Log Management

# From log_analytics.py:335-340
Heartbeat
| where Computer == 'vm-name'
| top 500 by TimeGenerated desc
| project TimeGenerated, Computer, Category, OSType, OSName, Version, ResourceId

# From log_analytics.py:324-333
Perf
| where Computer == 'vm-name'
| where CounterName == '% Processor Time' or CounterName == 'Available MBytes Memory'
| where InstanceName == '_Total' or InstanceName == 'Memory' or InstanceName == 'total'
| summarize AverageValue = avg(CounterValue) by TimeGenerated, CounterName
| order by TimeGenerated desc
| top 500 by TimeGenerated

# From log_analytics.py:384-401
POST /api/azure/vm/{vm_name}/logs/query
Content-Type: application/json

{
  "workspaceGuid": "12345678-1234-1234-1234-123456789abc",
  "kqlQuery": "Heartbeat | where Computer == 'vm-name' | top 10 by TimeGenerated desc"
}

# From log_analytics.py:396-401
dangerous_keywords = ['delete', 'update', 'modify', 'insert', 'drop']
if any(keyword in kql_query.lower() for keyword in dangerous_keywords):
    return jsonify({"error": "Zapytanie zawiera niedozwolone słowa kluczowe"}), 400

if f"Computer == '{vm_id}'" not in kql_query:
    return jsonify({"error": f"Zapytanie musi zawierać filtr 'where Computer == \"{vm_id}\"'"}), 400

# From containermonitor.py:196-201
ContainerInstanceLog_CL
| where ContainerGroup_s == 'container-group-name'
| top 500 by TimeGenerated desc

# From containermonitor.py:252-253
if f"ContainerGroup_s == '{container_group_name}'" not in kql_query:
    return jsonify({"error": "Zapytanie musi zawierać filtr container-specific"}), 400

# From vmmonitor.py:306-376
POST /api/gcp/vm/{project_id}/{instance_id}/logs/query
Content-Type: application/json

{
  "lqlQuery": "resource.type=\"gce_instance\" resource.labels.instance_id=\"1234567890\" severity>=ERROR"
}

# Filter by resource type and instance
resource.type="gce_instance"
resource.labels.instance_id="1234567890"

# Filter by severity
severity>=ERROR
severity=INFO

# Filter by timestamp
timestamp>="2024-01-15T00:00:00Z"

# Filter by log name
logName="projects/my-project/logs/syslog"

# From vmmonitor.py:324-326
instance_filter = f'resource.labels.instance_id="{instance_id}"'
if instance_filter not in lql_query:
    return jsonify({"error": f"Zapytanie LQL musi zawierać filtr: {instance_filter}"}), 400

# From vmmonitor.py:332-362
entries_iterator = client.list_entries(
    filter_=lql_query,
    order_by=logging_v2.DESCENDING,  # Newest first
    page_size=100
)

for entry in entries_iterator:
    row = {
        "timestamp": entry.timestamp.isoformat(),
        "severity": entry.severity,
        "logName": entry.log_name.split('/')[-1]
    }
    
    # Extract payload fields dynamically
    payload = entry.payload
    if isinstance(payload, dict):
        for key, value in payload.items():
            row[key] = str(value)
    elif isinstance(payload, str):
        row["payload"] = payload

{
  "columns": ["timestamp", "severity", "logName", "message"],
  "rows": [
    ["2024-01-15T10:30:45.123Z", "ERROR", "syslog", "Connection timeout"],
    ["2024-01-15T10:30:40.456Z", "INFO", "syslog", "Service started"]
  ]
}

# From containermonitor.py:192-255
POST /api/gcp/container/{project_id}/{service_name}/logs/query
Content-Type: application/json

{
  "lqlQuery": "resource.type=\"cloud_run_revision\" resource.labels.service_name=\"my-service\" severity>=WARNING"
}

# From containermonitor.py:208-210
service_filter = f'resource.labels.service_name="{container_name}"'
if service_filter not in lql_query:
    return jsonify({"error": "Zapytanie LQL musi zawierać filtr service_name"}), 400

GET /api/azure/vm/{vm_name}/logs/export?workspaceGuid={guid}&type=perf&hours=1

# From log_analytics.py:303-370
response = client.query_workspace(
    workspace_id=workspace_guid,
    query=query,
    timespan=timedelta(hours=timespan_hours)
)

if response.status == LogsQueryStatus.SUCCESS and response.tables:
    table = response.tables[0]
    output = io.StringIO()
    writer = csv.writer(output, delimiter=';')
    
    # Write header
    writer.writerow(table.columns)
    
    # Write data rows
    for row in table.rows:
        row_data = [str(item) if isinstance(item, datetime) else item for item in row]
        writer.writerow(row_data)
    
    return Response(
        csv_content,
        mimetype="text/csv",
        headers={"Content-Disposition": f"attachment;filename={vm_id}_{log_type}_logs.csv"}
    )

GET /api/gcp/container/{container_name}/logs/export?workspaceGuid={guid}&hours=1&type=container

# From containermonitor.py:177-235
query = f"""
ContainerInstanceLog_CL
| where ContainerGroup_s == '{container_group_name}'
| top 500 by TimeGenerated desc
"""

response = client.query_workspace(
    workspace_id=workspace_guid,
    query=query,
    timespan=timedelta(hours=timespan_hours)
)

# From log_analytics.py:421
timespan=timedelta(days=1)  # Limit to 24 hours by default

# From vmmonitor.py:335
page_size=100  # Limit results per page

# From log_analytics.py:312-316
credential = ClientSecretCredential(
    tenant_id=TENANT_ID,
    client_id=CLIENT_ID,
    client_secret=CLIENT_SECRET
)
client = LogsQueryClient(credential)

# From vmmonitor.py:329
credentials = SessionCredentials(gcp_account)
client = logging_v2.Client(credentials=credentials, project=project_id)