We have configured our synapse to send data to log analytics workspace .. one table got truncated from my synapse so i want to find out who has done that operation .. i tried with "synapsesqlpoolexecrequests" but not getting results .
So can anybody help me with query to write in log analytics for above requirement ..
I'm guessing this is a cross-post from Microsoft Q&A: https://learn.microsoft.com/en-us/answers/questions/385289/how-to-check-logs-in-synapse.html
All details about who ran a query are available in the monitoring tab in the Synapse workspace:
Related
Can anyone share a Kusto query (KQL) that I can use in log analytics that would return some usage tracking stats?
I am trying to identify which "Views" and "Tables" are used the most. Also trying to find out who the power users are and commands/query that is run against the "Tables".
Any insights would be appreciated.
You can use below functions to gather the useage statics
DiagnosticMetricsExpand()
DiagnosticLogsExpand()
ActivityLogRecordsExpand()
And create target tables to store the function data to analyse the useage information.
Refer the Azure documentation for complete details https://learn.microsoft.com/en-us/azure/data-explorer/ingest-data-no-code?tabs=activity-logs
Tutorial: Ingest monitoring data in Azure Data Explorer without code
In this tutorial, you learn how to ingest monitoring data to Azure Data Explorer without one line of code and query that data.
I need to retrieve executed sql queries by using log analytics.
I have the log analytics workspace and also configured diagnostic settings (SQL managed instance and database).
But there is no data when I try to execute the following kusto query:
AzureDiagnostics | where Category == "QueryStoreRuntimeStatistics"
Should I set up something more to see this data? (enable Query Store - Write and Read - directly on the SQL Server Database ?)
In the AzureDiagnostic table I have only UsageStats and Erros.
We can check for SQL diagnostics information with help of log analytics workspace, below are few steps which we need to follow:
Need to create a log analytics work space.
Add few configurations to SQL such as enabling audit mode and select Log Analytics workspace.
Enable diagnostics to Log Analytics.
Select the check box for send data to log analytics.
We can understand more about this from one of the Microsoft blogs.
I can find tools in Azure to monitor and get logs on the performance of the Azure SQL database. However, what tools are available in the Azure portal to see logs of failed SQL data manipulation queries of the database? - e.g. update, delete, insert queries?
Thank you
In case someone need this to I got an answer elsewhere with Extended Events though didn't yet try https://techcommunity.microsoft.com/t5/azure-database-support-blog/extended-events-capture-step-by-step-walkthrough/ba-p/369013
I have
Azure Synapse Workspace on which I have Synapse Administrator access
Through Azure portal - I have configured he Log Analytics and running below KQL statement to find the list of queries executed along with data processed in MBs and user-id/identity of the SQL
I am not able to find the identity here - Is there a setting to fetch it ?
Below is the KQL statement
SynapseBuiltinSqlPoolRequestsEnded
| where TimeGenerated > ago(24h)
| evaluate bag_unpack(Properties)
| project startTime,endTime,error,Identity,queryText, command,dataProcessedBytes/1024/1024
Let me know, if this is a limitation at this moment or am I missing anything here ?
Thanks,
Aravind
Yes, there is a limitation for this.
Log analytics does not capture any PII(Personally identifiable information) for data compliance.
Check the Identity column in SynapseBuiltinSqlPoolRequestsEnded. It has the login name of the user running the query.
Unable to capture insert/update/delete operations in log Analytics. Using synapse dedicated sql pool audit data).
Is it possible to audit the insert/update/delete in log Analytics?
Could you please provide answer for this question😊
If the ask is , does log analytics capture the insert/update/delete records , then the answer is NO it does not . I think you can be a bit more elaborate on the ask .