Queries for the MNFDeviceUpdates table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Components state updates events are projected from devices. This query will list out all logs where value is active.

MNFDeviceUpdates
| where EventCategory == "ComponentStateUpdates"
| where Properties has "ACTIVE"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Interface status updates are projected from devices. This query will list out all logs where value is up.

MNFDeviceUpdates
| where EventCategory == "InterfaceStateUpdates"
| where Properties !has "DOWN"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Interface vxlan updates events are projected from devices. This query will list out all the logs where events is of the type VxlanVlanToVniVlan.

MNFDeviceUpdates
| where EventCategory == "InterfaceVxlanUpdates"
| where Properties has "VxlanVlanToVniVlan"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Network instance neighbor updates that happened between routers during a BGP communication are listed with types of afisafiname. This is the query to filter the logs where afisafiname is not of the type L2VPN_EVPN.

MNFDeviceUpdates
| where EventCategory == "NetworkInstanceBgpNeighborUpdates"
| where Properties !has "L2VPN_EVPN"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100

Network instance updates events from device will be reported here with different instance name. This query filters all network instances of the type workload-mgmt.

MNFDeviceUpdates
| where EventCategory == "NetworkInstanceUpdates"
| where Properties has "WORKLOAD-MGMT"
| project EventName, EventCategory, DeviceId, TimeGenerated, Properties
| sort by TimeGenerated desc
| limit 100