Azure Monitor Step by Step Deployment Part 2
Azure Monitor- Step-by-Step-Deployment-Part 2
In this post lets see the following,
- How to enable monitoring on non azure VM
- Create computer groups
- Enable Performance counters and windows event logs
- Create an alert when a DB is down from Event viewer logs.
Azure Monitor can collect data directly from physical or virtual Windows computers in your environment into a Log Analytics workspace for detailed analysis and correlation. We can collect data from a datacenter or other cloud environments.
To Download the agents ,Workspace ID & Primary Key
INSTALLING THE AGENT ON NON AZURE VM
Run the downloaded agent on the target VM
If you have proxy setup, click on advanced and enter the details
Please note the below URLS should be allowed in firewall and proxy(If you have)
Validate the Agent Installation
Check under Agent management page to see if the agent is reporting
ENABLE DATA COLLECTION
By default the data collections will not be enabled, You need to enable the required Event logs, Performance counter, IIS logs etc. Now lets see how to enable the collections,
click on advanced settings Under Data–>Windows event logs
Type the required events logs to capture as below
In this example I have enabled the application logs.
Similarly enable the required performance counter
Modify the Sample interval as required. You can select a maximum of 1800 seconds as sample interval.
And remember to save the selected collections.
CREATE COMPUTER GROUP
Saved Groups are groups that are created from a search query. Any query in search that returns a list of computers can be saved as a Saved Group. Go to Search. Enter a query that returns a list of computers. By choosing to save the query, you can enable the toggle to save the query as a computer group. You can view and manage all your Saved Groups in this page.
In this query I have selected the VMS with windows as os family, Remember you need to have distinct computer in the query to be able to save it as computer group
VMComputer | where OperatingSystemFamily contains “Windows” | distinct Computer
Enter the query in logs and click on save.. Select save as function and enable the “save this query as computer group”
As we mentioned in the part 1 post, We can configure alerts. This post lets see how to enable alerts for windows evet logs.
Create new alert rule
Configure the signal logic and you can either choose existing or create a custom log search
In this search query, Enter the query which needs to be filtered as signal logic
Event | where RenderedDescription has “service entered the stopped state.”
Below is the sample alert received in Azure app and you can also receive as a PUSH notification
Author : Amarnath Rajendran