Azure Monitor Alert Series – Part 10

We are getting to one of the last blog post of these series. I still haven’t decided how much more I will publish but this one won’t be the last one. If not else there will be at least another one after this one. Today we will cover Azure Sentinel alerts. To be honest I was not sure if I will cover these alert types. I have tons of feedback for Azure Sentinel in general and specifically for their alerts. That feedback focuses more on APIs and alignment with other Azure teams. I am sure that from security functionality perspective the service is doing great. But let’s start looking at Azure Sentinel alerts and I will express my feedback trough the blog post.

Continue reading “Azure Monitor Alert Series – Part 10”

Azure Monitor Alert Series – Part 9

We continue our journey in Azure Monitor Alerts. This time we will cover alert type that is not part of Azure Monitor specifically but my opinion is that every Azure alert should integrate somehow with Azure Monitor so we have one consistent alert experience. The alert type that we will cover today somehow achieve this. This alert type is cost management alert or budget alert.

Continue reading “Azure Monitor Alert Series – Part 9”

Set Per Table Retention in Log Analytics via ARM Template

This will be a short blog post but I hope still interesting one as I will provide example how to set per table retention in Log Analytics. Several weeks ago the Azure Monitor team has provided option to set retention period per table instead of just having retention period for the whole workspace.

Update 17.10.2019: If you set per table retention you will not be able to delete the workspace. You will get web request error 500 when you try that in the portal. To delete the workspace you will have to reset the value for every table with tool like ARM client. Example with Perf table below:

ARMClient.exe put "/subscriptions/22391568-8971-4320-b4be-08beb4919e9a/resourcegroups/loganalytics/providers/microsoft.operationalinsights/workspaces/ws000001/tables/Perf?api-version=2015-03-20" "{'properties':{'retentionInDays':null}}"

Update 17.10.2019: Just a few hours later Azure Monitor team fixed the issue. That is what I call fast support. Kudos to Azure Monitor team for being such proactive.

Continue reading “Set Per Table Retention in Log Analytics via ARM Template”

Azure Monitor Alert Series – Part 8

We are now on part 8 of these series. This blog post will be shorter compared to the others due to the nature of the alert we will cover in it. This time we will explore Azure Monitor for VMs alerts. Before proceeding to the alert part I should mention that Azure Monitor for VMs is in public preview. Always proceed with caution when using preview features as there might be some things missing compared to services/features that are general available.

Update 16.10.2019: A few hours after I have released this blog post the following announcement was made Updates to Azure Monitor for virtual machines (preview) before general availability release

To understand better the Azure Monitor for VMs alerts we need to understand better how the solution works. The solution itself consists of 3 major features:

  • Gathering performance data trough performance counters from Windows and Linux VMs
  • Visualizing maps of TCP communication on the VMs (via Service Map)
  • Discovering and showing VM health data
Continue reading “Azure Monitor Alert Series – Part 8”

Azure Monitor Alert Series – Part 7

On this blog post we will cover Azure Monitor Log Alerts. You might know them as Log Analytics alerts but a long time has passed when Log Analytics was standalone service that was not part of Azure Monitor. You may have noticed some UI improvements of those but the biggest improvements were actually under the hood. To my opinion this migration was executed very good with a lot of issues for the customers. No it was not perfect migration but taking into considerations all the complexity of such migrations I would say it was well executed and with thought for the customers. To be honest I will also say that these types of alert are my favorite. The simple reason for that is because by using Kusto queries I have way more room to improvise. Of course the alerts have their own downsides as well but that is the beauty of Azure Monitor alerts. You have flexible choices without being forced to specific one. Enough with the flattery and continue to the interesting parts of this blog post.

As I have mentioned before in Part 1 of the series we have two sub types:

  • Number of results
  • Metric Measurement
Continue reading “Azure Monitor Alert Series – Part 7”