Document Details
How To Configure Shir For Log Analytics Collection
❌
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Bias Types:
⚠️
windows_first
⚠️
missing_linux_example
⚠️
windows_tools
Summary:
The documentation page demonstrates a Windows bias by exclusively referencing Windows tools and workflows (such as Event Viewer logs and Windows Performance Counters) for log analytics collection. It provides detailed steps and references for Windows environments, with no mention of Linux-based SHIR deployments or equivalent Linux monitoring tools. All examples and screenshots are Windows-specific, and Linux scenarios are not addressed.
Recommendations:
- Add a section describing how to instrument SHIR running on Linux hosts, including installation of the Log Analytics agent for Linux.
- Provide equivalent examples for collecting syslog and Linux performance counters (e.g., using collectd or sysstat) and how to configure them for Log Analytics.
- Reference Azure documentation for installing and configuring the Log Analytics agent on Linux, and link to relevant articles.
- Include screenshots or CLI examples for Linux environments (e.g., using Bash or shell commands) alongside Windows GUI instructions.
- Clarify in the prerequisites and scenario sections whether Linux-based SHIR is supported or not, and if not, explicitly state this to avoid confusion.
Create pull request
Scan History
| Date | Scan ID | Status | Bias Status |
|---|---|---|---|
| 2025-07-12 23:44 | #41 | in_progress | ❌ Biased |
| 2025-07-12 00:58 | #8 | cancelled | ✅ Clean |
| 2025-07-10 05:06 | #7 | processing | ✅ Clean |
Flagged Code Snippets
Perf
| where TimeGenerated >= ago(24h)
and ObjectName == "Network Adapter"
and InstanceName == "Mellanox ConnectX-4 Lx Virtual Ethernet Adapter"
and CounterName == "Bytes Received/sec"
Perf
| where TimeGenerated >= ago(24h)
and ObjectName == "Network Adapter"
and InstanceName == "Mellanox ConnectX-4 Lx Virtual Ethernet Adapter"
| project TimeGenerated, Computer, ObjectName, InstanceName, CounterName, CounterValue
| summarize percentile(CounterValue, 95) by bin(TimeGenerated, 30m), Computer, ObjectName, InstanceName, CounterName
let pObjectName = "Memory"; // Required to select the right counter
let pCounterName = "Available MBytes"; // Required to select the right counter
Perf
| where Type == "Perf" and ObjectName == pObjectName and CounterName == pCounterName
| project TimeGenerated, Computer, CounterName, CounterValue
| order by TimeGenerated asc
| summarize Value=max(CounterValue) by CounterName, TimeStamps=TimeGenerated