WHY- HOW to create Log Analytics Workspace in Azure

Create Log Analytics Workspace in Azure

 What is Log Analytics?

Log Analytics is an Azure service which collects and stores information/data from a set of different sources. Log analytics workspace is a place where we can store Azure Monitor log data These data are organized into tables created automatically. I’ll be showing that in this article how does it look like. Just for the sake of understanding I’ll be using term LA for Log analytics .

LA allows you to monitor, analyze, visualize and create alerts for that data.

Log Analytics diagram

1.      An image datasource.jpg depicted below can see a basic diagram of the Log Analytics service.

2.      The Agents send telemetry data from each guest OS to Log Analytics service

3.      Log Analytics service collect data and classifies the data into different tables

4.      With several tools, the End User can monitor, analyze, create reports, dashboards, alerts based on       the data.

An excerpt from microsoft.com https://docs.microsoft.com each workspace has its own data repository and configuration, and data sources and solutions are configured to store their data in a particular workspace. You require a Log Analytics workspace if you intend on collecting data from the following sources:

1.      Azure resources in your subscription

2.      On-premises computers monitored by System Center Operations Manager

3.      Device collections from Configuration Manager

4.      Diagnostics or log data from Azure storage

Sign in to Azure portal

Sign in to the Azure portal at https://portal.azure.com.

Create a log analytics workspace

In the Azure portal, click All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics workspaces.

 Click Add, and then select choices for the following items:

1.    Provide a name for the new Log Analytics workspace, such as dotnetpiperLAWorkspace. This name must be globally unique across all Azure Monitor subscriptions.

2.   Select a Subscription to link to by selecting from the drop-down list if the default selected is not appropriate.

3.   For Resource Group, choose to use an existing resource group already setup or create a new one.

4.  Select an available Location.

5.  If you are creating a workspace in a new subscription created after April 2, 2018, it will automatically use the Per GB pricing plan and the option to select a pricing tier will not be available. If you are creating a workspace for an existing subscription created before April 2, or to subscription that was tied to an existing Enterprise Agreement (EA) enrollment, select your preferred pricing tier. For more information about the particular tiers, see Log Analytics Pricing Details.

After providing the required information on the Log Analytics Workspace pane, click OK.

Refer an images create-la.jpg below to create LA

Once you click on Create New it will open a new windows to fill all essentials details Refer an image LA.jpg below for more understanding

You can verify the progress from the notification menu just in the right corner of portal as depicted below: 

Go to resource group whichever you have created , it should persist there.In the upcoming article we will see how to enable Windows and Linux performance counter from azure portal.

Upcoming Articles

·         Enable Windows and Linux performance counter from azure portal.

·         Install and Configure MMA agent with Log Analytic Workspace

·         LA based table structure and execution of KUSTO Query. 

Categories: #Azure , #AzureMonitoring

Delete an Azure Backup Recovery Services vault through ARM Portal - AZ-103

Delete an Azure Backup Recovery Services vault through ARM Portal

This article states deletion of a Microsoft Azure Backup Recovery Services (MARS) vault. There are various minute things that can be considerable while removing dependencies and then deleting a vault.

Point of Consideration :

When I thought to delete a vault using ARM Portal , it didn’t allow me and prompted an error message as appears below

Vault deletion error

Vault cannot be deleted as there are existing resources within the vault. :  VMProd Unregistered all containers from the vault and the vault and then retry to delete.

image deletion_error.jpg

There is a reason behind if we get such message when delete Recovery Service vault, because it will have dependency on it or any workload will be attached to it

To delete the backup data, perform the following steps:

1.      From the portal, go to Recovery Services vault, and then go to Backup items. Then, find a table named as Backup management type and choose the items from list as mentioned in image below management-type.jpg

As you can see above there is one virtual machine which is already linked with MARS.

Click on Azure Virtual machine , it will open a new window

In order to delete vault we have to first stop backup already taken and later delete backup , as following screen appears  and click on stop back and after few seconds delete backup data.

Once you perform all above action it reaches to backup disabled state as you can see in last backup status in below image as well. After this you should be able to delete entire service vault probably after 14 days

 Hope this article will assist you to perform deletion of Service vault

#Azure #RecoveryServiceVault

Categories: #Azure , #AzureBackup , #AzureRecoveryServiceVault

Configure Diagnostic settings of Resource through ARM Templates in Azure

Configure Diagnostic settings through ARM Templates in Azure

Once you have provision any resource within azure , you may have a use case to enable diagnostic settings for that.

In this article we will explore how can we enable that for a azure resource using ARM templates.

Prerequisite : You should have Azure resource provision already.

I’ve provisioned a Azure firewall and will enable diagnostic for that. There are two ways to achieve that first is through azure portal and another through IaC.

I’ve Azure firewall under resource group FW-RG as mentioned in below image resource-group.jpg

 Click on the Firewall and it will open the following screenshot resource.jpg as shown below:

If you click on Diagnostic settings(rectangle as red) than you should be able to see there is no settings exists.

Now will use the following code snippet to enable that.

I believe you are familiar with ARM templates if not read the following article for references.

{

   "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

   "contentVersion":"1.0.0.0",

   "parameters":{

      "resourceName":{

         "type":"String",

         "metadata":{

            "description":"Name of the resource"

         }

      },

      "settingName":{

         "defaultValue":"firewallDiagnostic",

         "type":"String",

         "metadata":{

            "description":"Diagnostic setting Name"

         }

      },

      "logAnalyticWorkspaceName":{

         "defaultValue":"Fw-LA",

         "type":"String",

         "metadata":{

            "description":"Diagnostic setting Name"

         }

      }

   },

   "variables":{

      "workspaceId":"        [resourceid('Microsoft.OperationalInsights/workspaces',parameters('logAnalyticWorkspaceName'))]"

   },

   "resources":[

      {

         "type":"Microsoft.Network/azureFirewalls/providers/diagnosticSettings",

         "name":"[concat(parameters('resourceName'),'/microsoft.insights/', parameters('settingName'))]",

         "apiVersion":"2017-05-01-preview",

         "properties":{

            "name":"DiagService",

            "storageAccountId":null,

            "eventHubAuthorizationRuleId":null,

            "eventHubName":null,

            "workspaceId":"[variables('workspaceId')]",

            "logs":[

               {

                  "category":"AzureFirewallApplicationRule",

                  "enabled":true,

                  "retentionPolicy":{

                     "days":10,

                     "enabled":false

                  }

               },

               {

                  "category":"AzureFirewallNetworkRule",

                  "enabled":true,

                  "retentionPolicy":{

                     "days":10,

                     "enabled":false

                  }

               }

            ],

            "metrics":[

               {

                  "category":"AllMetrics",

                  "enabled":true,

                  "retentionPolicy":{

                     "enabled":false,

                     "days":0

                  }

               }

            ]

         }

      }

   ]

}

Now open Azure portal and search for  ‘Deploy a custom template’ and click. Once that opens click on build your own template in the editor and copy -paste entire stuff from above code snippet and click save. After this following window appears , fill the requires details and click on purchase.

It will start deploying entire stuff for you. Refer an image deployment.jpg as appears below:

Once the deployment succeeded it should reflect in firewall . To verify that go to firewall -> Diagnostic settings . Follow the below image fw-diagnostic.jpg

Click on edit settings to see that whether Application rules and metrics has enabled or not.

It should exists and pointing to log analytics work space

#Azure #AzureIaC #Firewall #ARMTemplate #DiagnosticSettings

Categories: #Azure , ARM Template , Azure ARM

Cheat Sheet for ARM Templates in Azure

Cheat Sheet for ARM Templates in Azure

In the recent time I’ve been working on ARM templates and each time I need to automate some stuff or provision some resources. So decided to create a cheat sheet for such purpose rather than jumping each time for Microsoft document.

 This blog post serves as a little cheat sheet for common ARM deployment stuff.

ARM Templates Parameters

Parameters are passed as an input to your ARM template. In general we take an inputs from customer or user as well.

This is most frequent technique we use while create arm template.

"parameters":{

       "actionGroupName":{

          "type":"string",

           "defaultValue":"hm-incident-create",

          "metadata":{

             "description":"Unique name (within the Resource Group) for the Action group."

          }

       },      

       "logicAppName":{

          "type":"string",

          "defaultValue":"hm-alert-splunk",

          "metadata":{

             "description":"Logic app name."

          }

      

       }

    }

Variables

There are various name of resource that  are often used more than once in the ARM template. For that purpose we should create variables . Variables can be used in scope of entire template.  Some examples:

"variables": {

"pingTestName": "[concat('Test-','toLower(parameters('appServiceName')))]"

 "WorkspaceId": "[concat('workspaceId-', toLower(parameters('appName')))]"

 "storageAccountName": "[concat('dotnet', parameters('storageName'), 'storage')]"

Complex objects with parameters

Many times we are not only dependent string , int and bool parameters .Though we have an option to create a complex object and can be use with simple syntax. I’ll be mentioning how to write that with in arm templates

To achieve this, I use nested variables that declare that in such way.

{

   "dotnetpiperspoke":{

      "type":"object",

      "defaultValue":{

         "vnet":{

            "name":"Spoke",

            "addressPrefixes":[

               "10.0.0.0/16"

            ]

         }

      },

      "metadata":{

         "description":"This is an example of using object type in ARM templates"

      }

   }

}

How to access these within template is show here:

{

   "resources":[

      {

         "name":"[parameters('spoke').vnet.name]",

         "type":"Microsoft.Network/virtualNetworks",

         "apiVersion":"2017-10-01",

         "location":"[resourceGroup().location]",

         "properties":{

            "addressSpace":{

               "addressPrefixes":"[parameters(dotnetpiperspoke).vnet.addressPrefixes]"

            }

         }

      }

   ]

}

ARM Template Resource Functions

There are many ARM template functions available, of which the resource functions are quite powerful and often required.  Here you can find some functions I often use.  They can serve as a starting point to be used in other scenarios.

·        Get the location of the resource group you’re deploying to

[resourceGroup().location]

·        Get the subscription id

[subscription().subscriptionId] or "[subscription().id]"

NOTE: Many times while deploying templates I use "[subscription().id]" and it works as anticipated

·        Get the tenant id

[subscription().tenantId]

·        Get the vault URI of a just created KeyVault instance

[reference(resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))).vaultUri]

ResourceId  function

"resourceId":"[resourceId('Microsoft.Logic/workflows', parameters('logicAppName'))]",                 

"callbackUrl": [listCallbackUrl(resourceId(parameters('logicAppRG'),'Microsoft.Logic/workflows/triggers',  parameters('logicAppName'), 'manual'), '2016-06-01').value]"

• Get the access key of a just created Storage account

[listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]

Conditional deployments

Another requirement is having conditions within your deployment.  For example, you only want to validate array length must be greater than 0 Or you want to add resource locks on certain condition like bool is true or not.

One way to achieve this, is by adding a condition to your Azure resource.  These conditions can use a comparison function.  This is demonstrated in the next sample:

{

   "resources":[

      {

        "name":"[concat(variables('storageAccountName'), ‘Microsoft.Authorization/CriticalStorageLock')]",

         "type":"Microsoft.Storage/storageAccounts/providers/locks",

         "apiVersion":"2015-01-01",

    "condition": "[greater(length(variables('productsJArray')), 0)]",

         "dependsOn":[

            "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]"

         ],

         "properties":{

            "level":"CannotDelete",

            "notes":"Prevent accidental deletion of the storage account."

         }

      }

   ]

}

I believe an above shared cheat sheet concepts would help you while deploying  ARM templates.

Categories: #Azure , ARM Template , Azure ARM