List Azure Monitor Agent Connector Failures In Syslog
Description
This KQL query detects latest failure events per AMA connector failures in Syslog in the last three days.
Risk
Failures in AMA connectors mean that no data is being ingested thus no potential alerts will be triggered.
Query
Microsoft Sentinel
Kusto
Syslog
| where TimeGenerated > ago(3d)
| extend sent_by_ama = column_ifexists('CollectorHostName','')
| where isnotempty(sent_by_ama)
| where isnotempty(HostName)
| summarize LastLogReceived = max(TimeGenerated) by HostName, HostIP
| project IsConnected = LastLogReceived > ago(3d), HostName, HostIP
| where IsConnected == "false"