Azure Automation Account - Runbook Job Status

Automation Account Runbook Status

Query

AzureDiagnostics
| where Category == 'JobLogs'
| extend RunbookName = RunbookName_s
| project TimeGenerated,RunbookName,ResultType,CorrelationId,JobId_g
| summarize StartTime = minif(TimeGenerated,ResultType == 'Started'),EndTime = minif(TimeGenerated,ResultType in ('Completed','Failed','Failed')),
Status = tostring(parse_json(make_list_if(ResultType,ResultType in ('Completed','Failed','Stopped')))[0]) by JobId_g,RunbookName
| extend DurationSec = datetime_diff('second', EndTime,StartTime)
| join kind=leftouter (AzureDiagnostics
| where Category == "JobStreams"
| where StreamType_s == "Error"
| summarize TotalErrors = dcount(StreamType_s) by JobId_g, StreamType_s)
on $left. JobId_g == $right. JobId_g
| extend HasErrors = iff(StreamType_s == 'Error',true,false)
| project StartTime, EndTime, DurationSec,RunbookName,Status,HasErrors,TotalErrors,JobId_g

About this query

Azure Automation Account - Runbook Job Status

Query Information

Description

Use the following query to get the status of your Automation Account Runbook jobs

References

Microsoft Sentinel

Explanation

This KQL (Kusto Query Language) query is designed to retrieve and summarize the status of runbook jobs from an Azure Automation Account. Here's a simplified explanation of what the query does:

Data Source: The query starts by accessing the AzureDiagnostics table, specifically looking for entries where the Category is 'JobLogs'. This table contains logs related to the execution of runbook jobs.
Data Extraction: It extracts relevant fields such as TimeGenerated, RunbookName, ResultType, CorrelationId, and JobId_g.
Job Status Summary:
- It calculates the start time of each job by finding the earliest TimeGenerated where ResultType is 'Started'.
- It determines the end time by finding the earliest TimeGenerated where ResultType is 'Completed', 'Failed', or 'Stopped'.
- It identifies the job status ('Completed', 'Failed', or 'Stopped').
Duration Calculation: The query calculates the duration of each job in seconds by finding the difference between the end time and start time.
Error Analysis:
- It performs a left outer join with the same AzureDiagnostics table, this time looking for entries in the 'JobStreams' category where StreamType_s is 'Error'.
- It counts the total number of errors for each job.
Final Output: The query produces a summarized output that includes:
- Start and end times of the job.
- Duration of the job in seconds.
- Name of the runbook.
- Status of the job.
- Whether the job encountered errors.
- Total number of errors.
- Job ID.

This query helps users monitor and analyze the performance and issues of their Azure Automation runbook jobs by providing a clear summary of job statuses and error occurrences.

Details

Alex Verboon

Released: April 16, 2026

Tables

AzureDiagnostics

Keywords

AzureAutomationAccountRunbookJobsStatusLogsAnalytics

Operators

whereextendprojectsummarizeminifintostringparse_jsonmake_list_ifdatetime_diffjoinkindiffdcount

Actions

GitHub

KQL Search