Send Subscription Activity Logs via ARM Template

At Ignite the Azure Monitor team has announced that you can now send subscription activity logs to Log Analytics. Wait? What? Isn’t that already available? And the answer yes it was available before but if we look closer you will see that the previous implementation was not very native to Azure. With the new implementation besides making the API better there are also other improvements like faster ingestion, ability to send different categories, etc.

Continue reading “Send Subscription Activity Logs via ARM Template”

Azure Monitor Alert Series – Part 9

We continue our journey in Azure Monitor Alerts. This time we will cover alert type that is not part of Azure Monitor specifically but my opinion is that every Azure alert should integrate somehow with Azure Monitor so we have one consistent alert experience. The alert type that we will cover today somehow achieve this. This alert type is cost management alert or budget alert.

Continue reading “Azure Monitor Alert Series – Part 9”

Set Per Table Retention in Log Analytics via ARM Template

This will be a short blog post but I hope still interesting one as I will provide example how to set per table retention in Log Analytics. Several weeks ago the Azure Monitor team has provided option to set retention period per table instead of just having retention period for the whole workspace.

Update 17.10.2019: If you set per table retention you will not be able to delete the workspace. You will get web request error 500 when you try that in the portal. To delete the workspace you will have to reset the value for every table with tool like ARM client. Example with Perf table below:

ARMClient.exe put "/subscriptions/22391568-8971-4320-b4be-08beb4919e9a/resourcegroups/loganalytics/providers/microsoft.operationalinsights/workspaces/ws000001/tables/Perf?api-version=2015-03-20" "{'properties':{'retentionInDays':null}}"

Update 17.10.2019: Just a few hours later Azure Monitor team fixed the issue. That is what I call fast support. Kudos to Azure Monitor team for being such proactive.

Continue reading “Set Per Table Retention in Log Analytics via ARM Template”

Azure Monitor Alert Series – Part 7

On this blog post we will cover Azure Monitor Log Alerts. You might know them as Log Analytics alerts but a long time has passed when Log Analytics was standalone service that was not part of Azure Monitor. You may have noticed some UI improvements of those but the biggest improvements were actually under the hood. To my opinion this migration was executed very good with a lot of issues for the customers. No it was not perfect migration but taking into considerations all the complexity of such migrations I would say it was well executed and with thought for the customers. To be honest I will also say that these types of alert are my favorite. The simple reason for that is because by using Kusto queries I have way more room to improvise. Of course the alerts have their own downsides as well but that is the beauty of Azure Monitor alerts. You have flexible choices without being forced to specific one. Enough with the flattery and continue to the interesting parts of this blog post.

As I have mentioned before in Part 1 of the series we have two sub types:

  • Number of results
  • Metric Measurement
Continue reading “Azure Monitor Alert Series – Part 7”

Azure Monitor Alert Series – Part 5

Another week another part of the Azure Monitor Alert series. This part put the end of alert based on Azure Activity log. Today we will have a look at:

  • Autoscale Alerts
  • Resource Health Alerts
Continue reading “Azure Monitor Alert Series – Part 5”