Azure Monitor Alerting Session at MP University

MP University is free 1 day online training event that focuses on SCOM and Azure. As you know for the past several weeks I have been blogging about Azure Monitor Alerts so when I was offered the opportunity to do online session on that topic – I was all in. Besides blogging I also like presenting. Being able to do that online is good for me due to my busy schedule (both personal and work one). So if you are interested on that topic and seeing more of what I have blogged or any of the other sessions in the event please go here and sign up.

Azure Monitor Alert Series – Part 10

We are getting to one of the last blog post of these series. I still haven’t decided how much more I will publish but this one won’t be the last one. If not else there will be at least another one after this one. Today we will cover Azure Sentinel alerts. To be honest I was not sure if I will cover these alert types. I have tons of feedback for Azure Sentinel in general and specifically for their alerts. That feedback focuses more on APIs and alignment with other Azure teams. I am sure that from security functionality perspective the service is doing great. But let’s start looking at Azure Sentinel alerts and I will express my feedback trough the blog post.

Continue reading “Azure Monitor Alert Series – Part 10”

Azure Monitor Alert Series – Part 9

We continue our journey in Azure Monitor Alerts. This time we will cover alert type that is not part of Azure Monitor specifically but my opinion is that every Azure alert should integrate somehow with Azure Monitor so we have one consistent alert experience. The alert type that we will cover today somehow achieve this. This alert type is cost management alert or budget alert.

Continue reading “Azure Monitor Alert Series – Part 9”

Set Per Table Retention in Log Analytics via ARM Template

This will be a short blog post but I hope still interesting one as I will provide example how to set per table retention in Log Analytics. Several weeks ago the Azure Monitor team has provided option to set retention period per table instead of just having retention period for the whole workspace.

Update 17.10.2019: If you set per table retention you will not be able to delete the workspace. You will get web request error 500 when you try that in the portal. To delete the workspace you will have to reset the value for every table with tool like ARM client. Example with Perf table below:

ARMClient.exe put "/subscriptions/22391568-8971-4320-b4be-08beb4919e9a/resourcegroups/loganalytics/providers/microsoft.operationalinsights/workspaces/ws000001/tables/Perf?api-version=2015-03-20" "{'properties':{'retentionInDays':null}}"

Update 17.10.2019: Just a few hours later Azure Monitor team fixed the issue. That is what I call fast support. Kudos to Azure Monitor team for being such proactive.

Continue reading “Set Per Table Retention in Log Analytics via ARM Template”

Azure Monitor Alert Series – Part 8

We are now on part 8 of these series. This blog post will be shorter compared to the others due to the nature of the alert we will cover in it. This time we will explore Azure Monitor for VMs alerts. Before proceeding to the alert part I should mention that Azure Monitor for VMs is in public preview. Always proceed with caution when using preview features as there might be some things missing compared to services/features that are general available.

Update 16.10.2019: A few hours after I have released this blog post the following announcement was made Updates to Azure Monitor for virtual machines (preview) before general availability release

To understand better the Azure Monitor for VMs alerts we need to understand better how the solution works. The solution itself consists of 3 major features:

  • Gathering performance data trough performance counters from Windows and Linux VMs
  • Visualizing maps of TCP communication on the VMs (via Service Map)
  • Discovering and showing VM health data
Continue reading “Azure Monitor Alert Series – Part 8”