Microsoft Azure – VMs Patch Update Summary by Installation Status

Here we will be using the KQL Query to find the Status of Patch Updates by Installation Status. Use Azure Log Analytics Workspace or Azure Workbook to run the queries in this article.

KQL Query 1: Use the below log analytics log query to get the details of resources where Installation Status is Succeeded.

UpdateRunProgress
| summarize arg_max(TimeGenerated, Title, InstallationStatus, Resource, UpdateRunName) by UpdateId
| project TimeGenerated, Resource, Title, InstallationStatus, UpdateRunName
| where InstallationStatus == "Succeeded"

This query returns the results of Succeeded Patch Updates.

Output:

In a similar, way you can perform for NotStarted, NotIncluded, Failed. 

Refer to the below Queries to get the reports.

KQL Query 2: Use the below log analytics log query to get the details of resources where Installation Status is Not Started.

UpdateRunProgress
| summarize arg_max(TimeGenerated, Title, InstallationStatus, Resource, UpdateRunName) by UpdateId
| project TimeGenerated, Resource, Title, InstallationStatus, UpdateRunName
| where InstallationStatus == "NotStarted"

This query returns the results of Patch Not Started resources.

Output:

KQL Query 3: Use the below log analytics log query to get the details of resources where Installation Status is Not Included.

UpdateRunProgress
| summarize arg_max(TimeGenerated, Title, InstallationStatus, Resource, UpdateRunName) by UpdateId
| project TimeGenerated, Resource, Title, InstallationStatus, UpdateRunName
| where InstallationStatus == "NotIncluded"

This query returns the results of Patch Not Included resources.

Output:

KQL Query 4: Use the below log analytics log query to get the details of resources where Installation Status is Failed.

UpdateRunProgress
| summarize arg_max(TimeGenerated, Title, InstallationStatus, Resource, UpdateRunName) by UpdateId
| project TimeGenerated, Resource, Title, InstallationStatus, UpdateRunName
| where InstallationStatus == "Failed"

This query returns the results of Patch Failed resources.

Output: