turbot/azure_insights

Query: compute_virtual_machine_scale_set_logging_disabled

Usage

powerpipe query azure_insights.query.compute_virtual_machine_scale_set_logging_disabled

SQL

with logging_details as (
select
distinct a.id as vm_scale_set_id
from
azure_compute_virtual_machine_scale_set as a,
jsonb_array_elements(extensions) as b
where
(
b ->> 'Publisher' = 'Microsoft.Azure.Diagnostics'
and b ->> 'ExtensionType' = 'IaaSDiagnostics'
or (
b ->> 'Publisher' = any(
ARRAY [ 'Microsoft.OSTCExtensions',
'Microsoft.Azure.Diagnostics' ]
)
)
and b ->> 'ExtensionType' = 'LinuxDiagnostic'
)
)
select
count(*) as value,
'Logging Disabled' as label,
case
when count(*) = 0 then 'ok'
else 'alert'
end as type
from
azure_compute_virtual_machine_scale_set as a
left join logging_details as b on a.id = b.vm_scale_set_id
where
b.vm_scale_set_id is null;

Dashboards

The query is used in the dashboards: