Skip to content

Commit 9e0345c

Browse files
paulth1paulth1
committed
fixing validation error
1 parent d86a667 commit 9e0345c

File tree

1 file changed

+23
-23
lines changed

1 file changed

+23
-23
lines changed

‎articles/azure-monitor/vm/monitor-virtual-machine-data-collection.md

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -98,19 +98,19 @@ Use the following guidance as a recommended starting point for event collection.
9898

9999
| Query | Description |
100100
|---------|-------------|
101-
| `Event` | All Windows events |
102-
| `Event` | where EventLevelName == "Error"` |All Windows events with severity of error |
103-
| `Event` | summarize count() by Source` |Count of Windows events by source |
104-
| `Event` | where EventLevelName == "Error" | summarize count() by Source` |Count of Windows error events by source |
101+
| Event | All Windows events |
102+
| Event | where EventLevelName == "Error"` |All Windows events with severity of error |
103+
| Event | summarize count() by Source` |Count of Windows events by source |
104+
| Event | where EventLevelName == "Error" | summarize count() by Source` |Count of Windows error events by source |
105105

106106
### Sample log queries: Syslog events
107107

108108
| Query | Description |
109109
|----------|-------------|
110-
| `Syslog` |All Syslogs |
111-
| `Syslog` | where SeverityLevel == "error"` |All Syslog records with severity of error |
112-
| `Syslog` | summarize AggregatedValue = count() by Computer` |Count of Syslog records by computer |
113-
| `Syslog` | summarize AggregatedValue = count() by Facility` |Count of Syslog records by facility |
110+
| Syslog |All Syslogs |
111+
| Syslog | where SeverityLevel == "error"` |All Syslog records with severity of error |
112+
| Syslog | summarize AggregatedValue = count() by Computer` |Count of Syslog records by computer |
113+
| Syslog | summarize AggregatedValue = count() by Facility` |Count of Syslog records by facility |
114114

115115
## Collect performance counters
116116
Performance data from the client can be sent to either [Azure Monitor Metrics](../essentials/data-platform-metrics.md) or [Azure Monitor Logs](../logs/data-platform-logs.md), and you typically send them to both destinations. If you enabled VM insights, a common set of performance counters is collected in Logs to support its performance charts. You can't modify this set of counters, but you can create other DCRs to collect more counters and send them to different destinations.
@@ -137,17 +137,17 @@ The following samples use the `Perf` table with custom performance data. For inf
137137

