Category Archives: Azure Monitor

Azure management services and System Center: What's New in January 2019

The new year has begun with several announcements by Microsoft regarding what happened to Azure management services and System Center. The Cloud Community releases a monthly basis article, allowing you to have a general overview of the main new features of the month, in order to stay up to date on these news and have the necessary references to conduct further study.

As already announced in the past few months, monitoring capabilities, management, and security functionality of Operations Management Suite (OMS) have been included in the Azure portal. Since 15 January 2019 the OMS portal has been officially retired, and all the features are accessible from Azure portal.

Azure Monitor

Azure Monitor logs in Grafana

For Monitor Azure was announced a new pluging to integrate with Grafana. Thanks to this pluging you can see in a simple and intuitive way any data collected in Log Analytics. The plugin requires at least version 5.3 of Grafana and by the Log Analytics API retrieves information directly from the workspace, making them available directly from the Grafana dashboard. For more information, please visit the Microsoft's official documentation.

Figure 1 – Log Analytics integration in Grafana

Azure Monitor for containers

During the month of January, the agent of Azure Monitor for Containers (build version 01/09/19) has been updated to introduce improvements in stability and performance. Agent in cluster environments Azure Kubernetes Service (AKS) will be automatically updated. For further details please consult the release notes of the agent.

Azure Security Center

New dashboard on regulatory compliance

In Azure Monitor was made available a new dashboard that shows the status of environmental compliance with respect to specific standards and regulations. Currently supported standards are: Azure CIS, PCI DSS 3.2, ISO 27001, and SOC TSP. The dashboard showsthe overall score of compliance and the detail of the evaluations that reports the status of compliance with respect to each standard.

Figure 2 – Regulatory compliance dashboard in Azure Security Center

Azure Backup

Added support for PowerShell and ACLs for Azure Files

In the scenario of protection ofAzure file shares using Azure Backup the following features have been introduced:

Azure Site Recovery

New Update Rollup

For Azure Site Recovery was released theUpdate Rollup 32 introducing new versions of the following components:

  • Microsoft Azure Site Recovery Unified Setup (version 9.21.5091.1): used for replication scenarios from VMware to Azure.
  • Microsoft Azure Site Recovery Provider (version 5.1.3800.0): used for replication scenarios from Hyper-V to Azure or to a secondary site.
  • Microsoft Azure Recovery Services Agent (version 2.0.9144.0): used for replication scenarios from Hyper-V to Azure.

The installation of this update rollup is possible on all systems running Microsoft Azure Site Recovery Service providers, by including:

  • Microsoft Azure Site Recovery Provider for System Center Virtual Machine Manager (3.3.x. x).
  • Microsoft Azure Site Recovery Hyper-V Provider (4.6.x. x).
  • Microsoft Azure Site Recovery Provider (5.1.3400.0) and later.

The Update Rollup 31 for Microsoft Azure Site Recovery Unified Setup applies to all systems that have installed the version 9.17.4860.1 or later.

For more information on the issues resolved, on improvements from this Update Rollup and to get the procedure for its installation is possible to consult thespecific KB 4485985.

New statement of support

In Azure Site Recovery have recently included the following improvements:

  • Support for physical servers with UEFI boot type. Although Azure VMs are not supported with UEFI boot disks, ASR can handle the migration of these systems by performing a conversion of the type of BIOS boot, also for the physical servers, not just virtual ones. This feature is only for Windows virtual machines (Windows Server 2012 R2 and later).
  • Support for systems that have the system directory ( /[root], /boot, /usr, etc.) even on different disks than the OS and supporting /boot on LVM volume.
  • Extended support for server migration by AWS for the following OSS: RHEL 6.5+, RHEL 7.0+, CentOS 6.5+ and CentOS 7.0+

System Center

System Center Configuration Manager

Version 1901 for the branch Technical Preview of System Center Configuration Manager.

Among the main new features of this release there is a new interactive client health dashboard will report an overview of the client's health and common mistakes in their environment, with the ability to apply filters to exclude obsolete and offline clients.

Figura 3 – New Client Health Dashboard

For full details of what's new in this release you can consult this document. Please note that the Technical Preview Branch releases help you to evaluate new features of SCCM and it is recommended to apply these updates only in test environments.

System Center Operations Manager

Management Packs

Following, are reported the news about the SCOM Management Packs:

  • Microsoft System Center 2016 Management Pack for Microsoft Azure version 1.6.0.7
  • Microsoft System Center Management Pack for SQL Server 2017+ Reporting Services version 7.0.12.0
  • Log Analytics Management Pack forSCOM 1801 version7.3.13288.0 and SCOM 2016 version7.2.12074.0

Evaluation of Azure and System Center

To test and evaluate free of charge the services offered by Azure you can access this page, while to try the various System Center components you must access theEvaluation Center and, after registering, you can start the trial period.

OMS and System Center: What's New in December 2018

In December have been announced, by Microsoft, a significant number of news regarding Azure management services and System Center. Our community releases this monthly summary that gives you a comprehensive overview of the main news of the month, in order to stay up to date on these news and have the necessary references to conduct further study.

Azure Monitor

The service Azure Monitor for containers is now available to monitor the health and performance of Kubernetes cluster hosted on Azure Kubernetes Service (AKS). Azure Monitor for containers gives you complete visibility on the performance, collecting metrics on memory and processor of controllers, of the nodes and containers. Also collects the logs of containers. After you enable the monitor for Kubernetes clusters, metrics and logs are automatically collected by a Log Analytics agent version for containers for Linux and stored in a workspace of Log Analytics.

Over the past few months solutions of monitoring, management and security, available from the Operations Management Suite (OMS), have been incorporated into the Azure Portal. Starting from 15 January 2019 the OMS portal will be permanently withdrawn and you will need to use the Azure portal. Before this date you should complete the following steps:

For more details you can refer to this Microsoft's document.

Azure Log Analytics, now part of Azure Monitor, is now available in the Azure region of West US 2.

In January by selecting views and Log Analytics solutions, you will use the new Azure Monitor Logs UX, that provides a query editor more functional and improvements in views.

Azure Site Recovery

For Azure Site Recovery was released theUpdate Rollup 31 introducing new versions of the following components:

  • Microsoft Azure Site Recovery Unified Setup (version: 9.20.5051.1): used for replication scenarios from VMware to Azure.
  • Microsoft Azure Site Recovery Provider (version 5.1.3700.0): used for replication scenarios from Hyper-V to Azure or to a secondary site.
  • Microsoft Azure Recovery Services Agent (version 2.0.9144.0): used for replication scenarios from Hyper-V to Azure.

The installation of this update rollup is possible on all systems running Microsoft Azure Site Recovery Service providers, by including:

  • Microsoft Azure Site Recovery Provider for System Center Virtual Machine Manager (3.3.x. x).
  • Microsoft Azure Site Recovery Hyper-V Provider (4.6.x. x).
  • Microsoft Azure Site Recovery Provider (5.1.3300.0) and later.

The Update Rollup 31 for Microsoft Azure Site Recovery Unified Setup applies to all systems that have installed the version 9.16.4860.1 or later.

For more information on the issues resolved, on improvements from this Update Rollup and to get the procedure for its installation is possible to consult the specific KB 4478871.

In Azure Site Recovery is also introduced the ability to update the Mobility Agent installed aboard Azure virtual machines, in the replication scenario of VMs in Azure. Whereas Azure Site Recovery releases an update that introduces new features and enhancements every month, the ability to maintain automatically updated infrastructure is especially convenient. These updates do not require restarting the virtual machines and have no impact on the systems replication. By enabling automatic update, the process takes place via a runbook, within an automation account, created in the same subscription of the vault. By dafult the runbook runs at 12:00 AM, but the schedule can be changed at will.

Figure 1 - Enablng automatic update in the activation phase

Figure 2 – Enabling automatic update in the Revovery Service vault

Another important feature introduced in Azure Site Recovery is the ability to replicate and fail over to other regions of virtual machines that belong to Availability Zones. Such functionality has been made available for all Azure regions that support Availability Zones.

Azure Backup

In Azure backup was simplifies the procedure to perform the restore of virtual machines, introducing the feature In-Place restore of disks, which allows to restore the disks of a virtual machine, without the need to create a new system. To do this simply select the following option at restore time:

Figure 3 – In-Place restore from the Azure Portal

Currently this feature is supported only for VMs managed unencrypted. There isn't currently support for generalized VMs and for VMs created using custom images, but this feature is definitely going to increase functionality.

In Azure Backup there is the possibility to activate the protection of SQL Server installed on a virtual machine Azure. In this area of functionality has been added Auto-protection and, if activated, lets make the discovery and protection of all the databases that will be added on that instance of SQL Server, standalone or in an Always On availability group.

Figure 4 – Auto-protect SQL databases with Azure Backup

System Center

System Center Virtual machine Manager

The installation of the following updates 'KB4467684', 'KB4478877', 'KB4471321' or 'KB4483229' on a host Windows Server 2016 managed by SCVMM, may mean that SCVMM is no longer able to enumerate or manage Logical Switch configured on the host. The problem is the fact that the above updates remove the registration of WMI classes used by SCVMM agent to enumerate and manage Logical Switch on the host. The solution is to record the classes in the WMI repository, as reported by this article.

System Center Configuration Manager

Released the version 1811 for the branch Technical Preview of System Center Configuration Manager.

Through the major new features in this release are the ability to insert code PowerShell as a Task Sequence step, thus eliminating the need to create and distribute the package to run PowerShell commands.

Figure 5 – PoerShell code injection in a Task Sequence

In this release are covered further innovations that can be found in this document.

Please note that the Technical Preview Branch releases help you to evaluate new features of SCCM and it is recommended to apply these updates only in test environments.

For the branch Technical Preview System Center Configuration Manager has been released version 1812. All that's new in this release can be found in this Microsoft's document. Please note that the Technical Preview releases Branch help you evaluate the new features of SCCM, so that you can investigate and provide feedback to the product team. These updates is recommended only apply them in test environments.

System Center Operations Manager

Following, are reported the news about the SCOM Management Packs:

Evaluation of Azure and System Center

To test and evaluate free of charge the services offered by Azure you can access this page, while to try the various System Center components you must access theEvaluation Center and, after registering, you can start the trial period.

Protection from DDoS attacks in Azure

A cyber attack of type distributed denial-of-service (DDoS attack – Distributed Denial of Service) is intended to exhaust deliberately the resources of a given system that provides a service to clients, such as a website that is hosted on web servers, to the point that it will no longer be able to provide these services to those who require it in a legitimate way. This article will show the security features that you can have in Azure for this type of attacks, in order to best protect the applications on the cloud and ensure their availability against DDoS attacks.

DDoS attacks are becoming more common and sophisticated, to the point where it can reach sizes, in bandwidth, increasingly important, which make it difficult to protect and increase the chances of making a downtime to published services, with a direct impact on company business.

Figure 1 – DDoS Attack Trends

Often this type of attack is also used by hackers to distract the companies and mask other types of cyber attacks (Cyber Smokescreen).

 

Features of the solution

In Azure, DDoS protection is available in two different tiers: Basic oppure Standard.

Figure 2 - Comparison of the features available in different tiers for DDoS Protection

The protection Basic is enabled by default in the Azure platform, which constantly monitors traffic and applies mitigations to the most common network attacks in real time. This tier provides the same level of protection adopted and tested by Microsoft's online services and is active for Azure Public IP addresses (Pv4 and IPv6). No configuration is required for the Basic tier.

Typology Azure DDoS Protection Standard provides additional mitigation features over the Basic tier, that are specifically optimized for resources located in Azure virtual networks. The protection policies are self-configured and are optimized by carrying out specific monitoring of network traffic and applying machine learning algorithms, that allow you to profile your application in the most appropriate and flexible way by studying the traffic generated. When the thresholds set in the DDoS policy are exceeded, the DDoS mitigation process is automatically started, which is suspended when it falls below the established traffic thresholds. These policies are applied to all public IP of Azure (IPv4) associated with resources present in the virtual network, like: virtual machines, Azure Load Balancer, Azure Application Gateway, Azure Firewall, VPN Gateway and Azure Service Fabric instances. This protection does not apply to App Service Environments.

Figure 3 – Overview of Azure DDoS Protection Standard

The Azure DDoS Protection Standard is able to cope with the following attacks:

  • Volumetric attacks: the goal of these attacks is to flood the network with a considerable amount of seemingly legitimate traffic (UDP floods, amplification floods, and other spoofed-packet floods).
  • Protocol attacks: These attacks are aiming to make inaccessible a specific destination, exploiting a weakness that is found in the layer 3 and in the layer 4 of the stack (for example SYN flood attacks and reflection attacks).
  • Resource (application) layer attacks: These attacks are targeting the Web application packages, in order to stop transmitting data between systems. Attacks of this type include: violations of the HTTP protocol, SQL injection, cross-site scripting and other attacks in level 7. To protect themselves from attacks of this type is not sufficient DDoS protection standard, but you must use it in conjunction with the Web Application Firewall (WAF) available in Azure Application Gateway, or with third-party web application firewall solution, available in the Azure Marketplace.

 

Enabling DDoS protection Standard

The DDoS protection Standard is enabled in the virtual network and is contemplated for all resources that reside in it. The activation of the Azure DDoS Protection Standard requires you to create a DDoS Protection Plan which collects the virtual networks with DDoS Protection Standard active, cross subscription.

Figure 4 – Creating a DDoS Protection Plan

The protection Plan is created in a particular subscription, which will be associated with the cost of the solution.

Figure 5 – Enabling DDoS protection Standard on an existing Virtual Network

The Standard tier provides a real-time telemetry that can be consulted via views in Azure Monitor.

Figure 6 – DDoS Metrics available in Azure Monitor

Any DDoS protection metrics can be used to generate alerts. Using the metric "Under DDoS attack"you can be notified when an attack is detected and DDoS mitigation action is applied.

DDoS Protection Standard applies three auto-tuned mitigation policies (TCP SYN, TCP & UDP) for each public IP address associated with a protected resource, so that resides on a virtual network with active the DDoS standard service.

Figure 7 – Monitor mitigation metrics available in Azure

To report generation, regarding the actions undertaken to mitigate DDoS attacks, you must configure the diagnostics settings.

Figure 8 – Diagnostics Settings in Azure Monitor

Figure 9 - Enable diagnostics of Public IP to collect logs DDoSMitigationReports

In the diagnostic settings it is possible to also collect other logs relating to mitigation activities and notifications. For more information about it you can see Configure DDoS attack analytics in the Microsoft documentation. The metrics for the DDoS protection Standard are maintained in Azure for Moniotr 30 days.

Figure 10 – Attack flow logs in Azure Log Analytics

How to test the effectiveness of the solution

Microsoft has partnered withBreakingPoint Cloud and, thanks to a very intuitive interface, it allows you to generate traffic, towards the public IPs of Azure, to simulate a DDoS attack. In this way you can:

  • Validate the effectiveness of the solution.
  • Simulate and optimize responses against incident related to DDoS attacks.
  • Document the compliance level for attacks of this type.
  • Train the network security team.

Costs of the solution

The Basic tier foresees no cost, while enabling the DDoS Protection Standard requires a fixed monthly price (not negligible) and a charge for data that are processed. The fixed monthly price includes protection for 100 resources, above which there is an additional unit cost for each protected resource. For more details on Azure DDoS Protection Standard costs you can see the Microsoft's official page.

Conclusions

The protection from DDoS attacks in Azure allows us to always have active a basic protection to deal with such attacks. Depending on the application criticality, can be evaluated the Standard protection, which in conjunction with a web application firewall solution, allows you to have full functionality to mitigate distributed denial-of-service attacks.

Azure Monitor: introduction to monitor service for virtual machines

In Azure Monitor was introduced a new service that allows you to monitor virtual machines, called Azure Monitor for VMs. This service analyzes the performance data and the status of virtual machines, makes the monitor of the installed processes and examines its dependencies. This article shows the characteristics of the solution and describes the procedure to be followed to effect the activation.

