log analytics Archives - Apostolidis Cloud Corner

Monitor & Dependencies agents at once!

Pantelis Apostolidis — Fri, 26 Apr 2024 07:30:11 +0000

Download the two agents from the links below:

The Monitor agent needs extravtion. To extract use the command: MMASetup-.exe /c /t:

e.g.: MMASetup-AMD64.exe /c /t:C:\Temp

Add all files to a network share like: \\server\share\

φτιάξε ένα bat or cmd file, π.χ. setupagents.bat με το παρακάτω περιεχόμενο αλλά βάλε τα δικά σου shares, workspace ID & Key:

create a bat or cmd file, e.g. setupagents.bat and add the below content. Change the share link, the Workspace ID and Key:

net use y: \\server\share\

y:\Setup.exe /qn NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE=0 OPINSIGHTS_WORKSPACE_ID="" OPINSIGHTS_WORKSPACE_KEY="" AcceptEndUserLicenseAgreement=1

y:\InstallDependencyAgent-Windows.exe /S /RebootMode=manual

net use y: /delete

For example, I created the setupagents.bat, and added the files to the network share \\dcvm\Temp . The content of my setupagents.bat is:

net use y: \\dcvm\Temp

y:\Setup.exe /qn NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE=0 OPINSIGHTS_WORKSPACE_ID="b987ae35-b7e3-44ba-bd27-000000000000" OPINSIGHTS_WORKSPACE_KEY="OZz8YN5A12biINsMbja9PHkZLDdYNNZEw+QDIsAmi0ys/2+000000000000==" AcceptEndUserLicenseAgreement=1

y:\Temp\InstallDependencyAgent-Windows.exe /S /RebootMode=manual

net use y: /delete

After running the setupagents.bat, both agents are installed. You can check at the programs and features:

At the control panel the Microsoft Monitoring Agent will appear and open it to check that it is connected to y our Log Analytics Workspace.

Here is a list of sample Log Search commands for the dependency analysis:

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Monitor & Dependencies agents at once! appeared first on Apostolidis Cloud Corner.

Azure Monitor for VMs – Health, Performance & Service Map

Pantelis Apostolidis — Thu, 07 Feb 2019 13:58:51 +0000

Get real insights about your Windows and Linux VMs & VMSSs performance and their dependencies with Azure Monitor. Integrate with Log Analytics for even more in depth analysis and retain the data over time. Health, Performance & Service Map of your VM in a dashboard.

Deploy to Single VM

For a single VM, go to the VMs blade, scroll down to the “Monitoring” section, select “Insights” and press “Try now”

The Azure Monitor Insights Onboarding wizard will open. If your VM is already onboard at a Log Analytics workspace just click Enable. Otherwize select a Log Analytics workspace or create one.

You will start seeing data form the VM in about 20-30 minutes.

Deploy to multiple VMs using Azure Policy

For deploying to multiple VMs, the easiest way is to use Azure Policy

Go to the Azure Policy, select Assignments and press “Assign initiative”

The first option is the Scope. Press the three dots “…” at the Scope field. You can choose a a Management Group, a Subscription or a Resource Group. So if you just select a Management Group (And don’t select subscription and resource group), this policy will apply to all Subscriptions under the Management Group and of course to all resources of the subscription. If you choose a Subscription (and don’t select a resource group then the policy will apply to all resources of the subscription. Finally if you choose a resource group then the policy will apply only to this resource group. Later we will see how to select specific VMs in the Subscription or Resource group.

After selecting the Scope you can add exclusions. There you can check the VMs you don’t want this policy to apply.

The next step is to select the Policy. At the BASICS section, press the three dots “…” near the “Initiative definition” and find the “Enable Azure Monitor for VMs”

Next step is to configure the Parameters. There select the Log Analytics workspace that the VM will onboard, or create a new one. Optionally you can provide a list of VMs instead of adding all of them

Finally press Apply. Back at the Azure Policy main menu you will see the new Definition Assignment.

View the Health / Performance / Service Map of the VMs

To view the Azure Monitor of the VMs, go to the VM that you have enabled Insights, select the Insights blade and you will be able to see the health status not only for the common CPU. Memory, Disk,

But also for the services that run inside the VM and the Azure Monitor discovered.

By clicking on any service you will have a list of all logs of this service

At the performance section you have the ability to select time range and have performance analytics for a requisted period of time

Finally at the MAp, you have a service map of the services and ports that are open and listening

Product Documentation: https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Monitor for VMs – Health, Performance & Service Map appeared first on Apostolidis Cloud Corner.

Serverless Computing | Email Report Azure WAF Logs

Pantelis Apostolidis — Fri, 28 Dec 2018 13:50:55 +0000

At this post, we will create a Logic App that will query the Log Analytics workspace for the WAF logs of the last 24 hours and send the results in an email, using a free SendGrid account.

A Web Application Firewall protects your application from common web vulnerabilities. Azure provides enterprise grade Web Application Firewall through the Application Gateway. You can read more at my previous post: https://www.e-apostolidis.gr/microsoft/azure/protect-your-web-application-with-azure-application-gateway-waf/

Use Log Analytics to Query the WAF Logs

The Application Gateway WAF sends its logs to the Log Analytics workspace. You can see them using a typical query like the below, that will list all events at the past 24 hours.

