaml).
170+
* For new downloaded configmapdefault the value for containerlog_schema_version is "v1"
171+
* Update the "containerlog_schema_version = "v2""
172+
173+
```yml
174+
[log_collection_settings.schema]
175+
# In the absense of this configmap, default value for containerlog_schema_version is "v1"
176+
# Supported values for this setting are "v1","v2"
177+
# See documentation for benefits of v2 schema over v1 schema before opting for "v2" schema
178+
containerlog_schema_version = "v2"
179+
```
180+
* Once you have finished configuring the configmap Run the following kubectl command: kubectl apply -f `<configname>`
181+
>[!TIP]
182+
>Example: kubectl apply -f container-azm-ms-agentconfig.yaml.
183+
184+
>[!NOTE]
185+
>* The configuration change can take a few minutes to complete before taking effect, all omsagent pods in the cluster will restart.
186+
>* The restart is a rolling restart for all omsagent pods, it will not restart all of them at the same time.
187+
## Next steps
188+
* [Write queries](https://docs.microsoft.com/azure/data-explorer/write-queries)
189+
* [Rest API](https://docs.microsoft.com/rest/api/azure/)

0 commit comments

Comments
 (0)