You are the IT administrator for an Azure subscription that contains 20 virtual machines (VMs).
You need to write a Log Analytics query to determine which VMs have not been responsive within the past hour.
How should you complete the query?
You should use the following query:
Heartbeat | where TimeGenerated > ago(1h)
This query finds all computers that have had a heartbeat within the past hour. Computers send a heartbeat to let Azure know that they are responsive. The ago(1h) means the timestamp is one hour ago. If TimeGenerated is greater than that timestamp, the heartbeat occurred within the past hour.
You should not use Perf as a source. This source looks at performance counters. In this scenario, you need to search the Heartbeat source, not performance counters.
You should not use the following query:
Heartbeat | where TimeGenerated < ago(1h)
This query finds all computers that have sent a heartbeat before one hour ago.