Examkin

Question

Difficulty: EasyLog Analytics Workspaces and KQL Queries

An administrator deploys the Azure Monitor agent to a virtual machine named VM-Prod1. The administrator needs to write a Kusto Query Language (KQL) query to retrieve all heartbeat events recorded for VM-Prod1 within the last hour. Which KQL query should you run?

  1. Heartbeat | where TimeGenerated > ago(1h) and Computer == "VM-Prod1"Answer
  2. B
    AzureDiagnostics | where TimeGenerated > ago(1h) and Resource == "VM-Prod1"
  3. C
    Heartbeat | filter TimeGenerated > ago(1h) and Computer == "VM-Prod1"
  4. D
    Heartbeat | where TimeGenerated > ago(1h) and Computer = "VM-Prod1"

Answer

Heartbeat | where TimeGenerated > ago(1h) and Computer == "VM-Prod1"
The correct query targets the Heartbeat table, filters logs from the last hour using 'where TimeGenerated > ago(1h)', and performs an equality comparison on the Computer column using the double equals (==) operator.

Step-by-Step Solution

1
Identify the correct database table that stores agent heartbeats in Log Analytics.
The 'Heartbeat' table is selected because it stores the connectivity status of virtual machines, whereas 'AzureDiagnostics' is used for Azure resource resource-specific diagnostic logs.
Selecting the correct table ensures the query targets the correct log type.
2
Apply the correct row filter operator in KQL.
The 'where' operator is selected to filter the logs.
KQL does not support a 'filter' operator for filtering rows.
3
Select the correct equality operator for comparisons.
The double equals operator '==' is used.
Using a single equals sign in a 'where' clause results in a syntax error because '=' is reserved for assignment operations.

Key Concept

Selecting the correct table and basic query operators in KQL for Azure Monitor VM heartbeats.
Estimated Time:45s
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic