Category Archives: Log Analytics

OMS Log Analytics: How to collect Virtual Machine Manager jobs

In OMS there is a new solution Virtual Machine Manager (VMM) Analytics that allows to centralize inside Log Analytics, jobs from one or more instances of Virtual Machine Manager to have an overview of all activities performed by VMM in the virtualization infrastructure.

In this article we will see how to enable and configure this new solution so you can use the tools offered by the OMS platform to more easily diagnose any issues related to the activities carried out on the virtualization hosts and virtual machines using Virtual Machine Manager. Furthermore, through the power of language to create queries in OMS you can search and correlate data collected by others OMS solutions in a simple and functional way.. Don't overlook the possibility of implementing automated tasks through runbooks in Azure Automation for the resolution of any issues.

In order to implement the solution Virtual Machine Manager (VMM) Analytics you will need the following requirements:

  • Azure Subscription.
  • OMS Workspace where to deploy the solution.
  • Azure Automation Account with the presence of the Hybrid Worker role able to communicate with Virtual Machine Manager.
  • Credentials with read permission on the VMM server from which you want to collect information.

It is an open-source solution that can be included in the workspace OMS following this steps.

First, it is necessary to access the Azure Portal and select the subscription that contains the OMS workspace which you want to add the solution. To start the deployment of the solution simply access to its GitHub page and press the button Deploy to Azure. Automatically compare the template that requires the inclusion of the following parameters:

Figure 1 – Parameters required by the template of the solution

The template of the solution requires you to select, in addition to the basic information such as the name of the Subscription and the Resource Group, the name and the region of the OMS Workspace on which will be deployed the solution. Are also requests information relating to the Automated Account that will contains everything needed for the automation allowing the solution to catch the information relating to the Virtual Machine Manager system, whose name is specified as the last parameter.

At the end of the deployment of the solution inside the specified Automation Account will be created the runbook called vmmanalytics, thanks to which is carried out the import in Log Analytics of VMM jobs.

Figure 2 – Runbook used by Virtual Machine Manager solution (VMM) Analytics

Now you need to set the variable LastRunTime in the Assets with a string expressed in the form “yyyy-MM-ddTHH:mm:ss.fffffffZ“. This variable specifies the time from which the runbook will begin to collect the jobs of VMM. At every execution of the runbook this variable is updated automatically. As you can see from the following image there are other variables already populated automatically by the process of deployment of the solution:

Figure 3 – variables used by the runbook of the solution

You also need to specify credentials with the appropriate permissions to read jobs from the instance of Virtual Machine Manager:

Figure 4 – Required credentials for collecting VMM jobs

The runbook vmmanalytics can be run manually, but to import in an automatic and recurring way the jobs of VMM in Log Analytics you can create a specific schedule to suit your needs:

Figure 5 – Schedule creation

Afterwards you must attach schedule created to the runbook vmmanalytics and set which Hybrid Worker use to contact the Virtual Machine Manager instance.

Figure 6 – Scheduling and execution parameters of the Runbook

After successfully completing the first run of the Runbook, using the OMS portal you can access the solution Virtual Machine Manager Analytics which includes a number of useful reports to display in a simple and intuitive way the data collected from instances of Virtual Machine Manager.

Figure 7 – Overview of VMM Analytics solution

The dashboard of the solution also allows you to define the time range to filter, more accurately and to suit your needs, the jobs collected from Virtual Machine Manager.

Figure 8 – Defining the Time Range

Conclusions

Thanks to this new solution is made available to the VMM administrators the potential of the OMS platform. This is very useful because you can hypothesize scenarios where are merged into a single OMS workspace jobs from more instances of Virtual Machine Manager. It may be possible to configure OMS alerts to notify working groups on the state of execution of the job performed using VMM and undertake remediations in the face of problems. Also by correlating jobs collected with this solution with information from others OMS solutions as Capacity and Performance and Change Tracking you can simplify troubleshooting and you can more easily identify the causes of any problems. Virtual Machine Manager (VMM) Analytics is an open-source solution so you can contribute to its development by directly accessing its GitHub page.

To test and evaluate for free Operations Management Suite (OMS) you can access this page and select the mode that is most appropriate for your needs.

OMS and System Center: What's New in September 2017

Even the month of September is full of news and different updates have affected Operations Management Suite (OMS) and System Center, also thanks to Ignite 2017, the annual Microsoft conference of this week in Orlando. This article contains a summary accompanied by useful references for further study.

Operations Management Suite (OMS)

  • OMS Customers are using the solution Security & Compliance are given the option to use the features found in ’Azure Security Center in order to have a unified management of security and protection of their systems, all without additional cost. This is particularly useful to be able to manage workloads across hybrid environments, regardless of where they reside, on Azure, on-premises, or on other public clouds. Within the Azure Security Center will be automatically handle the security of the systems that are already connected to the solution OMS Security & Compliance and you can add additional machines simply by installing the Microsoft Monitoring Agent. To see details of the features offered I invite you to consult the publication OMS customers can now use Azure Security Center to protect their hybrid cloud workloads. In this regard it is worth noting that to enable the features just in time VM access, dynamic application controls and network threat detection of Azure resources you must select pricing tier Security Center Standard for the Subscription or the Resource Group.

Figure 1 – List of features for the protection of hybrid environments

  • The Azure portal now includes two features related to Operations Management Suite (OMS): Workspace Settings and View Designer. From the Azure portal you can access the settings of the workspace OMS as shown in the following figure:

    Figure 2 – Settings of the Workspace who are accessible from the Azure Portal

Also, the View Designer, that allows you to create custom views, is now accessible directly from the Log Analytics section of Azure portal:

Figure 3 – View Designer available directly from the portal Azure

  • As already announced in a dedicated article the update of Log Analytics has introduced a new powerful query language. In this useful article highlighted the main changes introduced by the new language.
  • Another interesting new feature is the ability to run query not only on single workspace OMS, but in a transversal way across multiple workspace. To learn more about you can see Query across resources.
  • Article Monitoring SQL Azure Data Sync using OMS Log Analytics returns the configuration to be carried out in order to monitor the solution SQL Azure Data Sync using a custom solution OMS. Azure SQL Data Sync allows you to synchronize data in both directions or unidirectional between different Azure SQL database andor to SQL database on-premises. With this procedure you can detect error conditions or warning in the synchronization process so simple, thanks to OMS.
  • To help you to track the Big Data application involving different technologies was announced in preview the ability to monitor cluster HDInsight with Azure Log Analytics . In this video there are the details of how HDInsight customers can monitor and debug Hadoop, Spark, HBase, Kafka, Interactive Query and cluster Storm.

Solutions

  • In OMS there is a new solution Virtual Machine Manager (VMM) Analytics for centralizing in Log Analytics the jobs of one or more Virtual Machine Manager to have an overall view of the health and performance of the virtualization infrastructure managed by System Center Virtual Machine Manager.

Figure 4 – Overview of VMM Analytics solution

Agent

  • Released a new version of the OMS agent for Linux systems that mainly has solved some bugs and introduced an updated version of some of the main components. For more details and to get the updated version please refer to the official GitHub page OMS Agent for Linux GA v 1.4.1-45

Figure 5 – Bug fixes and what's new for the OMS agent for Linux

 

System Center

System Center Configuration Manager

  • Released the Cumulative Update 6 for UNIX and Linux clients of Configuration Manager. It is a new version of the client that fixes several bugs and adds support for new Linux distributions. This release also removed support for Unix and Linux distributions even obsolete discontinued by vendor. Customers using the SCCM clients with these versions may continue to use the client updated to Cumulative Update 5. The release announcement and further details can be found in this article.
  • During Ignite 2017 was announced an interesting feature called co-management that interest the management of the device using either System Center Configuration Manager and Microsoft Intune. With Windows 10 Fall Creators Update there is the possibility to make the join of the device both to the Active Directory domain (AD) on-premises and to Azure AD in the cloud. This expands the possibilities for management of devices using the Configuration Manager client and the MDM agent of Intune. To deepen this topic, you can look in the video section of the Ignite site the sessions with the following reference codes: BRK3057, BRK3075, BRK3076 and BRK2079.

Figure 7 – Co-management devices with SCCM and Intune

 

System Center Updates Publisher

By accessing this page you can select the way you find most suitable to test and evaluate free Operations Management Suite (OMS).

OMS and System Center: What's New in August 2017

This article summarizes the main new features and includes upgrades, concerning Operations Management Suite (OMS) and System Center, that were announced during the month of August.

Operations Management Suite (OMS)

Log Analytics

  • For Log Analytics was published what may be called the most significant upgrade from the date of issue. Among the main changes introduced by this update there is a new powerful query language, the introduction of the new Advanced Analytics portal and greater integration with Power BI. For more details, I invite you to consult the specific article Log Analytics: a major update evolves the solution.

Figure 1 – Upgrade of Log Analytics

Agent

  • The agent who for Linux systems is constantly evolving and we released a new version that has fixed some bugs and improved error handling during onboarding of agent for easier troubleshooting: OMS Agent for Linux GA v 1.4.0-45

Figure 2 – Bug fixes and what's new for the OMS agent for Linux

Solutions

  • The OMS solution Network Performance Monitor has been improved and enhanced with the following new features:
    • The diagnostic agent: the solution now provides the ability to monitor in a specific view the health status of various agents deployed on the network and in case of problems NPM reports useful diagnostic information for troubleshooting.
    • Hop-by-hop latency breakdown: the topology map of the network has been enriched with details of timings found between two specific points.
    • Availability on the Azure Portal: as well as continuing to be available from OMS can be added from the Marketplace Azure and used directly by the Azure Portal.
    • Presence in additional region of Azure: the solution is now also available for the region Azure West Central US.

For more details see the announcement Improvements to the who Network Performance Monitor.

  • The emerging technology is becoming more widespread and monitor containers Docker becomes an essential component. For this reason the OMS team announced the availability of the new solution Container Monitoring that allows you to:
    • Display in a unique location information for all hosts container.
    • Learn which containers are running, where I am and with which image.
    • See audit information concerning action taken on container.
    • View and search logs for troubleshooting without needing access to hosts Docker.
    • Locate the containers that are consuming an excessive amount of resources on the host.
    • Display performance information centrally about the container about CPU usage, of memory, storage and network.

Figure 3 – Synthesis pathway of solution Container Monitoring

Full details on the solution Container Monitoring you can consult them in the document Container Monitoring solution in Log Analytics.

  • Released in preview the new solution for the monitoring of Azure Logic Apps. The solution displays various information about the status of logic app and then drill down to see details useful for troubleshooting. All aspects of this solution you can consult them in Microsoft's official documentation.

Security and Audit

  • The baseline assessment of OMS Security is enhanced with functionality Web security baseline assessment that was announced in public preview and lets you scan the web server with Internet Information Services (IIS) to check for security vulnerabilities and provides useful recommendations regarding the correct environment setup. The document Baseline Assessment in Operations Management Suite Web Security and Audit Solution shows additional information about.

Figure 4 – Assessment dashboard of Web security baseline

 

System Center

System Center Configuration Manager

  • Last month it was released version 1706 for the Current Branch (CB) System Center Configuration Manager as described in the article OMS and System Center: What's New in July 2017. In date 8 August was released a package update to correct some errors that were encountered during the first deployment, but this package introduced problems therefore on 11 August has been replaced with a new version. For those who have updated SCCM to version 1706 between August 8 and August 11 you need to install an additional update as documented in Microsoft knowledge base article Update for System Center Configuration Manager version 1706, first wave. This update can be installed by accessing the node "Updates and Servicing" of the SCCM console. A further update will be released in the coming week to who made the SCCM update to version 1706 prior to August 8.
  • Released version 1708 for the branch Technical Preview of System Center Configuration Manager: Update 1708 for Configuration Manager Technical Preview Branch – Available Now!. I remind you that the releases in the Technical Preview Branch allows you to evaluate in preview new SCCM functionality and is recommended to apply these updates only in test environments.

System Center Operations Manager

Following the news about the SCOM Management Pack 2016:

  • Advanced Threat Analytics 1.7 Management Pack version 1.7.1.1.
  • Service Map Management Pack in public preview: Thanks to this new MP you can integrate maps are created dynamically by the OMS Service solution Map with diagrams of the Distributed Application in Operations Manager to ensure that the latter are dynamically generated and maintained.

For more information I invite you to consult related documentation available online.

Figure 5 – Integration of the Service Map of who and the SCOM Distributed App

  • Available a hotfix to solve some problems related to the WMI monitor health.

Log Analytics: a major update evolves the solution

Last week Microsoft began releasing what may be termed the most significant update Log Analytics from date of issue. Among the main changes introduced in the new version of Log Analytics are a powerful new query language, the introduction of the new Advanced Analytics portal and greater integration with Power BI. In this article we will see how to upgrade and the main features of the new features.

How to update Log Analytics

The upgrade process is very simple and is gradually affecting the workspace who present in all region of Azure. When the update is available for your workspace you will see a notification in the portal banner OMS or directly in the Log Analytics of the portal Azure:

Figure 1 – Banners that notifies the availability of Log Analytics

With a simple click on the banner leads to the following summary screen that summarizes the changes introduced by the update and that you use to start the upgrade process by selecting the appropriate button:

Figure 2 – Upgrade of Log Analytics

The upgrade must be performed by an administrator of the workspace who and the upgrade process takes a few minutes, at the end of which all artifacts like saved searches, the alert rule, computer groups and views created by using the View Designer are automatically converted to the new language of Log Analytics. The research included in the solution are not converted automatically during the upgrade, but would like to convert on the fly and transparently to the user at the time of the opening of the same.

During the upgrade process creates a full backup of the workspace, useful in case there is a need to revert to the previous version. Recovery is possible directly from the portal OMS:

Figure 3 – Restore the workspace Log Analytics legacy

When this update is optional, but in the future will be forced by Microsoft by talking to advance the date of the conversion of the workspace.

New query building language

After upgrading you can take advantage of the potential of the new language for creating queries. We carry the main features:

  • This is a simple and easy-to-understand language where you can use constructs closer to natural language.
  • The output of a query can be correlated (piped) with other commands in order to create more complex queries than was possible with the previous language.
  • Supports the use of extended field calculated in real time and can be used to compose complex queries.
  • Improved advanced features that allow you to join tables based on multiple fields, inner join, outer joins and join using the extended field.
  • Are made available more functionality for operations involving functions based on date and time.
  • Use advanced algorithms for evaluation of patterns in dataset and compare different sets of data.
  • Supports inserting comments in queries, always useful when troubleshooting and to facilitate understanding of queries written by others.

Listed above are just some of the many new features that are introduced, but for more details about the new build Log Analytics query language I invite you to consult the official site specially created that contains a complete guide, tutorials and examples.

Figure 4 -Example of query written in the new language that creates a chart with daily alerts by severity

For those who already have a good familiarity with the previous generation of query language, you can use the converter that is added when upgrading your workspace and that converts queries written with language legacy in new language:

Figure 5 -Example of converting a query

Useful also Legacy to new Azure Log Analytics Query Language cheat sheet that allows you to make a quick comparison between the two languages bringing some statement of the most widely used.

Advanced Analytics Portal

With the introduction of new Advanced Analytics you can perform useful tasks when writing code that cannot be done directly from the portal of Log Analytics. Access to the portal Advanced Analytics can take place by selecting one of the following icons from Log Analytics Portal:

Figure 6 – Advanced Analytics Portal login

Thanks to this portal you get a better experience in interactive writing queries using a multi-line editing, emphasis on the context-aware syntax and a powerful integrated Viewer. The whole thing is very useful when troubleshooting, Diagnostics, trend analysis and to generate reports quickly.

Figure 7 – Query that computes and graphically displays the result of the CPU usage of a specific machine

With ease you can also create a quick visualization of the portal Advanced Analytics and make the pin in the same on a shared Azure Dashboard.

Integration with Power BI

Following this update you get even closer integration with Power BI, like Application Insights:

Figure 8 – Log Analytics integration scheme with Power BI

Through this integration you can use Power BI reports, publish and share them on PowerBI.com and enable automatic generation. For more details about I invite you to read the document Export Log Analytics data to Power BI.

 

Conclusions

This major upgrade of Log Analytics increases the potential of the tool allowing you to perform complex searches in a targeted and easy thanks to the new language introduced and enhances the potential of the solution due to better integration with Power BI. This new language and Advanced Analytics are already being used in Application Insights and this allows a homogeneous and consistent monitoring experience for different Azure services.

OMS and System Center: What's New in July 2017

We inaugurate a new series of articles that will be published on a monthly basis and that will reflect the main changes, updates and information released within the last month about System Center and Operations Management Suite (OMS). It will be a summary accompanied by references for any insights.

Operations Management Suite (OMS)

Agent

  • Released the updated version of the OMS agent for Linux systems that solved some bugs and introduced some new features useful to extend the capabilities of OMS: OMS Agent for Linux GA v 1.4.0-12.

Figure 1 – Bug fixes and what's new for the OMS agent for Linux

 

Protection and Disaster Recovery

  • In Azure Backup introduced the ability to instant recovery of files and folders using the VM backup Azure. This feature is available for both Windows and Linux virtual machines and allows you to act quickly without having to restore the entire VM to retrieve only certain items: Instant File Recovery from Azure VM backups is now generally available.

Figure 2 – Instant File Recovery

 

System Center

System Center Configuration Manager

  • Released the version 1706 for the Current Branch (CB) of System Center Configuration Manager that introduces new features and major improvements in the product.

Among the various new products made by this update mainly these issues emerge:

  • Ability to manage driver updates for Microsoft Surface.
  • Improving the user experience for Office updates 365.
  • Added the ability in hardware inventory to collect information about how to enable the SecureBoot and ownership of the TPM.
  • Important new capabilities in mobile device management in SCCM architectures associated with Microsoft Intune.

For more details about it you can see the article: Now Available: Update 1706 for System Center Configuration Manager.

The update will be available starting from the coming weeks and it will appear a notification on node "Updates and Servicing" the SCCM console when it was performed on automatic download. To force the update you can use this PowerShell script.

  • If you try to install a new Cloud Management Gateway (CMG) in Configuration Manager current branch version 1702 You may not be able to complete provisioning. In this regard has been released the hotfix described in KB 403015 (Provisioning not completed when creating a Cloud Management Gateway in System Center Configuration Manager version 1702).

 

System Center Operations Manager

Several SCOM Management Pack 2016 We released a new updated version:

OMS Azure Backup: new reporting functionality via Power BI

Recently introduced the ability to Backup to generate the reports necessary to Azure easily check the status of resource protection, details on the different backup jobs configured, the actual storage utilization and status of its alert. Particularly interesting is the ability to generate reports also cross subscription and cross Azure vault. All this is made possible by using Power BI allowing you to have a high degree of flexibility in the generation and customization of reports. To see the benefits of this feature and evaluate how to analyze data through Power BI I invite you to consult the post "Gain business insights using Power BI reports for Azure Backup". In this article we will analyze the necessary steps to configure reporting Azure Backup.

By logging in from Azure portal to Recovery Service Vault that contains the resources protected the message of the availability of this new feature:

Figure 1 – Notice of availability of the new reporting capabilities in Recovery Services vault

To enable the functionality you need to position yourself in the settings of Recovery Services vault and under "Monitoring and Reports" select "Backup Reports":

Figure 2 – Configuring reports

By selecting the "Configure" button starts the configuration process that requires two distinct steps. In the first step you must select the Storage Account on which will store the information needed for the generation of reports. There is also the possibility to send this information to a Log Analytics workspace. For each type of log, you can select the retention period, which applies only to information that is located on the Storage Account and not to those invited to the workspace OMS. By setting to 0 days retention period the data is never removed from the Storage Account.

Figure 3 – Step 1: Diagnostics configuration

All ’ in the storage account is created an appropriate container to save logs from Azure Backup named insights-logs-azurebackupreport:

Figure 4 – Azure Backup container for jobs of Azure Backup

The second step of Setup requires access to the portal Power BI and the addition of’Azure Backup Content Pack performing the following steps:

Figure 5 – Adding Azure Backup Content Pack from the portal Power BI

At this point you must enter the name of the Account on which Storage, during the step 1 the configuration, you have chosen to save backup information.

Figure 6 – Storage Account name

In the next step, we require authentication using the account access key storage:

Figure 7 – Insert key to authenticate the Storage Account

After you complete these steps by the portal Power BI using the dashboard, you can consult all information relating to Azure Backup and if necessary customize reports to suit your needs.

Figure 8 – Azure Backup Dashboards present in the portal Power BI

Having chosen to send diagnostic information to Log Analytics you can, by accessing the portal OMS, query the repository by using the following query, and retrieve information about Azure Backup:

Figure 9 – Search for events of Azure Backup in Log Analytics

Using the View Designer, you can also build a custom view of OMS using data from Azure Backup collected in Log Analytics.

