Examkin

Soru

Zorluk: Çok zorLog Analytics Workspaces and KQL Queries

An Azure subscription contains a resource group named `RG-Compute` that contains two virtual machines named `VM-Prod1` and `VM-Prod2`. The subscription also contains a resource group named `RG-Ops` that contains a Log Analytics workspace named `LAW-Shared`. Diagnostic settings on both virtual machines are configured to send guest OS performance logs to `LAW-Shared`. The Access Control Mode of `LAW-Shared` is configured to 'Use resource or workspace permissions'. A user named Admin1 is assigned the Reader role on `RG-Compute`, but has no roles assigned on `RG-Ops` or `LAW-Shared`. Admin1 needs to run a single KQL query to compare the CPU performance metrics (`% Processor Time`) of both virtual machines over the last 12 hours. Which administrative action should Admin1 perform to execute this query successfully?

  1. A
    Navigate to the `VM-Prod1` blade in the Azure portal, select Logs, and run the query: `Perf | where TimeGenerated > ago(12h) and CounterName == "% Processor Time"`.
  2. B
    Navigate to the `LAW-Shared` blade in the Azure portal, select Logs, and run the query: `Perf | where TimeGenerated > ago(12h) and CounterName == "% Processor Time"`.
  3. Navigate to the `RG-Compute` blade in the Azure portal, select Logs, and run the query: `Perf | where TimeGenerated > ago(12h) and CounterName == "% Processor Time"`.Cevap
  4. D
    Request the User Access Administrator to assign the Log Analytics Reader role to Admin1 on `LAW-Shared`, navigate to the `LAW-Shared` blade, and run the query: `Perf | where TimeGenerated > ago(12h) and CounterName == "% Processor Time"`.

Cevap

Navigate to the resource group containing the virtual machines in the Azure portal, open the Logs pane, and execute the performance query.
The correct action is to run the query from the Resource Group's Logs blade. Because the Log Analytics workspace is configured to use resource or workspace permissions, users with read permissions to a resource (or resource group) can query logs for those resources even if they do not have direct access to the workspace. This is known as resource-context log access. When running a query from the Logs blade of a Resource Group, Azure Monitor automatically scopes the query to all resources within that Resource Group, enabling the comparison of performance metrics for both virtual machines without requiring workspace-level permissions.

Adım Adım Çözüm

1
Evaluate the Log Analytics workspace permissions model.
The workspace uses 'Use resource or workspace permissions' (resource-context). This mode allows users with read permissions to a resource to query its logs even if they have no direct access to the workspace.
To determine whether the user can retrieve logs without workspace-level permissions.
2
Determine the required resource scope to compare metrics for both virtual machines.
The scope must encompass both virtual machines, which are located in the same resource group.
To select a portal context that includes both target virtual machines.
3
Identify the portal blade that aligns with the scope and current reader permissions.
Opening Logs from the resource group blade scopes the query to all resources within that resource group.
A resource-context query initiated at the Resource Group level automatically filters and gathers logs for all resources in that group.

Anahtar Kavram

Resource-context log access and scoping in Azure Monitor
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru