Skip to content

Asistance with KQL under log analytics workspace #21

@Arslannetworkhomes

Description

@Arslannetworkhomes

ConfigurationChange
| where ConfigChangeType == "WindowsServices"
and SvcState == "Stopped"
and (
Computer has "NET-SQL2.networkhg.org.uk"
or Computer has "NET-SQL3.networkhg.org.uk"
or Computer has "NET-GISSQL1.networkhg.org.uk"
or Computer has "NET-CALSQL.networkhg.org.uk"
)
and (
SvcDisplayName == "SQL Full-text Filter Daemon Launcher (TEST)"
or SvcDisplayName == "SQL Full-text Filter Daemon Launcher (MSSQLSERVER)"
or SvcDisplayName == "SQL Full-text Filter Daemon Launcher (SQLEXPRESS)"
or SvcDisplayName == " SQL Server (MSSQLSERVER)"
or SvcDisplayName == "SQL Server (Test) "
or SvcDisplayName == "SQL Server Agent (MSSQLSERVER)"
or SvcDisplayName == "SQL Server Agent (Test)"
or SvcDisplayName == "SQL Server Browser"
or SvcDisplayName == "SQL Server Integration Services 10.0"
or SvcDisplayName == "SQL Full-text Filter Daemon Launcher (FIDO)"
or SvcDisplayName == "SQL Full-text Filter Daemon Launcher (SUN)"
or SvcDisplayName == "SQL Server (FIDO)"
or SvcDisplayName == "SQL Server (SUN)"
or SvcDisplayName == "SQL Server Agent (FIDO)"
or SvcDisplayName == "SQL Server VSS Writer"
or SvcDisplayName == " SQL Server Integration Services 11.0"
or SvcDisplayName == "SQL Server Reporting Services (MSSQLSERVER)"
or SvcDisplayName == "SQL Server Reporting Services (SQLEXPRESS)"
or SvcDisplayName == "SQL Server Analysis Services (MSSQLSERVER)"
)

Question to ask, if one of the service gets stopped in any of the server mentioned above, will I get an email with regards to that server or all the servers will be listed

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions