Azure Monitor Archives - Page 2 of 3

Azure spring clean 2020

30/01/202003/02/2020
by Martin Ehrnst

Azure spring clean is a community initiative where the idea is to convey best practices and lessons learned managing Azure. During February 2020 we will have a broad selection of blog posts and videos on Real-world scenarios and solutions from the community. Covering topics like Azure Monitor, policies, and cost management.

The first post goes online on February 3.

Date	Article	Contributor	Category
03/02/20	Azure RBAC – Best Practices	Alan Kinane	Azure Foundations
04/02/20	Azure Policy for AKS	Sam Cogan	Azure Policy
05/02/20	Monitoring Containers on Azure with Windows Admin Center	Dave Rendón	Azure Monitor
06/02/20	How to use Tags to organize your Azure resources	Wim Matthyssen	Azure Foundations
07/02/20	Azure Governance – Best Practises	Amine Charot	Azure Foundations
10/02/20	Nailing your Naming Convention with Azure Policy	Matt Browne	Azure Foundations
11/02/20	Azure Cost Management – Best Practises	Sarah Lean	Azure Cost Management
12/02/20	Protect your network resources with Azure Firewall	Luis Beltran	Azure Security Principles
13/02/20	Monitoring Azure Site Recovery	Karel De Winter	Azure Monitor
14/02/20	Using Azure Advisor to baseline your platform	Sam Hodgkinson	Azure Foundations
17/02/20	Using Azure Resource Graph To Assess Your Azure Environment Quickly & Efficiently	Jack Tracey	Azure Foundations
18/02/20	Azure Monitor – Best Practices for Sanity	Kam Salisbury	Azure Monitor
19/02/20	Azure Storage and Backup Lifecycle Best Practices	Dwayne Natwick	Azure Foundations
20/02/20	How to Use and Monitor Azure Update Management	Vukasin Terzic	Azure Fundamentals
21/02/20	Azure Security: my top 10 best practises to make your tenant secure as possible	Shabaz Darr	Azure Security Principles
24/02/20	Simplify Large Scale Deployments with Azure Blueprints	Isham Mohamed	Azure Foundations
25/02/20	Azure Kubernetes Service (AKS) securing Clusters and Applications	Adil Touati	Azure Security Principles
26/02/20	Azure Monitor – Autoscaling Resources Based on Performance	Anthony Mashford	Azure Monitor
27/02/20	How to Avoid a Billing Shock With Azure Serverless Solutions	Stanislav Lebedenko	Azure Cost Management
28/02/20	Securing Your Azure Platform Web Applications	Tidjani Belmansour	Azure Security Principles

Thanks to all the content creators, MVPs Joe Carlyle and Thomas Thornton for starting this!

Azure

Azure Lighthouse why is it so important

15/08/201920/12/2019
by Martin Ehrnst

Working for a Managed Service Provider (MSP) I have many times faced the challenges of managing multiple separate customers from one single pane. Whether it is a multi-tenant active directory, single AD or a vanilla Azure tenant. An MSP is only good when they can build tools to manage all customers in a streamlined fashion.

In the Microsoft sphere, partners and large enterprises have faced many of the same challenges. If you are a large enterprise, you might be eligible for an Enterprise Agreement.
As a partner, you can apply to become a (tier 1) Cloud Solution Provider (CSP). The tools provided are are far from good enough. The challenge is that you are still bound to tenant isolation. If you wanted to have a view of all alerts in Azure Monitor for all your customers. You need to create a tool that authenticates against each individual tenant and retrieves this information. Similar to what I did with SCOM.

Project Towboat

Last year I attended a side meeting for MSPs at Ignite. We discussed at scale management in the Azure Portal. We were promised that something called Project Towboat was planned. Since then it have been dead silent.
Out of the blue, Microsoft announced Azure Lighthouse. Promising simplified cross tenant resource management. So what makes this so great?

Delegated resource access

Azure Lighthouse uses delegated resource access. In essence, the customer establishes a trust with your (management/master) tenant. This allows for the users in the management directory (tenant) to manage resources on behalf of their customers. Many use Azure AD B2b to manage resources across multiple tenants. With Azure Lighthouse, you can do that without changing the context of the user.

