This repo contains samples of OMS searches that you could use to explore your hybrid infrastructure in near-realtime. Using OMS Log Analytics, these custom searches provide some cool examples on how easy it is to query complex environments with infrastructure, applications, software and many other hidden problematic secrets.
You are free to cut/paste these searches, use them and change them as you see fit.
The Sky is the limit with OMS Analytics. Search Anything, Search Any Source, and Apply corrective action or proactive alerting to search results.
-
You will require a valid Azure Subscription to test these searches.
-
You will require a configured OMS Workspace.
-
You will need the OMS direct agent installed on Windows or Linux servers.
-
You will require the necessary OMS Solutions installed as appropriate for the search you are running.
-
Cut and paste the appropriate searches below into your OMS Workspace Search,
-
Important, change the values to match your environment.
Type=Perf CounterName="% Processor Time" (Computer=X) OR (Computer=Y) OR (Computer=Z) | measure avg(CounterValue) by Computer Interval 5MINUTE
Type=Perf ObjectName="Capacity and Performance" CounterName="% VM Processor Usage" InstanceName=X | measure avg(CounterValue) by InstanceName Interval 1HOUR
Type=Perf ObjectName="Capacity and Performance" CounterName="VM Disk MB/s" InstanceName=X | measure avg(CounterValue) by InstanceName interval 1hour
Type=Perf (CounterName="Bytes Total/sec") (Computer=X) or (Computer=Y) | measure avg(CounterValue) by InstanceName interval 1hour
Type=Perf (CounterName="Current Disk Queue Length") (Computer=X) OR (Computer=Y OR (Computer=Z)
Type=Perf (CounterName="Avg. Disk sec/Read" OR CounterName="Avg. Disk sec/Write") (Computer=X) OR (Computer=Y OR (Computer=Z) | measure avg(CounterValue), max(CounterValue) by Computer Interval 20MINUTE
Type:W3CIISLog (scStatus=200)(Computer=X)
Type:W3CIISLog (scStatus=400)(Computer=X)