Questions[azure-monitor](server)

We're using a custom table in Log Analytics for application error logging. The setup is: Serilog -> Azure Analytics Sink -> Data Collector API (used in sink) -> Log Analytics Workspace -> Custom Table. There seems to be a secret I'm missing in setting up the custom tables. I have two tables working beautifully. We're not seeing entries in all subsequent tables we've created, even though the API calls are successful. It's like our entries are getting lost after ingestion.

Here's how we're creating the tables:

Create a Data Collection Endpoint. It's not used as far as I can tell but you can't create a custom table without one

Create a new custom table in the Tables section of Log Analytics Workspace. It must be DCR-based

Create a Data Collection Rule for the table. I'm not sure it is used either but is required.

Step 2 of wizard. Copied schema directly from a working custom table.

Edit table modal, after custom table is created

Schema modal. These two screens are the only configuration options once table is created

I am trying to figure out direct integration between Zabbix and AWS CloudWatch or Azure Monitor. I have seen YT videos available to integrate Zabbix with grafana first and then integrate grafana with AWS or Azure monitoring solution. But I am just wondering

1. if we have any direct integration available to AWS cloudwatch (for example) using which I can populate the default metrics of AWS services (EC2, Redis, Cache and others).?
2. and also monitor the metrics like script execution or any other DB related metrics from RDS instance (for example).

Any guidance would really be appreciated.

I am trying to integrate azure kubernetes container insights with grafana dashboard.

The plugin for that

For that, I have installed grafana on an azure cloud ubuntu 20 machine following the steps in this link

Allowed 3000 port in azure network security rules and able to access grafana portal using public ip of the VM with 3000 port.

Logged in with admin and password also admin and changed it later after login. Found the details in getting started guide

Installed azure monitor plugin with below command on the ubuntu machine and restarted the server and able to see the plugin there.

grafana-cli plugins install grafana-azure-monitor-datasource

By following the steps in link, I am able to register a new application and create a secret to it in azure and used that service principal and provided permissions(contributor role) to the default workspace of container insights linked to azure kubernetes cluster, which I want to monitor.

Then, when I provided those details in the grafana azure monitor data source.But the details configuration page is different when compared to the one in link.

But still clicked on save and test and got message.

Above screen is different from 7,8 steps in this link

I tried to import dashboard 10956 as in step 10 on above link and got below error there.

Please suggest how to fix this

I want to get a list of all requests that are taking longer then 2 seconds and I think this is correct as the timeTaken_d appears to be a floating point and would seem to be in seconds.

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and timeTaken_d  > 2
| project TimeGenerated, host_s, requestUri_s, httpStatus_d, backendPoolName_s, serverRouted_s, timeTaken_d 
| order by TimeGenerated desc 

However, I have seen elsewhere that this measure is in milliseconds.

Does anyone know for sure? Better still, can someone point me at the docs?

The following is more of an academic question. I don't think there is much of pratical value in it as there are better out-of-the-box solution to it.

Question

How can I collect the Security Events from a windows-based Azure Virtual Machine and create an alert on top of it. So that an email is sent out if there are more then lets say 30 Security Events per minute?

Take 1

• Create a Log Analytics workspace
• Add a virtual machine as data source (Workspace Data Sources > Virtual machines)
• Configure data that should be collected (Advanced Settings > Data > Windows Event Logs)

This however doesn't allow me to add Security Events (only Application and System events).

'Security' event log cannot be collected by this intelligence pack because Audit Success and Audit Failure event types are not currently supported.

Take 2

• From the VM itself enable Diagnostic settings and from "Logs" ensure "Audit Success" and "Audit failure" are selected.
• Enable "Azure Monitor" under data sink

When querying now for something like Event or Event | where ComputerName == "vm1" no results are returned. It seems that this approach only sends metrics and not logs to Azure Monitor

Edit

Okay here is what I have found out so far.

With the use of VM Diagnostic settings, one could write the security events to a storage account table and then later use a Log Analytics Workspace and add the storage account as a source.

This however still doesn't give the ability to query the events. At least for me the Events table was always empty. It seems the data would need transformation first, through an Azure Solution. However I couldn't find one the transforms windows events.

To collect and react on Security Event Logs coming from Windows the go-to-solution would be Azure Security Center. Still don't know though how to create an alert based on that... so confusing.