有关在 Azure 门户中使用这些查询的信息，请参阅 Log Analytics 教程。 有关 REST API，请参阅 查询。
提供程序消息操作（过去 24 小时）
过去 24 小时内提供程序消息审核事件（创建、更新、删除）计数，按操作名称和结果代码分组。
// Provider message audit events over the last 24 hours, summarized by operation and outcome.
// Answers "what happened to provider messages recently, and did any operations fail?"
QuantumProviderAccountMessageAuditLogs
| where TimeGenerated > ago(24h)
| summarize EventCount = count() by OperationName, ResultCode
| sort by OperationName asc, EventCount desc
失败的提供程序消息操作（过去 7 天）
提供程序消息审核事件在过去 7 天内，其 ResultCode 不成功，按提供程序、操作和结果代码分组，以便操作员可以对最近的失败进行会审。
// Failed provider message operations over the last 7 days, grouped by outcome and provider.
// Excludes Success so operators can quickly triage recent errors such as
// ProviderMessageNotFound or InvalidProviderMessageRequest.
QuantumProviderAccountMessageAuditLogs
| where TimeGenerated > ago(7d)
| where ResultCode != "Success"
| summarize FailureCount = count(), LastFailure = max(TimeGenerated)
by ProviderId, OperationName, ResultCode
| sort by FailureCount desc, LastFailure desc
即将推出的计划提供程序消息窗口
对于每个提供程序消息，最新的成功创建或更新审核记录，其计划窗口尚未结束。 排除了最近事件为 Delete 的消息。
// Upcoming scheduled provider message windows, based on the most recent successful
// Create or Update audit record per MessageId. Messages whose most recent event was a
// DeleteProviderMessage, or whose scheduled end time has already passed, are excluded.
QuantumProviderAccountMessageAuditLogs
| where TimeGenerated > ago(30d)
| where ResultCode == "Success"
| summarize arg_max(TimeGenerated, OperationName, ProviderId, MessageType, MessagePriority,
ScheduledMessageStartTime, ScheduledMessageEndTime, RequesterUpn)
by MessageId
| where OperationName in ("CreateProviderMessage", "UpdateProviderMessage")
| where ScheduledMessageEndTime > now()
| project ScheduledMessageStartTime, ScheduledMessageEndTime, ProviderId, MessageId,
MessageType, MessagePriority, LastModifiedBy = RequesterUpn, LastModifiedAt = TimeGenerated
| sort by ScheduledMessageStartTime asc