Azure automation Jobs that completed with errors - JobStreams data not forwarded to Azure Monitor

Question

Background:

I have an Automation Account with one Runbook configured.

The runbook initiates a job which is a one PowerShell line that is syntactically wrong on purpose (Write-Hos "Hello error").

The typical result of this runbook running is a job with the following details:

I have one "Diagnostic setting" rule that is forwarding JobLogs, JobStreams, and Metrics to a Log Analytics Workspace.

I am using a system-assigned identity for this setup with no additional configuration to this identity other than enabling it when the automation account was created.

The problem

The ultimate goal is run this built-in query Runbook completed successfully with errors which will list all runbook jobs that are Completed (Job status = "Complete") but the job encountered errors. (To my understanding "Job Streams" refer to the detailed logs generated during the execution of a runbook job. Which is different than the "Job Status")

This is the query details as per Azure built-in Runbook completed successfully with errors query:

AzureDiagnostics 
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobStreams" and StreamType_s == "Error" 
| project TimeGenerated , RunbookName_s , StreamType_s , _ResourceId , ResultDescription , JobId_g 

This however, doesn't return any data. After investigating the issue, I think the problem lies with the fact that the "AzureDiagnostics" table which stores this data, simply doesn't have it:

• I don't have any columns for job streams, such as StreamType_s.
• I don't have a value of "JobStreams" for the Category column.

I am not sure what am I missing.

Answer 1

Use below KQL query that provides the details about the completed runbook job status with errors.

AzureDiagnostics 
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobStreams" and StreamType_s == "Error" 
| project TimeGenerated , RunbookName_s , StreamType_s , _ResourceId , JobId_g

Path: Automation account >> Monitoring >> Logs >> Automation Jobs

Use below query if you want to retrieve only the job logs with result type as failed.

AzureDiagnostics 
| where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and ResultType == "Failed"
| project TimeGenerated , RunbookName_s , ResultType , JobId_

Refer MSDoc for the relevant information.

Answer 2

I don't know the exact specifics, but potentially it could of have been one of the following:

1. Issues with the Diagnostics setting instance.
2. Timing issue.

Details:

I deleted the original Diagnostics setting rule that I have configured on the automation account and simply recreated it under a different name (just being superstitious) then I ran the runbook once (which created a job). I believe this was 5 - 10 minutes after I created the new Diagnostic setting.

The JobLogs data came in much quicker than JobStreams data (when I trying to query the workspace logs about 5 minutes after the job had completed).

While keep refreshing the query editor and running the same query again:

AzureDiagnostics 
| where ResourceProvider == "MICROSOFT.AUTOMATION"

The JobStreams came in (I'd say roughly between 15-30 minutes after the job had completed)

Although I ran around 4 jobs on the old instance of Diagnostic settings that I deleted, which some of them should of have been captured (if it was a timing issue), nonetheless, I won't rule that out.

The solution to me (and by observation but rather than fact) was to delete the old Diagnostic settings rule and create recreate it.