Topics
Related topics
Available monitoring options
- Azure Monitor: this codument go through the important aspects of it.
- Azure Security Center
- Azure Sentinel
Monitoring concepts
Each project need a holistic monitor strategy.
Scenario: A financial organization is moving its systems to Azure, with a mixture of IaaS and PaaS services. In its previous environment, the organization had several instances where systems failed or issues arose. There was an extended delay to engage resources and resolve the issues. This situation affected customers’ ability to access their accounts, and it influenced satisfaction.
The organization wants to design a monitoring strategy that encompasses all the solutions that it uses. There should also be insights and alerting into the accumulated log data. The organization wants to quickly identify and minimize the impact if systems fail in the future.
Continuous monitoring strategy
- it can improve the ability to identify issues within application
- it can help to improve customer experience
- to monitor performance of infrustructure and application
- monitor security risks and suspicious activity
- collect information on issues and analyse and then respond
- in long run, your organization will become more productive, cost-effective, secure, and competitive.
- why monitor applications
- to improve application health
- configure alert and automated response to deal with issues
- to improve the development lifecycle, we can use monitoring, therefore we would be ready when we go to production
- why monitor infrustructures
- because of issues that could render the entire infrastructure unavailable
- because of threats to security (these can have impact on productivity, financial loss, damage organization reputation )
- risk of suspicious user account
- malicious ip addresses
- create automated response to alerts with playbooks and webhook.
- learn from issues, strengthen protection, build an improved infrastructure
Azure Monitor agents
Azure Diagnostics Extension
- An agent in azure monitor
- Collects monitoring data from guest operating systems of azure compute resources include virtual machines.
- We don’t pay for the extension but we pay for data ingestion
- Data destination is azure storage account or other data sinks (additional destinations).
Scenarios
- Collect guest metrics into azure monitor metrics (collect logs from middle-tier/vm and transfer to azure monitor)
- Send guest logs and metrics to azure storage for archiving
- Send guest logs and metrics to azure event hubs to send outside of azure
Data collected
| Windows (WAD) | Linux (LAD) |
|---|---|
| Windows event logs | Syslogs |
| Performance counters | Performance counters |
| IIS logs | Log files |
| Application logs | |
| .Net eventsource logs | |
| Manifest based ETW logs | |
| Crash dumps log | |
| File based logs | |
| Agent disgnostic logs | |
Sources
Azure Log Analytics Agent
| Azure Diagnostics Extension | Azure Log Analytics |
|---|---|
| Only Azure VMs | Azure/other clouds/on-prem VMs, |
| Sends data to azure storage, azure monitor metrics (only win), and event hubs. | collects data to azure monitor logs. |
| is required for solutions, azure monitor for vms, azure security center, und… |
Windows Agents
Coming soon…
Linux Agents
Coming soon…
Dependancy Agent
Coming soon…
Azure Monitor Logs
- powerfull query language for joining data from multiple tables
- with virtual presentation
- extracts valuable information about infrastructure from log data
- monitor health of the services
- it’s for collecting and analyzing telemetry
- helps to have max performance and availability for cloud application & on-prem
- it collects data in azure monitor
- azure monitor collects two fundamental types of data
- metrics: tell you how the resource is performing and consuming other resources
- logs: when the resource created and modified
- azure monitor is automatic system, it collects data as soon as the resource is created
- azure monitor data can be extended
- enabling diagnostics:
- adding an agent: it’s for vms via installing log analytics agent and sending data to log analytics workspace.
- custome code via Data Collector API
- Logs (recommended for analyzing)
- time-stamped information about changes made to resource
- types are numeric, text, events
- You can store metric data in logs to combine them with other monitoring data for analysis
- You log data from Azure Monitor in a Log Analytics workspace
- Azure provides an analysis engine and a rich query language (Kusto)
- metrics (recommended for alerting)
- Metrics are numerical values that describe some aspect of a system at a point in time
- The metrics are collected at regular intervals and are useful for alerting because of their frequent sampling.
- Metrics are stored in a time-series database
- Metrics are suited for alerting and fast detection of issues
Monitoring Best Practices
Sources
What’s alert?
- A proactive notificaion when an important notification found in monitoring (response to incidents).
- Alert is raised before customer identifies and addresses an issue.
- Unified alerts are managed by log analytics and application insights.
- The previous type of alert are classic alerts.
- Alerts are raised for matrics and logs. Ex. Metric values, Log search queries, Activity log event, Health of the underlying azure platform, test for website availability.
Alert states
| Alert state | Description |
|---|---|
| New | Issue has been detected but has not been reviewed. |
| Acknowlaged | Administrator has reviewed the alert and started working on it. |
| Closed | Issue has been resolved. |
NOTE : The state changes are stored in alert’s history.
Alert states are independent of Monitor condition (fired or resolved).
Different type of reaction to an incident
- Alerts & alert rules & action group
- Classic alerts
- Metric alerts
- Log alerts
- Activity log alerts
- common alert schema
- Smart groups (aggregation of lalerts base on machine learning algorithms)
- Auto scale
- Change analysis
Permission and privilages
We can use the Role-based access control (RBAC) at different levels
- Subscription Level
- Resource Level
The RBACs which are available for Azure Monitor service are the following:
- Monitoring Contributor
- Monitoring Metrics Publisher
- Monitoring Reader
Ex. A user with the Monitoring contributor access for VM1 can only consume and mange the alert that have been generated for VM1.
Add new Alert
Alerts are defined via Azure Minitor Service blade.
Go to Azure portal > Monitor service> Go to Alerts section > Use add alert rule button.
According to the seleced resource there’s different signals available.
Signal types
- Metrics
- Activity logs
The alert configuration is different respectively. But without considering the signal types always we need the following items for creating an alert rule in Azure Monitor Service.
| Resource (For the scope of Alert Rule) | The scope of alert is specified in this step. – Subscription level – Resource Group level – Region – A specific resource – One Alert Rule for multiple resources with the same Resource Type is available. |
| Condition | The monitoring criteria. |
| Action Group | Collection of notifications. |
Resources
You owe your dreams your courage.
Koleka Putuma
Multi Cloud Solutions 