An administrator needs to query Syslog messages from Linux virtual machines in a Log Analytics workspace.
The administrator wants to identify all log entries from the 'auth' facility that have a severity level of 'err' and were generated within the last . The query must display only the time of the event, the computer name, and the log message.
Which KQL query should the administrator run to meet these requirements?
- Syslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" and SeverityLevel == "err"
| project TimeGenerated, Computer, SyslogMessageAnswer - BSyslog
| project TimeGenerated, Computer, SyslogMessage
| where TimeGenerated > ago(24h)
| where Facility == "auth" and SeverityLevel == "err" - CSyslog
| where TimeGenerated > ago(24h)
| where Facility = "auth" and SeverityLevel = "err"
| project TimeGenerated, Computer, SyslogMessage - DSyslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" or SeverityLevel == "err"
| project TimeGenerated, Computer, SyslogMessage
Answer
The query that filters by TimeGenerated, Facility, and SeverityLevel using the double equals comparison operator (==) before using the project operator to limit the output columns to TimeGenerated, Computer, and SyslogMessage.
The correct query begins with the Syslog table, filters logs from the last 24 hours, applies the correct criteria using the double equals comparison operator (==) combined with the logical 'and' operator, and then uses the 'project' operator to output only the requested columns (TimeGenerated, Computer, and SyslogMessage). This maintains the required columns in the pipeline for filtering before they are projected.
Step-by-Step Solution
Key Concept
KQL query pipeline processing, filtering, and column projection
Estimated Time:1m 30s