AZ-104 Practice Question 67: KQL Heartbeat Missing VMs
Microsoft Azure Administrator Associate (AZ-104) · Test 7 · question 7 of 10
An administrator wants a Log Analytics query that lists the machines that have stopped reporting. A machine is considered down if its most recent Heartbeat record is older than 15 minutes.
Which query returns those machines?
Show answer and explanation
Answer:
The agent sends a Heartbeat record about once a minute. To find machines that have gone quiet, the query must look at each machine's latest record: summarizing by Computer with max(TimeGenerated) gives the last heartbeat for each machine, and filtering for a value older than 15 minutes leaves exactly the machines that have stopped reporting.
Option A filters individual records. Every machine that has ever reported has old heartbeats, so healthy machines are returned as well, and a machine that is down cannot be told apart.
Option B returns the opposite set, the machines that did report in the last 15 minutes.
Option C looks at performance counters. A counter value of zero says nothing about whether the machine is alive (an idle machine can report zero), and a machine that is down produces no Perf records at all, so it never appears in the results.
Reference: Heartbeat table reference