Select Page

More Kusto

You can tell where I’ve been working by the Kusto queries against Azure Resource Graph that I leave behind.

All Azure VNets and subnets, with subnet details:

// get all Azure VNETS and SUBNETS with associated subnets

resources

| join kind=leftouter (ResourceContainers | where type==’microsoft.resources/subscriptions’ | project SubName=name, subscriptionId) on subscriptionId

| where type == “microsoft.network/virtualnetworks”

| mv-expand subs=properties.subnets

| extend subnetname = subs.name

| extend subnetprefix= subs.properties.addressPrefix

| extend vnetprefix = substring(tostring(properties.addressSpace.addressPrefixes),2,strlen(tostring(properties.addressSpace.addressPrefixes))-4)

| project SubName, resourceGroup, name, vnetprefix, subnetname, subnetprefix

| sort by SubName, resourceGroup asc, name

This one for pulling back network security groups and metadata (this was originally at Thomas BalkestĂ„hl’s blog) – tidied up:

Resources

| where type =~ “microsoft.network/networksecuritygroups”

| join kind=leftouter (ResourceContainers | where type==’microsoft.resources/subscriptions’ | project SubName=name, subscriptionId) on subscriptionId

| mv-expand rules=properties.securityRules

| extend direction = tostring(rules.properties.direction)

| extend priority = toint(rules.properties.priority)

| extend description = rules.properties.description

| extend destprefix = rules.properties.destinationAddressPrefix

| extend destport = rules.properties.destinationPortRange

| extend sourceprefix = rules.properties.sourceAddressPrefix

| extend sourceport = rules.properties.sourcePortRange

| extend subnet_name = split((split(tostring(properties.subnets), ‘/’))[10], ‘”‘)[0]

| project SubName, resourceGroup, subnet_name, name, direction, priority, destprefix, destport, sourceprefix, sourceport, description

| sort by SubName, resourceGroup asc, name, direction asc, priority asc

COVID – week 53 – Mar 15 – Mar 21 2021

Weekend – Italy, Germany, France all picking up for another wave. I think this goes back to the earliest days (a year ago!) – the hammer and the dance. This is going to be the Spring story – racing to produce, ship and deliver vaccines across the globe; and getting enough people immunised.

Casing surging across Europe. JHU/The Guardian graphic.

image

Washington State weekly recap from The Seattle Times. Positive tests have ticked back up.

Friday – The “people we know who have been vaccinated” list keeps growing. Friends, family, colleagues. All positive. 100M shots in 58 days; weeks ahead of schedule. On the downside – positive cases are picking up; lots of B117 variant in the US – and it’s spreading just as states open up too early. It’s a race to vaccinate “most” before the next wave comes through.

Thursday – vaccine manufacturing shortages. Hoarding/export bans for vaccine.

Wednesday – Looking back at last year; and there was absolute panic: blueprints for ventilators being sent to industry, closing borders, exams being cancelled, schools closing.

Tuesday – AstraZeneca vaccine “safe”, another wave of infections in France.

Monday – The blog rolls around. Officially more than a year of weekly synopsis.

A reminder of “this time last year” and the panic buying:

IMG_20200404_104516IMG_20200319_125930IMG_20200319_125848IMG_20200322_121951IMG_20200312_171617IMG_20200303_195818

The Guardian The Seattle Times
15 Mar here here
16 Mar here here
17 Mar here here
18 Mar here here
19 Mar here here
20 Mar here here
21 Mar here here

https://www.theguardian.com/world/series/coronavirus-live

https://www.seattletimes.com/tag/coronavirus/

COVID – week 52 – Mar 8 – Mar 14 2021

Weekend – Almost 3MM vaccinations in the US yesterday. Phenomenal rate. This is the only way to beat the variants; run faster and vaccinate. Plenty of concern about the 50% who say they won’t get the vaccine however. 🙁 100M vaccinated. Concerns in Europe on blood clot risk of AstraZeneca vaccine.

Weekly graph from The Seattle Times. Positive test rate is picking up slightly. 20% with first dose, 11% with two.

Friday – All US adults eligible for vaccine by 1 May, “independence from Covid 4th July”.

