Enable performance counter for Log analytics workspace and KUSTO Query

 Enable performance counter for Log analytics and execute KUSTO Query

 

This article states you about how can you execute log analytics query or KUSTO query over log analytics workspace. A KUSTO query is combination of SQL,PowerShell and bash and becomes KQL (Kusto query language).

Prior to this please go through to this which is about how to create log analytics workspace.

How to create log analytics workspace in Azure

Setup Microsoft monitoring agent on Virtual machine in Azure

Configure MMA agent for multiple VM’s in Azure - An Easiest Way

Pre-requisite

The following must be present for this solution:

1.     You should have Log analytics workspace already configured in your Azure subscription.

Log analytics workspace

Once you are done with creation of LAW, go to that and find an option logs on t eleft side of the panel as you can see in an image LA.jpg below marked as RED

There I’ve executed a query which is describes about list the number of computers sending logs, each hour. For that purpose I selected a table named HeartBeat which contains a potential information about the virtual machine connected to Log analytics workspace aka LAW

Go to Data -> Windows Performance Counter -> Add the selected performance counter

And click on that. As soon as you click all those counter will be enable and will start sending telemetry to log analytics workspace on which you can query and get virtual machine performace information. Refer enable-counter.jpg

Once performance counter got enabled , it starts sending those information to Log Analytics workspace.

NOTE: If you don’t get any records while you execute query on PERF table than restart MMA agent persists on virtual machine or disconnect/connect from virtual machine option visible in Log Analytics Workspace.

You can easily see the performance of a virtual machine connected to Log analytics workspace aka LAW. For that select PERF table .

Another set of query is for Usage and rendering it in piechart. You can render it in table , scatterchart and with few more option

// Usage by data types

// Chart the amount of logs reported for each data type, today

Usage

| summarize count_per_type=count() by DataType

| sort by count_per_type desc

| render piechart

In an image below you should be able to understand how does it works in real use case.

KUSTO keywords in use

Refer an image below kusto-query-piechart.jpg below for the output in piechart.

NOTE:  Following query fetches information about "%committed bytes in use"  (in case of windows OS) for Linux base machine counter name will be "% Used Memory".

After executing the below query I get 3 rows as a result because If you remember I’ve enable performance counter for windows computer. Refer screen shot enable-counter.jpg

Perf

| where TimeGenerated > ago(30m)

| where  CounterName == "% Committed Bytes In Use"

| project TimeGenerated, CounterName, CounterValue, Computer 

| summarize UsedMemory = avg(CounterValue) by CounterName, bin(TimeGenerated, 10m), Computer

| where UsedMemory > 0

| render timechart

Refer an image result.jpg below

 

I hope it helps you a bit to understand how can we run KUSTO on LOG analytics workspace.

Categories: #Azure , #AzureMonitoring , Azure Cloud

Configure MMA agent for multiple VM’s in Azure - An Easiest Way 

 

This article states how to setup MMA agent earlier known as OMS agent or Log analytics Agent  to multiple vm’s through portal.

Prior to this please go through to this which is about how to create log analytics workspace.

how to create log analytics workspace in Azure
Setup Microsoft monitoring agent on Virtual machine in Azure

Pre-requisite

The following must be present for this solution:

1.     You should have Log analytics workspace already configured in your Azure subscription.

2.      For the MMA, an internet access must be there

3.      The MMA supports Windows Server 2008 SP1, Windows 7 SP1, and later.

4.      You can install the MMA on physical or virtual machines, but not Azure virtual machines — these     are connected via the Azure Portal.

Create Log analytics workspace

Follow this article how to create log analytics workspace in Azure.

Once you are done with creation of LAW, go to that and find an option virtual machines as you can see in an image LA.jpg below marked as RED

Connect existing virtual machine with workspace

In order to install the MMA agent , click on virtual machine property and choose your desire virtual machines to install MMA in a one go. I do have only one windows based virtual machine , in you case you may have more .Kindly refer an image install-mma-on-vm.jpg below

There can be few more virtual machines

You can select multiple machine from here also and these can be Windows and Linux based machine.

Once you click in that click on connect in order to install/configure MMA as depicted below in image connect-vm.jpg

 

Click on the connect button, Same way you have to do for other virtual machine

As soon as you click on connect a new message appears as “Connecting VM to Log Analytics. Please check back later for status update”. It should not take more than 4 mins.

After Successfully connected to  VM, it changes a status and shows as below screenshot connected-to-vm.jpg

Once it succeeds than go to virtual machine which you have create and follow the below steps to confirm weather MMA agent got installed or not.

Once setup is finished than go to you server and open control panel Microsoft Monitoring agent must persist there as appears in below image mma-control-panel.jpg

Click on that and it will open the following windows which confirms that The Microsoft Monitoring Agent has successfully connected to the log analytics service as shown in image installation-succeeded.jpg

Microsoft Monitoring agent is connected to Log Analytics Workspace

In upcoming article will share you

1.       How can we write Kusto query.

2.       Enable Windows and Linux performance counter from azure portal.

Categories: #Azure , #AzureMonitoring

Setup Microsoft monitoring agent on Virtual machine in Azure

 

This article states you about installation and configuration of  MMA agent earlier known as OMS agent or Log analytics Agent also

Prior to this please go through to this which is about how to create log analytics workspace.

how to create log analytics workspace in Azure

 

Why do we need MMA?

In order to send all information about virtual machines and other compute resources require an agent like Microsoft monitoring agent to collect monitoring data to measure the performance , event logs ,file based logs , insights and solutions and availability of their guest operating system and workload.

You can install Microsoft monitoring agent (MMA) on Azure based machine, OnPrem and other cloud as well.

Log Analytics agent

The Log Analytics agent collects monitoring information or data from the guest operating system and workloads of virtual machines in Azure, other cloud providers, and on-premises. It also gathers data into a Log Analytics workspace. An MMA agent also used by System Center Operations Manager(SCOM), and you can configure MMA agent for Multihome purpose like you can use an agent to configure with Four workspace.

For multihoming you can refer this link : https://docs.microsoft.com/en-us/archive/blogs/msoms/oms-log-analytics-agent-multi-homing-support

 

The Log Analytics agent for Windows is often referred to as Microsoft Monitoring Agent (MMA). The Log Analytics agent for Linux is often referred to as OMS agent.

Pre-requisite

The following must be present for this solution:

1.     You should have Log analytics workspace already configured in your Azure subscription.

2.     For the MMA, an internet access must be there

3.     The MMS supports Windows Server 2008 SP1, Windows 7 SP1, and later.

4.     You can install the MMA on physical or virtual machines, but not Azure virtual machines — these are connected via the Azure Portal.

Download the Microsoft Monitoring Agent (MMA)

You can download the agent from the Log Analytics (OMS) workspace in the Azure Portal:

1.     Open https://portal.azure.com/#home and go to Log analytics workspace.

2.     Click the advanced settings, and browse to Connected Sources.

3.     Click Windows Servers  and Download Windows Agent (64 bit)

4.     Choose either the 64-bit or 32-bit download depending on the machines you want to monitor. Create a document or a notepad file to save some important information. Store this document securely.

5.     In the workspace, there is a copy button to the right of Workspace ID. Click this button to save the Workspace ID. Save this to your document for later reuse.

6.     Click the copy button for Primary Key and save this to your document for later reuse.

Manually Install the Agent

In order to install the MMA agent , click on download windows agent as I have windows on prem machine. Kindly refer an image download-mma.jpg below

                                                          Download  Windows or Linux agent                                           

Copy the Workspace ID and Primary Key from the portal, We’ll be using in upcoming steps

Now click on the downloaded agent , a wizard will open and

          Run Setup to install the agent.

1.       On the Welcome page, click Next.
2.          On the License Terms page, read the license and then click I Agree.
3.          On the Destination Folder page, change or keep the default installation folder and then click Next.
4.          On the Agent Setup Options page, choose the Connect the agent to Azure Log Analytics       (OMS) option. Click Next.

Refer an image appears below mma-setup.jpg

6.       Copy the Workspace ID and Primary Key from the portal into the Workspace ID and the Workspace Key fields of the MMA installer.

7.      Note the Advanced button, where you can configure a proxy connection, including username and       password, if required.

8      Finish the wizard.

Once MMA gets connect with LA workspace it’ll start sending all telemetry to LA workspace ,which you can query through KUSTO query.

Once setup is finished than go to you server and open control panel Microsoft Monitoring agent must persist there as appears in below image mma-control-panel.jpg

Click on that and it will open the following windows which confirms that The Microsoft Monitoring Agent has successfully connected to the log analytics service as shown in image installation-succeeded.jpg

In upcoming article will share you

1     How can we write Kusto query.

2.       Connect multiple Azure Virtual machine with LA workspace from portal only.

3.       Enable Windows and Linux performance counter from azure portal.

Categories: #Azure , #AzureMonitoring