armclient login
$api = "2015-03-20"
#getSubscription
$allSubscriptions = armclient get /subscriptions?api-version=$api | out-string | ConvertFrom-Json
$uiPrompt = "Select a subscription.`n"
$count = 1
foreach ($subscription in $allSubscriptions.value) {
$uiPrompt += "$count. " + $subscription.displayName + "(" + $subscription.subscriptionId + ")`n"
$count++
}
$answer = (Read-Host -Prompt $uiPrompt) - 1
$subscription = $allSubscriptions.value[$answer].subscriptionId
#Write-Host $subscription
#getWorkspace
$allWorkspaces = armclient get /subscriptions/$subscription/providers/Microsoft.OperationalInsights/workspaces?api-version=$api | out-string | ConvertFrom-Json
$uiPrompt = "Select a workspace.`n"
$count = 1
foreach ($workspace in $allWorkspaces.value) {
$uiPrompt += "$count. " + $workspace.name + "(" + $workspace.id + ")`n"
$count++
}
$answer = (Read-Host -Prompt $uiPrompt) - 1
$workspace = $allWorkspaces.value[$answer].name
if ($allWorkspaces.value[$answer].id -notcontains $resourcegroup)
{
$WSId=$allWorkspaces.value[$answer].id
$tempvar=$WSId.Substring($WSId.IndexOf("resourcegroups")+15,$WSId.Length-$WSId.IndexOf("resourcegroups")-15)
$resourcegroup=$tempvar.Substring(0,$tempvar.IndexOf("/"))
Write-Host "New resource group determined: $resourcegroup"
}
#list of search queries
$searchList = @(
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'% Processor is greater than 75%', 'Query':'Type=Perf ObjectName=Process CounterName= \`"Processor Time\`" | measure avg(Average) by Computer | where AggregatedValue > 75 ' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Recovery Action Failed', 'Query':'Type=Event Source=Microsoft-Exchange-ManagedAvailability EventLog= \`"Microsoft-Exchange-ManagedAvailability/RecoveredActionLogs\`" '}",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'MS Exchange Frontend Transport Service has not been running for a period of time', 'Query':'Type=Event EventLog=Application Source= \`"MSExchangeFrontEndTransport\`" ' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'The connection between the Client Access Server and the Mailbox server failed', 'Query':'Type=Event EventLog=Application Source=ActiveSync EventID=1022' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Availability service could not successfully send a proxy Web request', 'Query':'Type=Event EventLog=Application EventID=4002 Source = \`"MSExchange Autodiscover\`" '}",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'A setting in the Web.config file was not valid and has been reset to the default value', 'Query':'Type=Event EventLog=Application EventID=1033 Source=ActiveSync' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Percentage of the free usable space on my disk drive', 'Query':'Type=Perf ObjectName=\`"LogicalDisk\`" CounterName= \`"% Free Space\`" ' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Free Disk Space is less than 10%', 'Query':'Type=Perf ObjectName=\`"LogicalDisk\`" CounterName= \`"% Free Space\`" |measure avg(Average) by Computer | where AggregatedValue < 10' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Average number of bytes transferred to or from the disk during write or read operations', 'Query':'Type=Perf ObjectName=\`"LogicalDisk\`" CounterName= \`"Avg. Disk Bytes/Transfer\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Amount of Virtual memory in use', 'Query':'Type=Perf ObjectName=\`"Memory\`" CounterName= \`"% Committed Bytes in Use\`" | measure avg(Average) by Computer' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Amount of physical memory avaiable for running processes', 'Query':'Type=Perf ObjectName=\`"Memory\`" CounterName= \`"Available MBytes\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Percentage of elapsed time processor spends in User Mode', 'Query':'Type=Perf ObjectName=\`"Processor\`" CounterName= \`"% User Time\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Rate at which bytes are sent and received over each adapter', 'Query':'Type=Perf ObjectName=\`"Network Interface\`" CounterName= \`"Bytes Total/Sec\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'LDAP Read Time is beyond the warning threshold', 'Query':'Type=Perf ObjectName=\`"MSExchange ADAccess Domain Controllers\`" CounterName= \`"LDAP Read Time\`" | measure avg(Average) by Computer | where AggregatedValue > 50' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'LDAP Search Time is beyond the warning threshold', 'Query':'Type=Perf ObjectName=\`"MSExchange ADAccess Domain Controllers\`" CounterName= \`"LDAP Search Time\`" | measure avg(Average) by Computer | where AggregatedValue > 50' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Exchange ActiveSync could not access a mailbox on a Mailbox server because the Mailbox server is offline', 'Query':'Type=Event EventLog=Application EventID=1023 Source=ActiveSync' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Length of output packet queue in packet', 'Query':'Type=Perf ObjectName=\`"Network Interface\`" CounterName= \`"Output Queue Length\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Memory leak occurs', 'Query':'Type=Perf ObjectName=\`"Process\`" CounterName= \`"Private Bytes\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Client RPC Average Latencies are very high', 'Query':'Type=Perf ObjectName=\`"MSExchange RpcClientAccess\`" CounterName= \`"RPC Averaged Latency\`" |measure avg(Average) by Computer | where AggregatedValue > 250' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Getting data on Message Tracking Report', 'Query':'Type=Perf ObjectName=\`"MSExchange Message Tracking\`" CounterName= \`"Get-MessageTRackingReport Task Executed/Sec\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'High Message Queuing to Hub Transport servers', 'Query':'Type=Perf ObjectName=\`"MSExchangeIS\`" CounterName= \`"Messages Queued for Submission\`" |measure avg(Average) by Computer | where AggregatedValue > 20' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Exchange transport service is rejecting message submissions', 'Query':'Type=Event EventLog=Application EventID=15007 Source=MSExchangeTransport ' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Outlook Web Access was unable to read or update config settings', 'Query':'Type=Event EventLog=Application EventID=64 Source= \`"MSExchange OWA\`"' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Exchange Direct Push has detected that the config value for the min heartbeat interval is too low', 'Query':'Type=Event EventLog=Application EventID=1011 Source=ACtiveSync' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Unable to add an email address because it is invalid', 'Query':'Type=Event EventLog=Application EventID=1 Source=InternetProxy' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'The database engine lost one page of corrupted data', 'Query':'Type=Event EventLog=Application EventID=500 Source=ESE' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'There is no available Hub transport server in the local site', 'Query':'Type=Event EventLog=Application EventID=1008 Source=MSExchangeMailSubmission' }",
"{'etag': 'W/`"datetime\'2015-09-22T23%3A35%3A35.3182423Z\'`"', 'properties': { 'Category': 'MS Exchange ', 'DisplayName':'Outlook Web Access is not available for one of the mailboxes in a mailbox database', 'Query':'Type=Event EventLog=Application EventID=57 Source=MSExchangeOWA' }"
)
$myId = 0
foreach ($query in $searchList) {
$url = "/subscriptions/$subscription/resourceGroups/$resourcegroup/providers/Microsoft.OperationalInsights/workspaces/$workspace/savedsearches/exchange$myId" + "?api-version=$api"
armclient put $url $query
$myId++
}