Native monitoring with Azure VMs using the Azure Monitor Agent (AMA).
Different methods are implemented in this repository:
/infra1
- Data collection (direct configuration with Terraform)/infra2
- Monitor VM Insights/infra3
- Custom Logs / Application + Diagnosis (incoming)
For the Azure Monitor Agent, check the requirements.
- Permissions
- Authentication / Identity (Managed Identity)
- Networking / Azure Firewall
Run the from ./infra1
directory:
terraform init
terraform apply -auto-approve
The agent is configured via Data Collection Rules. Check the documentation for details.
Collection options are Linux Syslog
, Performance Counters
, and custom TXT
or JSON
.
Another method of monitoring VMs is via Monitor VM Insights
The startup code is in the ./infra2
directory:
terraform init
terraform apply -auto-approve
Once completed, connect to the VM and check if Docker has been installed correctly.
cloud-init status
Use the Portal or other interface to enable VM Insights.
Download the stressbox tool to simulate resource usage:
sudo docker pull epomatti/stressbox:arm64
sudo docker run -d -p 8080:8080 epomatti/stressbox:arm64
Simulate CPU consumption:
for i in {1..100}; do curl 0:8080/cpu?x=42; done
From the documentation:
- Virtual machine host
- Guest operating system
- Workloads
- Applications
Configuration steps covered here:
- Deploy Azure Monitor agent - Deploy the Azure Monitor agent to your Azure and hybrid virtual machines to collect data from the guest operating system and workloads.
- Configure data collection - Create data collection rules to instruct the Azure Monitor agent to collect telemetry from the guest operating system.
Large infrastructure landscapes should consider Log Analytics Workspace architecture designs.
Operational data is the scope for Azure Monitor. Security data is handle by Microsoft Defender for Cloud (inspector) and Microsoft Sentinel (threat intelligence).
There is a Diagnostics Extensions available that collects Metrics, Syslog, and Files, and publish them to a storage. There are several prerequisites (or limitations) and really there are other options available.
Within the same scope, there's Telegraf Agent integration available. This is not officially supported by Azure Monitor.
The OMS agent is being deprecated in favor of the Azure Monitor Agent, which is used in this example.
The Network Watcher Agent extension is required by some features of Network Watcher, such as capturing network traffic on demand, and other advanced functionality.
Sentinel:
- Microsoft Defender for Cloud - Allows the ingestion of Microsoft Defender for Cloud.
- Microsoft Threat Intelligence - Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.
https://learn.microsoft.com/en-us/azure/sentinel/connect-services-api-based https://learn.microsoft.com/en-us/azure/sentinel/connect-services-diagnostic-setting-based https://learn.microsoft.com/en-us/azure/sentinel/connect-services-windows-based