Recently one of the Turbo360 users asked about how to monitor for Log Analytics data retention settings with Turbo360. In the below video I show how you can do this.
Queries
Below is the query I used to visualize the workspaces and their settings
resources
| where ['type'] == "microsoft.operationalinsights/workspaces"
| extend retentionInDays = tostring(properties.retentionInDays)
| extend dailyQuotaGb = toint(properties.workspaceCapping.dailyQuotaGb)
| order by dailyQuotaGb desc
| project id, name, resourceGroup, subscriptionId, retentionInDays, dailyQuotaGb
//Add resource group or subscription filters below if needed
//| where subscriptionId == ""
//| where resourceGroup == ""
Below is the query I used in monitoring for any workspaces which have a daily quota bigger than 25 GB or if its not set
resources
| where ['type'] == "microsoft.operationalinsights/workspaces"
| extend dailyQuotaGb = toint(properties.workspaceCapping.dailyQuotaGb)
| order by dailyQuotaGb desc
| project id, name, resourceGroup, subscriptionId, dailyQuotaGb
| where dailyQuotaGb > 25
or dailyQuotaGb < 0
| summarize count()Below is the query I used to monitor any workspaces which have a retention period of longer than 90 days
resources
| where ['type'] == "microsoft.operationalinsights/workspaces"
| extend retentionInDays = toint(properties.retentionInDays)
| order by retentionInDays desc
| project id, name, resourceGroup, subscriptionId, retentionInDays
| where retentionInDays > 90
| summarize count()