 

Conclusions

This new feature enables you to have complete control of your infrastructure and backup status to easily keep tabs on SLAs in compliance with the corporate compliance. All in easy way and using a fully managed cloud solution. All you need is a subscription account Azure storage and Power BI. Analyzing data collected through Power BI is also extremely flexible thanks to the extensive customization capabilities provided by the tool.

OMS Log Analytics: the Update Management solution for Linux systems

Using the Operations Manager Update Management Solution Suite (OMS) you have the ability to centrally manage and control the update status of systems in heterogeneous environments both Windows and Linux machines and independently from their placement, on-premises rather than in the cloud. In this article, we explored aspects of solution regarding Linux systems.

The Update Management solution allows you to quickly assess the status of updates available on all servers with the OMS agent installed and is able to start the process of installing the missing updates. Linux systems are configured to use this solution require in addition to the presence of ’ agent who Powershell Desired State Configuration (DSC) for Linux andHybrid Runbook Automation Worker (installed automatically).

The solution currently supports the following Linux distributions:

  • CentOS 6 (x 86/x 64) and CentOS 7 (x64).
  • Red Hat Enterprise 6 (x 86/x 64) and Red Hat Enterprise 7 (x64).
  • SUSE Linux Enterprise Server 11 (x 86/x 64) and SUSE Linux Enterprise Server 12 (x64).
  • Ubuntu 12.04 LTS and later (x 86/x 64).

In addition to work correctly you need the Linux system has access to an update repository. In this regard it is worth noting that at the moment there is a chance by who to select which updates to apply, but ’ all available updates are available from the update repository configured on the machine. To have more control over updates to apply you may evaluate the ’ using a custom update repository created and contains only the updates that you want to approve.

The following diagram shows the flow of operations being carried out by the solution to move towards compliance status and the workspace who to apply the missing updates:

Figure 1 – Flow of operations performed on Linux systems

  1. The agent who for Linux scans each 3 hours to detect missing updates and reports the outcome of the scan to the workspace who.

Figure 2 – OMS Dashboard Update Management solution

  1. The operator using the dashboard OMS can refer to update assessments and define the schedule for deployment of updates:

Figure 3 – Management of Update Deployment

Figure 4 – OMS Dashboard Update Management solution

In creating the Update Deployment is defined a name, the list of systems to be involved, that can be provided explicitly or by using a query of Log Analytics, and scheduling.

  1. The component Hybrid Runbook Worker running on Linux systems checks for maintenance Windows and the availability of any deployment to apply. In this regard it is good to specify that enabling the solution to Update Management every Linux system connected to the workspace who is automatically configured as Hybrid Runbook Worker to perform runbook created to deploy updates. Also every system managed by the solution is a Hybrid Runbook Worker Group within the Automation OMS Account following the naming convention Hostname_GUID:

Figure 5 – Hybrid Worker Groups

  1. If a machine has an Update Deployment (as a direct member or because it belongs to a specific group of computers) on it starts the package manager (Yum, Apt, Zypper) to install updates. Installing updates is driven by who through specific runbook Automation within Azure. These are not visible in Azure runbook Automation and require no configuration by the administrator.

Figure 6 – Azure Automation Account used by the solution of Update Management

  1. After Setup OMS agent for Linux and the basic status of Update Deployment and compliance to the workspace who.

Conclusions

Microsoft Operations Management Suite is a tool that lets you manage and monitor heterogeneous environments. Still today, unfortunately, you are faced to the debate on the real need to maintain regularly updated Linux systems, but considering some recent security incident caused by outdated systems, It is evident that it is good to have a solution that allows you to manage updates for Linux machines. The solution to Update Management of OMS is constantly evolving, but already today enables us to control and manage the distribution of updates also on Linux systems in a simple and efficient way.

For more details, I invite you to consult Microsoft's official documentation Solution for Update Management of OMS.

To further explore this and other features you can activate free OMS.

 

OMS Log Analytics: How to monitor Azure networking

Inside there is the possiblity to Log Analytics of solution specifications that allow the monitor to some components of the network infrastructure that exists in Microsoft Azure.

