AZ-104 Question 253
Single answerYou are an Azure Administrator for a company whose Windows-based virtual machines send event logs to a Log Analytics workspace. Multiple outages have occurred, and you suspect that Critical-level events might reveal the root cause. Which Kusto Query Language (KQL) statement in Azure Monitor would enable you to retrieve all Critical-level events from these VMs in the last 24 hours?
- A
Event | where EventLevelName == "Critical" and TimeGenerated > ago(24h)
- B
Syslog | where Facility == "Critical" | where TimeGenerated > 24h
- C
AzureDiagnostics | where Category == "Critical" and Timestamp >= ago(24h)
- D
Event | where EventLevelName == "Error" and TimeGenerated < ago(24h)
Show answer and explanation
Correct answer: A
Explanation
When querying Windows event logs in Azure Monitor, the 'Event' table is used. Filtering for 'EventLevelName == "Critical"' retrieves only critical events, and 'TimeGenerated > ago(24h)' limits them to the last 24 hours. This approach precisely meets the requirement to locate recent critical issues.
- A. Correct.
This query uses the 'Event' table, filters by 'Critical' level, and specifies the time range as the last 24 hours with 'ago(24h)'. This matches the requirement exactly.
- B. Incorrect.
The 'Syslog' table is typically used for Linux-based logs rather than Windows event logs, and the time filter syntax is incorrect ('TimeGenerated > 24h' is not valid KQL).
- C. Incorrect.
While 'AzureDiagnostics' is used for diagnostic logs from various Azure services, Windows event logs in this scenario are stored in the 'Event' table, making this query unsuitable.
- D. Incorrect.
This query filters for 'Error' events and uses a '< ago(24h)' condition, which does not match the requirement to find 'Critical' events in the last 24 hours.