diff --git a/blog-service/2025-02-27-apps.md b/blog-service/2025-02-27-apps.md new file mode 100644 index 0000000000..c8b2635829 --- /dev/null +++ b/blog-service/2025-02-27-apps.md @@ -0,0 +1,14 @@ +--- +title: Azure Container Instances (Apps) +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - microsoft-azure-apps + - azure-container-instances +hide_table_of_contents: true +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +We're excited to introduce the new Azure Container Instances app for Sumo Logic. This app enables you to deploy and manage containers in Azure without the need for virtual machines. It is ideal for event-driven applications, microservices, and batch processing workloads. [Learn more](/docs/integrations/microsoft-azure/azure-container-instances). diff --git a/cid-redirects.json b/cid-redirects.json index 848493456a..3ab156fb67 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -1866,6 +1866,7 @@ "/cid/1964": "/docs/integrations/security-threat-detection/f5-big-ip-ltm", "/cid/1965": "/docs/integrations/security-threat-detection/netskope", "/cid/19665": "/docs/integrations/microsoft-azure/azure-security-defender-for-cloud", + "/cid/19667": "/docs/integrations/microsoft-azure/azure-container-instances", "/cid/1966": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source", "/cid/1987": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source", "/cid/1996": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sysdig-secure-source", diff --git a/docs/integrations/microsoft-azure/azure-container-instances.md b/docs/integrations/microsoft-azure/azure-container-instances.md new file mode 100644 index 0000000000..f2a8aa6815 --- /dev/null +++ b/docs/integrations/microsoft-azure/azure-container-instances.md @@ -0,0 +1,204 @@ +--- +id: azure-container-instances +title: Azure Container Instances +description: Learn about the Sumo Logic collection process for the Azure Container Instances service. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +Thumbnail icon + +[Azure Container Instances](https://learn.microsoft.com/en-us/azure/container-instances/) is a fully managed serverless container service that enables you to deploy and manage containers in Azure without the need for virtual machines. It is ideal for event-driven applications, microservices, and batch processing workloads. + +## Log and metric types + +For Azure Container Instances, you can collect the following logs and metrics: + +* **Audit Logs**. The activity log contains subscription-level events that track operations for each Azure resource as seen from outside that resource. For more details, refer to the [Azure Documentation](https://learn.microsoft.com/en-us/azure/container-instances/monitor-azure-container-instances#azure-activity-log). +* **Resource Logs**. Capture container creation, execution, and failure logs. Refer to the [Microsoft Documentation](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-monitor#resource-logs) to know about the schema for resource logs. +* **Metrics**. Metrics for Azure Container Instances are in the following namespaces: + * [Microsoft.ContainerInstance/containerGroups](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/microsoft-containerinstance-containergroups-metrics) + +For more information on supported dimensions, refer to [Azure documentation](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-monitor#metrics). + +## Setup + +Azure service sends monitoring data to Azure Monitor, which can then [stream data to an event hub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports: + +* Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). +* Metrics collection using our [HTTP Logs and Metrics source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/) via Azure Functions deployed using the ARM template. + +You must explicitly enable diagnostic settings for each domain, namespaces, custom topic, and system topic you want to monitor. You can forward logs to the same event hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations). + +When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/AzureContainerInstances/Logs`, `Azure/AzureContainerInstances/Metrics`. + +### Configure field in field schema + +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. +1. Search for the following fields: + - `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). + - `location`. The region to which the resource name belongs to. + - `subscription_id`. ID associated with a subscription where the resource is present. + - `resource_group`. The resource group name where the Azure resource is present. + - `provider_name`. Azure resource provider name (for example, Microsoft.Network). + - `resource_type`. Azure resource type (for example, storage accounts). + - `resource_name`. The name of the resource (for example, storage account name). + - `service_type`. Type of the service that can be accessed with a Azure resource. + - `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). +1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields). + +### Configure field extraction rules + +Create the following Field Extraction Rule(s) (FER) for Azure Storage by following the instructions in [Create a Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule/). + +#### Azure location extraction FER + + ```sql + Rule Name: AzureLocationExtractionFER + Applied at: Ingest Time + Scope (Specific Data): tenant_name=* + ``` + + ```sql title="Parse Expression" + json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop + | replace(toLowerCase(resourceLocation), " ", "") as resourceLocation + | if (!isBlank(resourceLocation), resourceLocation, location) as location + | if (!isBlank(service_region), service_region, location) as location + | if (isBlank(location), "global", location) as location + | fields location + ``` + +#### Resource ID extraction FER + + ```sql + Rule Name: AzureResourceIdExtractionFER + Applied at: Ingest Time + Scope (Specific Data): tenant_name=* + ``` + + ```sql title="Parse Expression" + json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop + | if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId + | toUpperCase(resourceId) as resourceId + | parse regex field=resourceId "/SUBSCRIPTIONS/(?[^/]+)" nodrop + | parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop + | parse regex field=resourceId "/PROVIDERS/(?[^/]+)" nodrop + | parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?[^/]+)/(?.+)" nodrop + | parse regex field=resource_name "(?[^/]+)(?:/PROVIDERS/[^/]+)?/(?[^/]+)/?(?.