Among these solutions are Network Performance Monitor (NPM) which was deepened in the article Monitor network performance with the new solution of OMS and that lends itself very well to monitor the health status of, the availability and accessibility of the networking of Azure. They are also currently available in the following gallery of Operations Management Suite solution that enrich the monitoring potential side OMS:

  • Azure Application Gateway Analytics
  • Azure Network Security Group Analytics

Enabling Solution

By accessing the portal who you can easily add these solutions present in the gallery by following the steps that are documented in the following article: Add Azure Log Analytics management solutions to your workspace (OMS).

Figure 1 – Analytics Solution Azure Application Gateway

Figure 2 – Analytics Solution Azure Network Security Group

Azure Application Gateway Analytics

The Azure Application Gateway is a service that you can configure in Azure environment can provide Application Delivery functionality ensuring an application layer balance 7. For more information regarding ’ Azure Application Gateway can be found in the official documentation.

In order to collect diagnostic logs in Log Analytics you need to position yourself in the Azure portal resource Application Gateway that you want to monitor, and then under Diagnostics logs Select sending the logs to the workspace Log Analytics should:

Figure 3 – Application Gateway Diagnostics settings

For the Application Gateway you can select the following log collection:

  • Logs that are related to active logins
  • Performance data
  • Firewall log (If the Application Gateway has the Web Application Firewall enabled)

After you complete these simple steps designed to walk easily installed solution who data sent from the platform:

Figure 4 – Azure Application Gateway Analytics Overview who Portal

All ’ within the solution, you can view a summary of the collected information and selecting the individual charts you access details about the following categories:

  • Application Gateway Access log
    • Client and server errors in access log of Application Gateway
    • Applications received by Application Gateway for now
    • Failed requests per hour
    • Errors detected for user agent

Figure 5 – Application Gateway Access log

  • Application Gateway performance
    • State of health of the hosts that meet the requirements of the Application Gateway
    • Failed requests of Application Gateway expressed as maximum number and with the 95 percentile

Figure 6 – Application Gateway performance

  • Application Gateway Firewall log

 

Azure Network Security Group Analytics

In Azure, you can check the network communication via the Network Security Group (NSG) which aggregates a set of rules (ACL) to allow or deny network traffic based on direction (inbound or outbound), the protocol, the address and the source port or the destination address and port. The NSG are used to control and protect the virtual network or network interfaces. For all the details about the NSG please visit the Microsoft's official documentation.

In order to collect diagnostic logs of Network Security Group in Log Analytics you need to position yourself in the Azure Portal Resource Network Security Group that you want to monitor, and then under Diagnostics logs Select sending the logs to the workspace Log Analytics should:

Figure 7 – Enabling NSG Diagnostics

Figure 8 – Diagnostic configuration NSG

On the Network Security Group you can collect the following types of logs:

  • Events
  • Counters related to rule

At this point in the OMS portal home page you can select the tile by Overview of solution Azure Network Security Group Analytics to access data from the NSG collected by platform:

Figure 9 – Azure Network Security Group Analytics Overview OMS Portal

The solution provides a summary of the logs collected by splitting them into the following categories:

  • Network security group blocked flows
    • Rules of the Network Security Group with blocked traffic
    • Network routes with traffic blocked

Figure 10 – Network security group blocked flows

  • Network security group allowed flows
    • Rules of the Network security group with allowed traffic
    • Directives of the network with traffic rules allowed

Figure 11 – Network security group allowed flows

The methodology of sending diagnostic logs of Application Gateway and Network Security Group of Azure to Log Analytics has changed recently by introducing the following advantages:

  • Writing the log in log Analytics takes place directly without having to use the storage account as repository. You can choose to save the diagnostic logs on the storage account, but it is not necessary for the ’ sending data to OMS.
  • The latency between the time of log generation and their consultation in Log Analytics has been reduced.
  • Have been greatly simplified the steps required to configure.
  • All Azure Diagnostics were harmonised as format.

Conclusions

Thanks to a more complete integration between Azure and Operations Management Suite (OMS) You can monitor and control the status of the components of the network infrastructure built on Azure comprehensively and effectively, all with simple, intuitive steps. This integration of platform Azure with OMS is surely destined to be enriched with new specific solutions for other components. For those interested to further deepen this and other features of the who remember that you can try the OMS for free.