Features of the solution

The service Azure Monitor for VMs is divided into three different perspectives:

  • Health: the logical components present on board of the virtual machines are evaluated according to specific pre-configured criteria, generating alerts when certain conditions are met. This feature, at the moment, is present only for systems that reside in Azure.
  • Performance: shows summary details of performance, from the guest operating system.
  • Map: generates a map with the interconnections between the various components that reside on different systems.

This solution can be used on Windows and Linux virtual machines, regardless of the environment in which they reside (Azure, on-premises or at other cloud providers).

Azure Monitor for VMs requires the presence of a workspace of Log Analytics. Since this is a feature currently in preview, workspace are supported in these regions: West Central US, East US, West Europe and Southeast Asia. Enabling a Log Analytics workspace can occur according to these modes:

To identify the operating systems that are supported by this solution, please visit the Official Microsoft documentation.

 

How to enable Azure Monitor for VMs

To enable the solution for a single virtual machine, from the Azure Portal, it is possible to proceed by accessing the section Insights from the virtual machine:

Figure 1 – Enabling Azure Monitor for VMs on a single VM

Enabling the solution on a single virtual machine it is possible to choose which Log Analytics workspace use and possibly create a new one. The advice is to precede before with the creation of workspace, so you can assign a meaningful name. The workspace of Log Analytics must be configured as follows:

  • You must have installed the solutions ServiceMap and InfrastructureInsights. The installation of this solutions can be done via JSON templates, according to the instructions in this document.

Figure 2 – Presence of solutions ServiceMap and InfrastructureInsights

Figure 3 – Collecting the performance counters enabled on Log Analytics workspace

Azure Monitor for VMs requires Log Analytics agent on virtual machines, also the functionality of Map requires the installation of the Microsoft Dependency agent. This is an additional agent which relies on Log Analytics agent for the connection to the workspace.

If you want to enable the solution for systems in Azure, you can activate the Dependency agent using the appropriate extension, that do the installation. For virtual machines that reside on Azure you must install it manually or via a solution that automates the deployment (such as System Center Configuration Manager).

To enable this feature automatically on new virtual machines created in Azure environment and achieve a high level of compliance you can also use the Azure Policy. Through the Azure Policy you can:

  • Deploy the Log Analytics agent and Dependency agent.
  • Having a report on the status of compliance
  • Start remediation actions for non-compliant VMs.

Figure 4 – Adding an Assignment

Figure 5 - Initiative definition to enable Azure Monitor for VMs

Figure 6 - Check of the state of compliance of the Policy

 

Consulting data collected from the solution

To analyze and identify critical operating system events, detect suboptimal performance and network issues, you can refer to the data provided by this solution directly from VM or using Azure Monitor, in case you want to have an aggregated view of the various virtual machines. All this allows you to detect and identify if problems are related to specific dependencies on other services.

Figure 7 – State of Health of a single virtual machine

Figure 8 – Performance gathered from multiple VMs, accessible by Azure Monitor

Figure 9 – Dependencies Map of various services present on VMs, accessible by Azure Monitor

For more information about using the features of Health you can consult this Microsoft documentation, while the article View Azure Monitor for VMs Map shows how to identify and analyze the dependencies detected from the solution.

Costs of the solution

By activating the solution Azure Monitor for VMs, the data collected by the virtual machines are sent and maintained in Azure Monitor and can depend on several factors, such as the number of logical disks and network adapters. The costs are those related to Azure Monitor, which has costs on the basis of the following elements:

  • Data ingested and collected.
  • Number of health monitored criteria.
  • Alert rule created.
  • Notifications sent.

 

Conclusions

The service Azure Monitor for VMs allowing you to have a fully integrated tool in Azure to monitor the virtual machines and to obtain a complete control of systems, regardless of where they reside. This solution is also particularly useful to conduct troubleshooting operations in a simple and immediate way. This service, although it is currently in preview, is already full enough and it will be enriched soon with new features.