138138
| Query | Description |
139139
|--------|-------------|
140-
| `Perf` | All Performance data |
141-
| `Perf` | where Computer == "MyComputer"` |All Performance data from a particular computer |
142-
| `Perf` | where CounterName == "Current Disk Queue Length"` |All Performance data for a particular counter |
143-
|` Perf` | where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total" | summarize AVGCPU = avg(CounterValue) by Computer` |Average CPU Utilization across all computers |
144-
| `Perf` | where CounterName == "% Processor Time" | summarize AggregatedValue = max(CounterValue) by Computer` |Maximum CPU Utilization across all computers |
145-
| `Perf` | where ObjectName == "LogicalDisk" and CounterName == "Current Disk Queue Length" and Computer == "MyComputerName" | summarize AggregatedValue = avg(CounterValue) by InstanceName` |Average Current Disk Queue length across all the instances of a given computer |
146-
| `Perf` | where CounterName == "Disk Transfers/sec" | summarize AggregatedValue = percentile(CounterValue, 95) by Computer` |95th Percentile of Disk Transfers/Sec across all computers |
147-
| `Perf` | where CounterName == "% Processor Time" and InstanceName == "_Total" | summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 1h), Computer` |Hourly average of CPU usage across all computers |
148-
| `Perf` | where Computer == "MyComputer" and CounterName startswith_cs "%" and InstanceName == "_Total" | summarize AggregatedValue = percentile(CounterValue, 70) by bin(TimeGenerated, 1h), CounterName` | Hourly 70 percentile of every % percent counter for a particular computer |
149-
| `Perf` | where CounterName == "% Processor Time" and InstanceName == "_Total" and Computer == "MyComputer" | summarize ["min(CounterValue)"] = min(CounterValue), ["avg(CounterValue)"] = avg(CounterValue), ["percentile75(CounterValue)"] = percentile(CounterValue, 75), ["max(CounterValue)"] = max(CounterValue) by bin(TimeGenerated, 1h), Computer` |Hourly average, minimum, maximum, and 75-percentile CPU usage for a specific computer |
150-
| `Perf` | where ObjectName == "MSSQL$INST2:Databases" and InstanceName == "master"` | All Performance data from the Database performance object for the master database from the named SQL Server instance INST2. |
140+
| Perf | All Performance data |
141+
| Perf | where Computer == "MyComputer"` |All Performance data from a particular computer |
142+
| Perf | where CounterName == "Current Disk Queue Length"` |All Performance data for a particular counter |
143+
| Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total" | summarize AVGCPU = avg(CounterValue) by Computer` |Average CPU Utilization across all computers |
144+
| Perf | where CounterName == "% Processor Time" | summarize AggregatedValue = max(CounterValue) by Computer` |Maximum CPU Utilization across all computers |
145+
| Perf | where ObjectName == "LogicalDisk" and CounterName == "Current Disk Queue Length" and Computer == "MyComputerName" | summarize AggregatedValue = avg(CounterValue) by InstanceName` |Average Current Disk Queue length across all the instances of a given computer |
146+
| Perf | where CounterName == "Disk Transfers/sec" | summarize AggregatedValue = percentile(CounterValue, 95) by Computer` |95th Percentile of Disk Transfers/Sec across all computers |
147+
| Perf | where CounterName == "% Processor Time" and InstanceName == "_Total" | summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 1h), Computer` |Hourly average of CPU usage across all computers |
148+
| Perf | where Computer == "MyComputer" and CounterName startswith_cs "%" and InstanceName == "_Total" | summarize AggregatedValue = percentile(CounterValue, 70) by bin(TimeGenerated, 1h), CounterName` | Hourly 70 percentile of every % percent counter for a particular computer |
149+
| Perf | where CounterName == "% Processor Time" and InstanceName == "_Total" and Computer == "MyComputer" | summarize ["min(CounterValue)"] = min(CounterValue), ["avg(CounterValue)"] = avg(CounterValue), ["percentile75(CounterValue)"] = percentile(CounterValue, 75), ["max(CounterValue)"] = max(CounterValue) by bin(TimeGenerated, 1h), Computer` |Hourly average, minimum, maximum, and 75-percentile CPU usage for a specific computer |
150+
| Perf | where ObjectName == "MSSQL$INST2:Databases" and InstanceName == "master"` | All Performance data from the Database performance object for the master database from the named SQL Server instance INST2. |
151151

152152
## Collect text logs
153153
Some applications write events written to a text log stored on the virtual machine. Create a [custom table and DCR](../agents/data-collection-text-log.md) to collect this data. You define the location of the text log, its detailed configuration, and the schema of the custom table. There's a cost for the ingestion and retention of this data in the workspace.
@@ -157,8 +157,8 @@ The column names used here are examples only. The column names for your log will
157157

158158
| Query | Description |
159159
|------------|-------------|
160-
| `MyApp_CL` | summarize count() by code` | Count the number of events by code. |
161-
| `MyApp_CL` | where status == "Error" | summarize AggregatedValue = count() by Computer, bin(TimeGenerated, 15m)` | Create an alert rule on any error event. |
160+
| MyApp_CL | summarize count() by code` | Count the number of events by code. |
161+
| MyApp_CL | where status == "Error" | summarize AggregatedValue = count() by Computer, bin(TimeGenerated, 15m)` | Create an alert rule on any error event. |
162162

163163
## Collect IIS logs
164164
IIS running on Windows machines writes logs to a text file. Configure IIS log collection by using [Collect IIS logs with Azure Monitor Agent](../agents/data-collection-iis.md). There's a cost for the ingestion and retention of this data in the workspace.
@@ -169,8 +169,8 @@ Records from the IIS log are stored in the [W3CIISLog](/azure/azure-monitor/refe
169169

170170
| Query | Description |
171171
|-------------|-------------|
172-
| `W3CIISLog` | where csHost=="www.contoso.com" | summarize count() by csUriStem` | Count the IIS log entries by URL for the host www.contoso.com. |
173-
| `W3CIISLog` | summarize sum(csBytes) by Computer` | Review the total bytes received by each IIS machine. |
172+
| W3CIISLog | where csHost=="www.contoso.com" | summarize count() by csUriStem` | Count the IIS log entries by URL for the host www.contoso.com. |
173+
| W3CIISLog | summarize sum(csBytes) by Computer` | Review the total bytes received by each IIS machine. |
174174

175175
## Monitor a service or daemon
176176
To monitor the status of a Windows service or Linux daemon, enable the [Change Tracking and Inventory](../../automation/change-tracking/overview.md) solution in [Azure Automation](../../automation/automation-intro.md).

0 commit comments

Comments
 (0)