+)" nodrop + | if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name + | fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name + ``` + +### Configure metric rules + +Create the following metrics rules by following the instructions in [Create a metrics rule](/docs/metrics/metric-rules-editor/#create-a-metrics-rule). + +#### Azure observability metadata extraction container instance level + + ```sql + Rule Name: AzureObservabilityMetadataExtractionAzureContainerInstanceLevel + ``` + + ```sql title="Metric match expression" + resourceId=resourceId=/SUBSCRIPTIONS/*/RESOURCEGROUPS/*/PROVIDERS/MICROSOFT.CONTAINERINSTANCE/*/* tenant_name=* + ``` + | Fields extracted | Metric rule | + |:------------------|:----------------------------| + | subscription_id | $resourceId._1 | + | resource_group | $resourceId._2 | + | provider_name | MICROSOFT.CONTAINERINSTANCE | + | resource_type | $resourceId._3 | + | resource_name | $resourceId._4 | + +### Configure metrics collection + +For metrics collection follow guidelines in [Azue Metrics Source](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source/). + +While you configure metrics collection you need to tag the location field in the source with right location value.
Azure Container Instance Tag Location + +Also you need to configure namespaces as shown below.
Azure Container Instance Namespaces + +### Configure logs collection + +1. Add a hosted collector and [HTTP Source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#step-1-configure-an-http-source). +2. Create and push a custom image using a Docker file and output_conf.yaml onto a Docker hub. +3. Use existing resource group or create a new one in Azure. +4. Update the **logging-sidecar-deploy.yaml** file with your own application image whose logs you want to collect. In the file we have used nginx application as an example whose log files(access logs and error logs) are created in a shared volume(/var/log/nginx). +4. Deploy the **logging-sidecar-deploy.yaml** Azure template. + * parameter - `/fluent-bit/bin/fluent-bit` is fluent-bit executable path. + * parameter - `-c /root/output_conf.yaml` is fluent-bit configuration file path. + * Inputs parameters in the `output_conf.yaml` file. + * **tail**. Read logs command name. + * **path**. Log file path from where fluent bit collector is collecting logs. + * Outputs parameters in the `output_conf.yaml` file. + * **name*. HTTP output collector. By default, the name key will be assigned with *http* as value. + * **format**. Data format by which you can send logs to Sumo Logic. By default, the format key will be assigned with *json_lines* as value. + * **compress**. Payload compression mechanism. The recommended file type from Sumo Logic is `gzip`. + * **match**. Log matching rule. + * **host**. Sumo Logic collector host. + * **port**. Sumo Logic collector port. + * **tls=on**. By default, *on* value will be assigned to enable the TLS support. + * **tls.verify**. By default, *off* value will be assigned to disable the certificate validation. + * **URI**. Sumo Logic HTTP collector URI. + * **json_date_key**. Name of the date field in output. + * **header**. X-Sumo-Fields header used to tag fields during logs collection. + +To learn more details on how to deploy azure container instance, refer to the [Azure Documentation](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-quickstart). + +#### Activity Logs + +To collect activity logs, follow the instructions [here](/docs/integrations/microsoft-azure/audit). Skip this step if you are already collecting activity logs for a subscription. + +:::note +Since this source contains logs from multiple regions, make sure that you do not tag this source with the location tag. +::: + +## Viewing the Azure Container Instances dashboards + +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + + +### Error Logs + +The **Azure Container Instance - Error Logs** dashboard provides detailed information on the container activity. This dashboard also provides comprehensive overview of Total Errors, Top 10 Errors bar chart, Log Level Error distribution, Error Trend by Container, and Recent Container Logs. + +Azure Container Instance - Error Logs + +### Administrative Operations + +The **Azure Container Instances - Administrative Operations** dashboard provides details on the operational activities and status of your Azure Container Instances resources. + +Use this dashboard to: +* Monitor the distribution of operation types and their success rates to ensure proper functioning of your Container Instances system. +* Identify potential issues by analyzing the top operations causing errors and correlating them with specific users or applications. +* Track recent write and delete operations to maintain an audit trail of changes made to your Azure Container Instances configuration. + +Azure Container Instances - Administrative Operations + +### Resources + +The **Azure Container Instances - Resources** dashboard shows average memory usage, avg CPU usage, and average network bytes received and transmitted per sec. + +Use this dashboard to: +* Monitor Average Memory and CPU usage with it's trend. +* Monitor Average Received and Transmitted network bytes. + +Azure Container Instances - Errors + +### Policy and Recommendations + +The **Azure Container Instances - Policy and Recommendations** dashboard provides details on policy events and recommendations for your Azure Container Instances resources. + +Use this dashboard to: +* Monitor the success and failure rates of policy events to ensure proper configuration and compliance. +* Track and analyze recent recommendations to improve the performance and security of your Azure Container Instances setup. +* Identify trends in policy events and recommendations over time to proactively address potential issues. + +Azure Container Instances - Policy and Recommendations + +## Troubleshooting + +### HTTP Logs and Metrics Source used by Azure Functions + +To troubleshoot metrics collection, follow the instructions in [Troubleshooting metrics collection](/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor/#troubleshooting-metrics-collection) in *Collect Metrics from Azure Monitor*. diff --git a/docs/integrations/microsoft-azure/index.md b/docs/integrations/microsoft-azure/index.md index 98cd1f6d8a..4dcdd9abf2 100644 --- a/docs/integrations/microsoft-azure/index.md +++ b/docs/integrations/microsoft-azure/index.md @@ -114,6 +114,13 @@ This guide has documentation for all of the apps that Sumo Logic provides for Mi

