Category: Logging

Purge Old Azure Log Analytics Ingested Data

This article is based on Microsoft document:

Assuming you have a Log Analytics workspace in a resource group, you can call the API url:

POST https://management.azure.com/subscriptions/your-subsc-ription-id/resourceGroups/yor-resource-group-rg/providers/Microsoft.OperationalInsights/workspaces/your-log-analytics-name/purge?api-version=2020-08-01

You need to pass Authorization as Bearer token in the header.

The body of the POST request will contain a filter and a table like this:

{
  "table": "Heartbeat",
  "filters": [
    {
      "column": "TimeGenerated",
      "operator": "<",
      "value": "2021-10-09T00:00:00"
    }
  ]
}

The response will have a header like 

x-ms-status-location: https://management.azure.com/subscriptions/{subscriptioId}/resourceGroups/{resourceGroupName}/providers/microsoft.operationalinsights/workspaces/{workspaceName}/operations/purge-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx?api-version=2017-01-01-preview

This is a GET url to send and see the status of the operation. This Url is also given as the body of the first POST request.

The status will be something like:

{
    "status": "pending"
}

Tip: You can find the records to delete using a simple query like this:

W3CIISLog 
| where TimeGenerated > ago(32d)
| summarize count() by bin(TimeGenerated, 1d)


Heartbeat 
| where TimeGenerated > ago(32d)
| summarize count() by bin(TimeGenerated, 1d)

Logging Properties of an instance object

Logging is an ongoing subject that I had some posts about it. In this post I am adding two methods to my beloved Logger class.
The first one shows the values of each property where the property is readable while the second method tries to show the signature of the method.

/// <summary>
/// Shows the public properties
/// </summary>
/// <param name="instance"></param>
public static void ShowPropertyValues(object  instance)
{
 var  instanceType = instance.GetType();
 Information(">>> Showing Instance Properties: "  + instanceType.Name);

 var  props = instanceType.GetProperties();
 foreach  (var  property in  props)
 {
   if  (!property.CanRead) continue ; //'t read! 
   Information(string .Format("Instance.{0} ='{1}'" , property.Name, property.GetValue(instance, null )));
 }
}

/// <summary>
/// Shows the public properties
/// </summary>
/// <param name="instance"></param>
public  static  void  ShowPropertySignature(object  instance)
{
 var  instanceType = instance.GetType();
 Information(">>> Showing Type Properties: "  + instanceType.Name);

 var  props = TypeDescriptor .GetProperties(instance);
 foreach  (PropertyDescriptor  prop in  props)
 {
   Information("----------------------------------------------------" );
   Information(string .Format("Name ='" , prop.Name));
   Information(string .Format("DisplayName ='" , prop.DisplayName));
   Information(string .Format("Description ='" , prop.Description));
   Information(string .Format("ComponentType ='" , prop.ComponentType.Name));
   Information(string .Format("Category ='" , prop.Category));
   Information(string .Format("IsBrowsable ='" , prop.IsBrowsable));
   Information(string .Format("IsLocalizable ='" , prop.IsLocalizable));
   Information(string .Format("IsReadOnly ='" , prop.IsReadOnly));
   Information(string .Format("PropertyType ='" , prop.PropertyType.Name));
   Information(string .Format("SerializationVisibility ='" , prop.SerializationVisibility));
   Information(string .Format("SupportsChangeEvents ='" , prop.SupportsChangeEvents));
 }
}