Queries for the AVSSyslog table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Gets 100 AVS failed DNS query logs. If you are receiving DNS query failures, check your DNS configuration.

AVSSyslog
| where AppName == "dnsmasq" // do some initial filtering to optimize 'has'
| where Message has "Failed DNS Query" // filter to only Failed DNS Query messages
| take 100

Gets 100 AVS distributed firewall logs.

AVSSyslog
| where AppName == "FIREWALL" or ProcId == "FIREWALL"
| take 100

Gets 100 AVS audit events for VM created events.

AVSSyslog
| where Message has "vmcreatedevent" 
| take 100

Gets 100 AVS audit events for VM deleted events.

AVSSyslog
| where Message has "vmremovedevent"
| take 100

Gets 100 AVS audits events for VM powered on events.

AVSSyslog
| where Message has "VmPowerStateChangedEvent" and Message has "poweredon"
| take 100

Gets 100 AVS audit events for VM disconnected events.

AVSSyslog
| where Message has "vmdisconnectedevent"
| take 100

Gets 100 AVS audit events for VM rebooted events.

AVSSyslog
| where Message has "VmGuestRebootEvent"
| take 100

Gets 100 AVS audit events for VM migrated events.

AVSSyslog
| where Message has "vmmigratedevent"
| take 100

Gets 100 AVS audit events for host added events.

AVSSyslog
| where Message has "hostaddedevent"
| take 100

Gets 100 AVS audit events for host shutdown events.

AVSSyslog
| where Message has "hostshutdownevent"
| take 100

Gets 100 AVS audit events for host enter maintenance mode events.

AVSSyslog
| where Message has "The host has entered maintenance mode"
| take 100

Gets 100 AVS audit events for host exit maintenance mode events.

AVSSyslog
| where Message has "The host has exited maintenance mode"
| take 100

Gets 100 AVS audit events for host connected events.

AVSSyslog
| where Message has "hostconnectedevent"
| take 100

Gets 100 AVS audit events for host connections lost events.

AVSSyslog
| where Message has "lost connection to the host"
| take 100

Gets 100 AVS audit events for cluster events.

AVSSyslog
| where Message has "cluster" and Message has "event"
| take 100

Gets the AVS audit events count for NSX.

AVSSyslog
| where Message has "nsx" and Message has "event"
| count

Gets the AVS audit events count for vCenter events.

AVSSyslog
| where Message has "vcenter" and Message has "event"
| count

Gets 100 AVS audit events for role added events.

AVSSyslog
| where Message has "RoleAddedEvent"
| take 100

Gets 100 AVS events by severity level equals Info. Swap it out with other severity level (Notice, Debug, Warning, Error) to get similar.

AVSSyslog
| where severity == "info"
| take 100