A guide to the Sumo Logic integration for Azure Cognitive Search.

+
+
+ Thumbnail icon +

Azure Container Instances

+

Learn about the Sumo Logic collection process for the Azure Container Instances service.

+
+
Thumbnail icon diff --git a/sidebars.ts b/sidebars.ts index fb8923655c..d5b955236b 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -2168,6 +2168,7 @@ integrations: [ 'integrations/microsoft-azure/azure-batch', 'integrations/microsoft-azure/azure-cache-for-redis', 'integrations/microsoft-azure/azure-cognitive-search', + 'integrations/microsoft-azure/azure-container-instances', 'integrations/microsoft-azure/azure-cosmos-db-for-postgresql', 'integrations/microsoft-azure/azure-cosmos-db', 'integrations/microsoft-azure/azure-data-explorer', diff --git a/static/img/integrations/microsoft-azure/azure-container-instance-namespaces.png b/static/img/integrations/microsoft-azure/azure-container-instance-namespaces.png new file mode 100644 index 0000000000..b6c3eb3ac4 Binary files /dev/null and b/static/img/integrations/microsoft-azure/azure-container-instance-namespaces.png differ diff --git a/static/img/integrations/microsoft-azure/azure-container-instances.png b/static/img/integrations/microsoft-azure/azure-container-instances.png new file mode 100644 index 0000000000..0f93d3fb80 Binary files /dev/null and b/static/img/integrations/microsoft-azure/azure-container-instances.png differ