Thursday – real concern in Brazil over spiraling cases and overrun hospitals.

Wednesday – Mixed directions in Europe, relaxed rules vs. increased lockdown and a “fourth wave”.

Tuesday – some excitement – as “extra” vaccines are being given at the close of day in many locations in Washington. We made appointments, then were told there was an error. Mid-March – and we must be just weeks away from open vaccinations.

Monday – the year rolls over. A year, 52 weeks, since I started the daily updates on COVID and capturing the news summaries for posterity. So what are my main observations? Firstly I’m glad that The Guardian, The Seattle Times and many other media outlets are still summarising the pandemic news on a daily basis. The BBC news website stopped this in the summer. Secondly – there’s sadly little shock value of dozens, hundreds or thousands dying on a daily basis. >500K deaths in the US – and that number really doesn’t resonate with many. Thirdly – everything is political. Masks, eating out, return to school, vaccination.

The Guardian The Seattle Times
8 Mar here here
9 Mar here here
10 Mar here here
11 Mar here here
12 Mar here here
13 Mar here here
14 Mar here here

https://www.theguardian.com/world/series/coronavirus-live

https://www.seattletimes.com/tag/coronavirus/

COVID – week 51 – Mar 1 – Mar 7 2021

Weekend – 28M fully vaccinated in the US (two shots),  WA is still slowly, but surely getting vaccines out. Almost a third of the UK have received at least one vaccine dose. “Hundreds of deaths per day” across European countries; sadly that isn’t newsworthy after the brutal waves of the past year. 90M vaccines have been delivered in theUS, including over 2.4M yesterday.

UK numbers from The Guardian. That massive peak, and the climb into it, seems so long ago.

image

Weekend numbers from The Seattle Times. A year on – they are still doing a daily roundup and regular stats.

Friday – @YearCovid tweeting last years news.

Thursday – last day in the office one year ago. The start of “vaccine passports” and “vaccinated only” events.

Wednesday – a year ago was the week of panic buying and stripped shelves.

Tuesday – amidst positive talk about vaccinations and decreasing positive tests and a decline in deaths; there are still huge risks of a fourth wave.

Monday – a year since the first COVID death in the US and in Washington State. It’s still a race against time – vaccinate and beat the variants. CDC/NIH tracking five variants across the US.

The Guardian The Seattle Times
1 Mar here here
2 Mar here here
3 Mar here here
4 Mar here here
5 Mar here here
6 Mar here here
7 Mar here here

https://www.theguardian.com/world/series/coronavirus-live

https://www.seattletimes.com/tag/coronavirus/

More Kusto – The Everything Script

“The get everything about virtual machines” script.

This brings back pretty much everything – sub second queries. Far, far easier than the old methods using PowerShell.

Resources

| where type =~ ‘microsoft.compute/virtualmachines’

| extend nics=array_length(properties.networkProfile.networkInterfaces)

| mv-expand nic=properties.networkProfile.networkInterfaces

| where nics == 1 or nic.properties.primary =~ ‘true’ or isempty(nic)

| project subscriptionId, resourceGroup, vmId = id, vmName = name, vmSize=tostring(properties.hardwareProfile.vmSize), nicId = tostring(nic.id),location, tags.itowner, tags.businessowner, tags.application, tags.costcenter, tags.supportgroup, tags.[‘project’], powerstate=properties.extended.instanceView.powerState.displayStatus, os=properties.storageProfile.osDisk.osType, sku=properties.storageProfile.imageReference.sku

| join kind=leftouter (ResourceContainers | where type==’microsoft.resources/subscriptions’ | project SubName=name, subscriptionId) on subscriptionId

| join kind=leftouter (

  Resources

  | where type =~ ‘microsoft.network/networkinterfaces’

  | extend ipConfigsCount=array_length(properties.ipConfigurations)

  | mv-expand ipconfig=properties.ipConfigurations

  | where ipConfigsCount == 1 or ipconfig.properties.primary =~ ‘true’

  | project nicId = id, privIP = tostring(ipconfig.properties.privateIPAddress)) on nicId

| project-away subscriptionId, subscriptionId1, vmId, nicId, nicId1