In my opinion. Here are some of the features that make Azure Lighthouse so important to MSPs, and others managing multiple tenants.

Cross tenant monitoring in Azure

Azure Monitor is now multi-tenant. As long as the resource group or subscription is available for the person using Azure Monitor. Application and infrastructure monitoring is available from a single pane of glass.

Multi-tenant Log Analytics queries

Log Analytics is a part of Azure Monitor and is called Azure Monitor Logs, the engine behind is Log Analytics.
Log Analytics is already capable of searching within multiple workspaces. Since Azure Lighthouse will surface your customer’s workspaces, you can run cross tenant queries, how cool is that?

Azure security center for all customers

The beauty with delegated resource management just continues. Another great thing for your security team apart from Log Analytics is Azure Security Center is available in Azure Lighthouse. This means that the team (or that one person) can look at one single dashboard, or write the integration against one tenant.

Summary

With Azure Lighthouse greatly simplifies at scale and cross tenant management. Being tightly integrated with Azure Resource Manager for deployment, as well as Azure Monitor and Security Center for monitoring infrastructure and security.

I am really looking forward to creating solutions and working more with Azure Lighthouse. It is a long-awaited product, and with this launch, Microsoft is way ahead of its competitors.
Expect more dedicated posts on how to manage and automate using lighthouse in the future.

You can read more and find examples on the official Azure Lighthouse documentation and Azure Lighthouse github examples

Azure Monitor

Metric alerts for Azure monitor logs

12/06/201912/06/2019
by Martin Ehrnst

A common thing for traditional companies is to have one team responsible for monitoring. A few years ago, this team where close friends with the team provisioning infrastructure. Now, more and more companies are shifting to the “DevOps” world. Even Microsoft have killed SCOM and are only using Azure Monitor. Meaning that the one deployed the code (and the infrastructure) should be responsible for monitoring. In essence, this is great. But this transition takes time, and one should not underestimate the knowledge of the team who have been responsible for monitoring your entire infrastructure for decades.

If you are familiar with SCOM, you know that rules and monitors is targeted against a class of objects. IE, Windows 2016 operating system. When we move our workloads to Azure, we want to use Azure Monitor to monitor our workloads and VMs.

Enter Log alerts

Log Alerts has been around for quite some time and is commonly used to alert on actual log data. IE custom application logs, Windows event log and so on. But Log alerts has a “hidden” feature, especially for your monitoring teams, not wanting to manage hundreds of duplicate rules.

By using Log alerts with metric measurements you can almost replicate the what discoveries in SCOM does- find resources of a specific type, and attach some kind of monitoring to them. For example, you can create a search query for all your IaaS VMs and alert on their CPU counter.

This will let your monitoring team recreate all their logic, and have control over the entire infrastructure, almost as they had on-permises. At the same time you can leverage more DevOps practices and at the end have every team responsible for their own work.

Kusto examlpe

Below is a simple example that will list all VMs and their processor time. You can create an alert straight from Azure Monitor logs (former Log Analytics) or start from a new alert.

 Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" | summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 5m), Computer

Summary

You have the option to monitor multiple VMs using one Alert Rule in Azure Monitor already. But one limitation is that this solution will not add new VMs to the alert rule. And for the time being, it only supports virtual machines
Log alerts are dependent on your query. So as long as your data is available, you can alert on it. Whether it is a web app, a SQL server or a custom log.

With Log Alerts, the transition to a public cloud-based infrastructure might be easier. Your operations teams can use their knowledge and re-create their on-premises monitoring logic as searches.
Application alerts could still be handled by the developers, and you can provision those using ARM templates or similar.

PS: I was going to write a longer post on how to manage and programmatically create log alerts, but with these great examples in Microsoft docs, there’s no need to re-invent the wheel.

Azure spring clean 2020

Share this:

Azure Lighthouse why is it so important

Project Towboat

Delegated resource access

Cross tenant monitoring in Azure

Multi-tenant Log Analytics queries

Azure security center for all customers

Summary

Share this:

Metric alerts for Azure monitor logs

Enter Log alerts

Kusto examlpe

Summary

Share this: