Microsoft Azure Operational Insights Preview Series – System Update Assessment (Part 1)

As you’ve probably heard from TechEd North America 2014 System Center Advisor has been restarted. What this mean? System Center Advisor gained some new and very improved functionalities. We have the old module Configuration Assessment and 5 new modules called Intelligence Packs:

The new System Center Advisor is currently in Limited Preview which means it is still not final version and this not final version is offered to a certain amount of customers/users. These slots were filled during TechEd. As you from the screenshot even the Security Intelligence Pack is not offered to those customers/users in Preview yet. With those blog series I want to give you a glimpse on the four available Intelligence Packs so when System Center Advisor reaches public availability to decide whether to try it or not.

Let’s start first with System Update Assessment Intelligence Pack.

When you open the Overview page for Advisor you will see tile for every Intelligence Pack you’ve enabled. That tile show you a pre-defined preview of information for that particular Intelligence Pack. To get more information you need to click on the tile. Let’s click on the System Update Assessment tile:

This drills down to more tiles and more information. The information here is also somehow too general but idea is to see what information is being gather and to use that information for queries. As you can see from the screenshot on the right side we have some help to make these queries. So what exactly are these queries. The queries in Advisor are like custom reports, views or searches that you can construct fairly easy. I bet you’ve had situation where you’ve wanted to create some custom report or a view that you want to use just once but the investment for that wasn’t worth it or you’ve wanted to create a report or a view but it was too hard or confusing. These queries are something similar to SQL OLAP cubes or Power BI for Office 365 and if you are familiar with these technologies you will know how much easier is to get information from them there compared to SQL Reporting Services. The tiles and the result on the Updates page are all clickable and will lead you to the Search page where you will see the constructed query and the information that will derive from it. Let’s click on Missing Critical updates to see what that will show:

As you can see we have 3 critical updates that are missing on a server/s.

Now we can continue to get more information easily. For example I want to know show not only Critical Updates that are missing but also Security Updates and I also want to see the Product so I simply change the query from:

Type:RequiredUpdate UpdateClassification:”Critical Updates” | select UpdateTitle,KBID,UpdateClassification,UpdateSeverity,PublishDate,Server

to

Type:RequiredUpdate UpdateClassification:”Critical Updates” or UpdateClassification:”Security Updates”  | select UpdateTitle,KBID,UpdateClassification,UpdateSeverity,PublishDate,Server,Product

We can got even go more complex by wanting to find from which Product are the most missing updates and their count:

Type:RequiredUpdate UpdateClassification:”Critical Updates” or UpdateClassification:”Security Updates”  | select UpdateTitle,KBID,UpdateClassification,UpdateSeverity,PublishDate,Server | measure count() as count by Product

As you can see we can have very powerful results with simple queries.

When you get the chance to try System Center Advisor think of what information you want to find out about updates on servers and than try to expose that information trough queries. There is more in queries than what I’ve shown here but I will save some of the rest for the next Intelligence Packs that I will show. And if you’ve wondered how I knew how to construct queries there is documented syntax here.

Hope this was helpful for you.