Add Log Analytics hybrid support for Activity Log and Resource Health - #9
Merged
Merged
Conversation
…ource Health - Add -Workspace parameter (LA workspace GUID) with validation - Add Get-LogAnalyticsData function: single KQL query fetches both Activity Log lifecycle events and Resource Health transitions from AzureActivity table - Refactor Invoke-SuspectGapInvestigation with dual paths: pre-fetched LA data when available, REST API fallback when -Workspace not specified - Update Get-HealthCoverageStart to bypass 30-day clamp in LA mode - Update .DESCRIPTION and function comments to document both modes - No changes to compiled types (MetricProcessor, GapProcessor)
- Add -Workspace row to PowerShell parameters table - Add note that C# --workspace support is planned - Add PowerShell example with -Workspace - Document LA info line and 30-day warning suppression in Output section - Update Suspect gap investigation: dual data source paths (REST vs LA) - Update observation window note for LA retention override
…events When -Workspace is specified but a resource has no Activity Log or Resource Health events in the LA data, resLaData is null. The fallback condition 'elseif (-not )' incorrectly triggered the REST API path, which tried to use the null HttpClient (not created in workspace mode). Fix: change both fallback conditions to 'elseif (-not )' so the REST API path is only attempted when NOT in workspace mode. In workspace mode, absence of a resource from the LA result correctly means no events.
…dation AzureActivity ResourceHealth events include multiple lifecycle events (Activated, Updated, InProgress, Resolved) per health incident. The previous code treated each event as an independent state transition, causing: - Activated events (cause=Unknown) to create phantom faults before the real cause was determined via subsequent Updated events. - Stale Updated events arriving after Resolved to create phantom unavailability periods. - Concurrent InProgress+Activated events to produce conflicting causes. The REST API retroactively applies the final cause to the entire incident. This commit replicates that behaviour: 1. Add OperationNameValue to the KQL health data projection. 2. Track health incidents (Activated/InProgress -> Resolved) and collect the latest non-Unknown cause within each incident. 3. Only create transitions when the health state actually changes. 4. On Resolved, retroactively apply the final cause to all transitions in that incident, matching the REST API's curated timeline. 5. Skip orphan Updated events outside any incident (stale events). Tested: win22ans0-PROD faults 122->2 (matches REST), tmaceal01azne 720->0, spocovm01a 949->0. OVERALL improved from 99.68% to 99.97%.
- Add inline comments to ~25 uncommented code sections covering health event parsing, incident post-processing, batch/per-resource metric collection, Activity Log investigation, Resource Health interval building, suspect classification, result assembly, and pipeline steps - Fix batch metric retry: remove HTTP 401 from retryable status codes (401 is permanent auth failure, only 429 should be retried) - Update README to accurately describe the hybrid LA+REST approach for Resource Health data (KQL for older transitions, REST API authoritative for last ~30 days)
- Add LogAnalyticsService.cs: single bulk KQL query fetches Activity Log lifecycle events and Resource Health transitions from a workspace. Health events undergo incident-based post-processing (Activated/Updated/ InProgress/Resolved consolidation with retroactive cause correction) to match REST API's curated timeline. - Update ResourceHealthService: add hybrid merge logic (LA transitions older than REST ~30-day cutoff + REST transitions for last ~30 days), add GetHealthCoverageStart(useLogAnalytics) overload and GetRestHealthCutoff(), pass LA data through investigation pipeline. - Update ActivityLogService: add BuildLifecycleIntervalsFromEvents() for processing pre-fetched LA events, extract shared interval-building logic into BuildIntervalsFromEvents(). - Update Program.cs: add --workspace/-w CLI parameter with GUID validation, integrate LA data fetching before investigation, display workspace info line and suppress 30-day health coverage warning in hybrid mode.
- BatchMetricsService: remove 401 from retry condition (same bug previously fixed in PowerShell — 401 is not retryable) - Program.cs: expand comments on suspect candidate assembly, investigation result integration, and result assembly sections - BatchMetricsService: add XML doc comments to ProcessVmOrSqlBatch, ProcessStorageBatch, and inline comments for grouping/parsing logic - SummaryWriter: document format string column layout - README: add --workspace/-w to C# parameter table, add C# workspace usage example, remove outdated 'PS-only' note, update observation window paragraph to reference both versions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds -Workspace / --workspace parameter to both PowerShell and C# versions, enabling bulk KQL queries against a Log Analytics workspace instead of per-resource REST API calls for Activity Log lifecycle events and Resource Health transitions.
Key changes
PowerShell (get-availability.ps1)
C# (Native AOT)
README
Testing
Comparative test with 3 subscriptions (215 resources) using -Workspace:
Commits (7)