Azure Application Gateway is an application load balancer (OSI layer 7) for web traffic, available in Azure environment, that manages HTTP and HTTPS traffic of the applications. This article is discussed how to monitor of Azure Application Gateway using Log Analytics provides.
Figure 1 - Azure Application Gateway basic schema
Using the Azure Application Gateway you can take advantage of the following features:
- URL-based routing
- Redirection
- Multiple-site hosting
- Session affinity
- Secure Sockets Layer (SSL) termination
- Web application firewall (WAF)
- Native support for WebSocket and HTTP/2 protocols
For more details on Azure Application Gateway can be found in the Microsoft's official documentation.
Configuring Diagnostics logs for the Application Gateway
The Azure Application Gateway can send diagnostic logs to a workspace of Log Analytics . This feature is very useful for checking the performance, to detect any errors and is essential for troubleshooting steps, in particular in the presence of the WAF module. To enable the diagnostic from the Azure portal you can select the Application Gateway resource and go to the "Diagnostics logs":
Figure 2 – Starting configuration of Diagnostics logs
Figure 3 – Configuring Diagnostics logs
After choosing your Log Analytics workspace where to send diagnostics data, in the Log section, you can select which type of log collecting among the following:
- Access log (ApplicationGatewayAccessLog)
- Performance log (ApplicationGatewayPerformanceLog)
- Firewall log (ApplicationGatewayFirewallLog): these logs are generated only if the Web Application Firewall is configured on the Application Gateway.
In addition to these logs are also collected by default Activity Log generated by Azure. These logs are maintained for 90 days in the store of the Azure event logs. For more details you can refer this specific document.
Azure Application Gateway analytics solution of Log Analytics
Microsoft offers the solution Azure Application Gateway analytics that can be added to the workspace of Log Analytics by following these simple steps:
Figure 4 - Launching the procedure of adding the solution to the OMS workspace
Figure 5 – Selection of the Azure Application Gateway analytics solution
Figure 6 - Addition of the solution in the selected workspace
After enabling the sending of diagnostics logs into the workspace of Log Analytics and adding the solution to the same, by selecting the tile Azure Application Gateway analytics in the Overview page, you can see an overview of the collected log data from the Application Gateway:
Figure 7 – Screen overview of the Azure Application Gateway analytics solution
You can also view the details for the following categories.
- Application Gateway Access logs:
- Client and server errors for Application Gateway access logs
- Requests per hour for each Application Gateway
- Failed requests per hour for each Application Gateway
- Errors by user agent for Application Gateways
Figure 8 - Screenshot of the Application Gateway Access logs
- Application Gateway performance:
- Host health for Application Gateway
- Maximum and 95th percentile for Application Gateway failed requests
Figure 9 – Screenshot of the Application Gateway performance
Customized dashboard of Log Analytics for the Application Gateway monitor
In addition to this solution can also be convenient to use a special dashboard of Log Analytics, specifically for the monitoring of the Application Gateway, available at this link. The deployment of the dashboard is via ARM template and requires also in this case the Diagnostics logs of the Application Gateway enabled, as described above. The various queries of Log Analytics, used by the dashboard, are documented in this blog. Thanks to these queries the dashboard shows several additional information exposed by the diagnostic of the Application Gateway.
Figure 10 – Custom dashboard of Log Analytics for Application Gateway monitoring
Query of Log Analytics to monitor the Firewall Log
Using the solution Azure Application Gateway analytics of Log Analytics or the custom dashboard (stated in the previous paragraph) are not contemplated at the time the Firewall log, generated when is active the Web Application Firewall (WAF) on the Application Gateway. The WAF is based on rules of OWASP Core Rule Set 3.0 or 2.2.9 to intercept attacks, for the web applications, that exploit the known vulnerabilities. To name a few, we find for example the SQL injection and attacks cross site scripting.
In this case, if you decide to check the Firewall log, you must directly query the Log Analytics, for example:
Figure 11 – The Query to retrieve blocked requests by the WAF module, over the past 7 days, for a specific URI, divided by RuleID
To see the list of rules of the WAF, by associating the RuleId to its description, you can consult this document.
The descriptive message of the rule is also listed within the results returned by the query:
Figure 12 – The Query to retrieve blocked requests by the WAF module, over the past 7 days, for a specific URI and for a specific RuleId
Conclusions
In my experience, in Azure architectures that require secure publishing of web services to Internet, is often used Azure Application Gateway service with the WAF module active. With the ability to send diagnostic logs of this component to Log Analytics you have the option of having a qualified monitor, that is fundamental to analyse any error conditions and to assess the state of the component in all its facets.
