Onboarding : Azure Monitor and Alert

Topics

Related topics

Available monitoring options

  • Azure Monitor: this codument go through the important aspects of it.
  • Azure Security Center
  • Azure Sentinel

Monitoring concepts

Each project need a holistic monitor strategy.

Scenario: A financial organization is moving its systems to Azure, with a mixture of IaaS and PaaS services. In its previous environment, the organization had several instances where systems failed or issues arose. There was an extended delay to engage resources and resolve the issues. This situation affected customers’ ability to access their accounts, and it influenced satisfaction.
The organization wants to design a monitoring strategy that encompasses all the solutions that it uses. There should also be insights and alerting into the accumulated log data. The organization wants to quickly identify and minimize the impact if systems fail in the future.

Continuous monitoring strategy

  • it can improve the ability to identify issues within application
  • it can help to improve customer experience
  • to monitor performance of infrustructure and application
  • monitor security risks and suspicious activity
  • collect information on issues and analyse and then respond
  • in long run, your organization will become more productive, cost-effective, secure, and competitive.
  • why monitor applications
    • to improve application health
    • configure alert and automated response to deal with issues
    • to improve the development lifecycle, we can use monitoring, therefore we would be ready when we go to production
  • why monitor infrustructures
    • because of issues that could render the entire infrastructure unavailable
    • because of threats to security (these can have impact on productivity, financial loss, damage organization reputation )
    • risk of suspicious user account
    • malicious ip addresses
    • create automated response to alerts with playbooks and webhook.
    • learn from issues, strengthen protection, build an improved infrastructure
Availability of applications
even in development phase monitoring can help developers

Azure Monitor agents

Azure Diagnostics Extension
  • An agent in azure monitor
  • Collects monitoring data from guest operating systems of azure compute resources include virtual machines.
  • We don’t pay for the extension but we pay for data ingestion
  • Data destination is azure storage account or other data sinks (additional destinations).

Scenarios

  • Collect guest metrics into azure monitor metrics (collect logs from middle-tier/vm and transfer to azure monitor)
  • Send guest logs and metrics to azure storage for archiving
  • Send guest logs and metrics to azure event hubs to send outside of azure

Data collected

Windows (WAD)Linux (LAD)
Windows event logsSyslogs
Performance countersPerformance counters
IIS logsLog files
Application logs
.Net eventsource logs
Manifest based ETW logs
Crash dumps log
File based logs
Agent disgnostic logs

Sources

Azure Log Analytics Agent
Azure Diagnostics ExtensionAzure Log Analytics
Only Azure VMsAzure/other clouds/on-prem VMs,
Sends data to azure storage, azure monitor metrics (only win), and event hubs.collects data to azure monitor logs.
is required for solutions, azure monitor for vms, azure security center, und…
Windows Agents

Coming soon…

Linux Agents

Coming soon…

Dependancy Agent

Coming soon…

Azure Monitor Logs

  • powerfull query language for joining data from multiple tables
  • with virtual presentation
  • extracts valuable information about infrastructure from log data
  • monitor health of the services
  • it’s for collecting and analyzing telemetry
  • helps to have max performance and availability for cloud application & on-prem
  • it collects data in azure monitor
  • azure monitor collects two fundamental types of data
    • metrics: tell you how the resource is performing and consuming other resources
    • logs: when the resource created and modified
Diagram of Azure Monitor's architecture displaying the sources of monitoring data, the data stores, and functions performed on the data.
high-level view of Azure Monitor[Source]
  • azure monitor is automatic system, it collects data as soon as the resource is created
  • azure monitor data can be extended
    • enabling diagnostics:
    • adding an agent: it’s for vms via installing log analytics agent and sending data to log analytics workspace.
    • custome code via Data Collector API
  • Logs (recommended for analyzing)
    • time-stamped information about changes made to resource
    • types are numeric, text, events
    • You can store metric data in logs to combine them with other monitoring data for analysis
    • You log data from Azure Monitor in a Log Analytics workspace
    • Azure provides an analysis engine and a rich query language (Kusto)
  • metrics (recommended for alerting)
    • Metrics are numerical values that describe some aspect of a system at a point in time
    • The metrics are collected at regular intervals and are useful for alerting because of their frequent sampling.
    • Metrics are stored in a time-series database
    • Metrics are suited for alerting and fast detection of issues

Source: https://docs.microsoft.com/en-us/learn/modules/analyze-infrastructure-with-azure-monitor-logs/1-introduction

Monitoring Best Practices

Sources

What’s alert?

  • A proactive notificaion when an important notification found in monitoring (response to incidents).
  • Alert is raised before customer identifies and addresses an issue.
  • Unified alerts are managed by log analytics and application insights.
  • The previous type of alert are classic alerts.
  • Alerts are raised for matrics and logs. Ex. Metric values, Log search queries, Activity log event, Health of the underlying azure platform, test for website availability.

Alert states

Alert stateDescription
NewIssue has been detected but has not been reviewed.
AcknowlagedAdministrator has reviewed the alert and started working on it.
ClosedIssue has been resolved.

NOTE : The state changes are stored in alert’s history.

Alert states are independent of Monitor condition (fired or resolved).

Different type of reaction to an incident

  • Alerts & alert rules & action group
  • Classic alerts
  • Metric alerts
  • Log alerts
  • Activity log alerts
  • common alert schema
  • Smart groups (aggregation of lalerts base on machine learning algorithms)
  • Auto scale
  • Change analysis

Permission and privilages

We can use the Role-based access control (RBAC) at different levels

  • Subscription Level
  • Resource Level

The RBACs which are available for Azure Monitor service are the following:

  • Monitoring Contributor
  • Monitoring Metrics Publisher
  • Monitoring Reader

Ex. A user with the Monitoring contributor access for VM1 can only consume and mange the alert that have been generated for VM1.

Add new Alert

Alerts are defined via Azure Minitor Service blade.

Go to Azure portal > Monitor service> Go to Alerts section > Use add alert rule button.

According to the seleced resource there’s different signals available.

Signal types

  • Metrics
  • Activity logs

The alert configuration is different respectively. But without considering the signal types always we need the following items for creating an alert rule in Azure Monitor Service.

Resource
(For the scope of Alert Rule)
The scope of alert is specified in this step.
– Subscription level
– Resource Group level
– Region
– A specific resource
– One Alert Rule for multiple resources with the same Resource Type is available.
ConditionThe monitoring criteria.
Action GroupCollection of notifications.

Resources


You owe your dreams your courage.

Koleka Putuma


Published by parisamoosavinezhad

- Software Engineer - Software Architect - Software and database specialist - Cloud solution architect

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: