turbot/azure_insights

Query: compute_virtual_machine_scale_set_logging_disabled

Usage

powerpipe query azure_insights.query.compute_virtual_machine_scale_set_logging_disabled

SQL

with logging_details as (
select
distinct a.id as vm_scale_set_id
from
azure_compute_virtual_machine_scale_set as a,
jsonb_array_elements(extensions) as b
where
(b ->> 'Publisher' = 'Microsoft.Azure.Diagnostics'
and b ->> 'ExtensionType' = 'IaaSDiagnostics'
or
(b ->> 'Publisher' = any(ARRAY ['Microsoft.OSTCExtensions', 'Microsoft.Azure.Diagnostics']))
and b ->> 'ExtensionType' = 'LinuxDiagnostic')
)
select
count(*) as value,
'Logging Disabled' as label,
case when count(*) = 0 then 'ok' else 'alert' end as type
from
azure_compute_virtual_machine_scale_set as a
left join logging_details as b on a.id = b.vm_scale_set_id
where
b.vm_scale_set_id is null;

Dashboards

The query is used in the dashboards: