Queries for the QuantumProviderAccountMessageAuditLogs table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Provider message operations (last 24 hours)

Count of provider message audit events (Create, Update, Delete) over the last 24 hours, grouped by operation name and result code.

// Provider message audit events over the last 24 hours, summarized by operation and outcome.
// Answers "what happened to provider messages recently, and did any operations fail?"
QuantumProviderAccountMessageAuditLogs
| where TimeGenerated > ago(24h)
| summarize EventCount = count() by OperationName, ResultCode
| sort by OperationName asc, EventCount desc

Failed provider message operations (last 7 days)

Provider message audit events over the last 7 days whose ResultCode is not Success, grouped by provider, operation, and result code so operators can triage recent failures.

// Failed provider message operations over the last 7 days, grouped by outcome and provider.
// Excludes Success so operators can quickly triage recent errors such as
// ProviderMessageNotFound or InvalidProviderMessageRequest.
QuantumProviderAccountMessageAuditLogs
| where TimeGenerated > ago(7d)
| where ResultCode != "Success"
| summarize FailureCount = count(), LastFailure = max(TimeGenerated)
    by ProviderId, OperationName, ResultCode
| sort by FailureCount desc, LastFailure desc

Upcoming scheduled provider message windows

For each provider message, the most recent successful Create or Update audit record whose scheduled window has not yet ended. Messages whose most recent event was a Delete are excluded.

// Upcoming scheduled provider message windows, based on the most recent successful
// Create or Update audit record per MessageId. Messages whose most recent event was a
// DeleteProviderMessage, or whose scheduled end time has already passed, are excluded.
QuantumProviderAccountMessageAuditLogs
| where TimeGenerated > ago(30d)
| where ResultCode == "Success"
| summarize arg_max(TimeGenerated, OperationName, ProviderId, MessageType, MessagePriority,
        ScheduledMessageStartTime, ScheduledMessageEndTime, RequesterUpn)
    by MessageId
| where OperationName in ("CreateProviderMessage", "UpdateProviderMessage")
| where ScheduledMessageEndTime > now()
| project ScheduledMessageStartTime, ScheduledMessageEndTime, ProviderId, MessageId,
    MessageType, MessagePriority, LastModifiedBy = RequesterUpn, LastModifiedAt = TimeGenerated
| sort by ScheduledMessageStartTime asc