AzureDiagnostics | where Resource == “PROWAF” and OperationName == “ApplicationGatewayFirewall” | where TimeGenerated > ago(24h) | summarize count() by TimeGenerated, clientIp_s , TimeGenerated , ruleId_s , Message , details_message_s , requestUri_s, details_file_s , hostname_s

You can save the query by clicking the Save button and give it a name and a Category.

We can send those logs as email by using an Azure Logic App and a SendGrid account. You can see how to create a SendGrid free account at my previous post: https://www.e-apostolidis.gr/microsoft/azure/azure-free-smtp-relay-using-sendgrid/

Create a Logic App

From the portal.azure.com, Create a resource and write “logic app”, click the “Logic App”and press “Create”

At the Logic App creation wizard add Name, subscription, resource group, location and press Create

Next the Logic App will be created. Open it and from the Logics App Designer select the “Recurrence” common trigger.

Change the Recurrence Interval to “1” and the Frequency to “Day” and press the “+ New step”

search for “log analytics” and select the “Run query and visualize results”

I will proceed with “Sign in”, you can also use a Service Principal but we will cover this to another post.

After you login select the Subscription, Resource Group and the Log Analytics Workspace. Next, add the query, for Chart Type select “Html Table” and add a “Next Step”

search for “sendgrid” and select the “Send email (V2)”

Add a name for the connection and the API key that you created at the SendGrid creation post and press create. https://www.e-apostolidis.gr/microsoft/azure/azure-free-smtp-relay-using-sendgrid/

Fill the From address, To address and Subject. At the email body, add dynamic content and select the blocs of the previous set result.

Press Save to save the Flow and Run to test it.

The result at my email:

Pantelis Apostolidis

www.cloudcorner.gr

The post Serverless Computing | Email Report Azure WAF Logs appeared first on Apostolidis Cloud Corner.

Azure Backup Reports

Pantelis Apostolidis — Wed, 28 Jun 2017 21:07:57 +0000

Azure Backup Reports

A new feature is in public preview, the Azure Backup Reports. Now we can have the Azure Backup Reports at the OMS Workspace, Event Hub and Power Bi. You can use Power BI to view report dashboard, download reports and create custom reports

The configuration has two steps, one to configure the Azure Backup Reports connection with each service and the other is to get the data at each service.

First go to a Recovery Services vault and select Backup Reports. Next press the Configure button.

The Diagnostic settings blade will open. Change the Status to “On” and select the desired services to collect the Azure Backup Logs.

For the Power Bi integration we need a Storage account. So check the “Archive to storage account” option and select a storage account. The storage account must be at the same region as the Azure Backup account.

To integrate with OMS check the “Send to Log Analytics” option and select an OMS Workspace.

An other option is to stream the Azure Backup logs to event hub. To configure it check the “Stream to an event hub” and select the event hub namespace and policy name.

At the bottom part of the configuration blade select the Logs that you want to get. The retention days option is only for the Storage Account configuration.

Press save and return to the Backup reports blade. Now press the “Sign in” to connect to Power Bi to configure the Service.

At the lower left corner of the Power Bi Portal press “Get Data”

At the AppSource press the “Get” button under the Services.

Search and select the “Azure Backup”

At the connect to Azure Backup page enter the Storage Account name. This is the storage account that we selected at the Azure Backup Reports configuration.

Press next and Save. Now the Azure Backup workspace is ready. Be patient, it needs time to start reporting data.

If you go back to the Azure Portal, the Backup Reports blade has changed and it only has the option to connect to your Power Bi dashboard.

If you browse to your Power Bi dashboard, you can view the Azure Backup Reports Workspace as the below image.

For the OMS integration, you only need to go to the Log Search and query “Category=”AzureBackupReport” and you will have all the Azure Backup Report logs. Following the OMS logic you can create a custom View, you can follow this post: Azure Log Analytics

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Backup Reports appeared first on Apostolidis Cloud Corner.

Azure Log Analytics | CPU Performance Monitor

Pantelis Apostolidis — Mon, 26 Jun 2017 20:50:07 +0000

Azure Log Analytics | CPU Performance Monitor

In this article we will create a CPU Performance monitor View for our servers at the Azure Log Analytics (OMS) Portal.

At the Microsoft Operations Management Suite (OMS) portal press the + button to create a new View

The View Designer workspace will open. Select the “Line chart & callout”

At the Properties blade enter a Name, something like “CPU Performance Monitor”, add the below query and press Apply

Type:Perf CounterName="% Processor Time" InstanceName="_Total" | measure avg(CounterValue) by Computer Interval 10Minutes

Pressing Apply you will see at the Preview window the “Name” and the CPU Performance of all the Windows servers that are monitored by OMS agent.

The next step is to press the “+ View” tab and add a “Stack of line charts

The “Stack of line charts” will add three charts per row and we can use it to add our servers. We will create something like that:

So, at the Properties blade add a name and a query for each server needs to be monitored and press Apply. For more than three servers add more “Stack of line charts”.

The query is the below, just change the Computer = “server.domain.local” with your servers.

Type:Perf CounterName="% Processor Time" InstanceName="_Total" AND Computer = "server.domain.local" | measure Avg(CounterValue) as 'CPU_Percentage' by Computer Interval 10Minutes

Finally press “Save” at the View Designer

The result is a CPU Performance monitor for all servers at the OMS Portal.

And when you press it you have the CPU Performance Monitor of all added servers.

Stay tuned for the next part

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Log Analytics | CPU Performance Monitor appeared first on Apostolidis Cloud Corner.