Skip to content

Commit 2870b59

Browse files
committed
Fixing Acrolinx errors
1 parent 29f94b5 commit 2870b59

File tree

4 files changed

+36
-36
lines changed

4 files changed

+36
-36
lines changed

articles/automation/change-tracking-file-contents.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Manage Change Tracking and Inventory in Azure Automation
3-
description: This article tells how to use Change Tracking and Inventory to track software and Windows service changes that occur in your environment.
3+
description: This article tells how to use Change Tracking and Inventory to track software and Microsoft service changes that occur in your environment.
44
services: automation
55
ms.subservice: change-inventory-management
66
ms.date: 07/03/2018
@@ -13,14 +13,14 @@ When you add a new file or registry key to track, Azure Automation enables it fo
1313

1414
## Enable the full Change Tracking and Inventory solution
1515

16-
If you have enabled [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring), you can use the full Change Tracking and Inventory solution as described below. You settings are not removed by this process.
16+
If you have enabled [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring), you can use the full Change Tracking and Inventory solution as described below. Your settings are not removed by this process.
1717

1818
> [!NOTE]
1919
> Enabling the full Change Tracking and Inventory solution might cause additional charges. See [Automation Pricing](https://azure.microsoft.com/pricing/details/automation/).
2020
2121
1. Remove the monitoring solution by navigating to the workspace and locating it in the [list of installed monitoring solutions](../azure-monitor/insights/solutions.md#list-installed-monitoring-solutions).
2222
2. Click on the name of the solution to open its summary page and then click on **Delete**, as detailed in [Remove a monitoring solution](../azure-monitor/insights/solutions.md#remove-a-monitoring-solution).
23-
3. Re-enable the solution by navigating to the Automation account and selecting **Change tracking** under **Configuration Management**.
23+
3. To re-enable the solution, navigate to the Automation account and select **Change tracking** under **Configuration Management**.
2424
4. Choose the Log Analytics workspace and Automation account, confirm your workspace settings, and click **Enable**.
2525

2626
## <a name="onboard"></a>Onboard machines to Change Tracking and Inventory
@@ -82,11 +82,11 @@ Use the following steps to configure file tracking on Linux computers:
8282

8383
## Track file contents
8484

85-
File content tracking allows you to view the contents of a file before and after a change that is being tracked with Change Tracking and Inventory. The feature saves the file contents to a storage account after each change occurs. Here are some rules to follow for tracking file contents:
85+
File content tracking allows you to view the contents of a file before and after a tracked change. The feature saves the file contents to a storage account after each change occurs. Here are some rules to follow for tracking file contents:
8686

8787
* A standard storage account using the Resource Manager deployment model is required for storing file content.
8888

89-
* Don't use premium and classic deployment model storage accounts. See [About Azure storage accounts](../storage/common/storage-create-storage-account.md).
89+
* Don't use premium and classic deployment model storage accounts. See [About Azure Storage accounts](../storage/common/storage-create-storage-account.md).
9090

9191
* The storage account that you use can be connected to only one Automation account.
9292

@@ -106,7 +106,7 @@ File content tracking allows you to view the contents of a file before and after
106106

107107
![Set storage account](./media/change-tracking-file-contents/storage-account.png)
108108

109-
6. When file content change tracking is enabled, the storage account and the Shared Access Signature (SAS) URIs are shown. The signatures expire after 365 days, and you can recreate them by clicking **Regenerate**.
109+
6. Change Tracking and Inventory shows storage account and Shared Access Signature (SAS) URIs when it enables file content change tracking. The signatures expire after 365 days, and you can recreate them by clicking **Regenerate**.
110110

111111
![List account keys](./media/change-tracking-file-contents/account-keys.png)
112112

@@ -147,19 +147,19 @@ You can do various searches against the Azure Monitor logs for change records. W
147147

148148
|Query |Description |
149149
|---------|---------|
150-
|ConfigurationData<br>&#124; where ConfigDataType == "WindowsServices" and SvcStartupType == "Auto"<br>&#124; where SvcState == "Stopped"<br>&#124; summarize arg_max(TimeGenerated, *) by SoftwareName, Computer | Shows the most recent inventory records for Windows services that were set to Auto but were reported as being Stopped. Results are limited to the most recent record for the specified software name and computer. |
150+
|ConfigurationData<br>&#124; where ConfigDataType == "Microsoft services" and SvcStartupType == "Auto"<br>&#124; where SvcState == "Stopped"<br>&#124; summarize arg_max(TimeGenerated, *) by SoftwareName, Computer | Shows the most recent inventory records for Microsoft services that were set to Auto but were reported as being Stopped. Results are limited to the most recent record for the specified software name and computer. |
151151
|ConfigurationChange<br>&#124; where ConfigChangeType == "Software" and ChangeCategory == "Removed"<br>&#124; order by TimeGenerated desc|Shows change records for removed software.|
152152

153153
## Create alerts on changes
154154

155-
The following example shows that the file **C:\windows\system32\drivers\etc\hosts** has been modified on a machine. This file is important because Windows uses it to resolve host names to IP addresses. This operation takes precedence over DNS, and might result in connectivity issues or the redirection of traffic to malicious or otherwise dangerous websites.
155+
The following example shows that the file **C:\windows\system32\drivers\etc\hosts** has been modified on a machine. This file is important because Windows uses it to resolve host names to IP addresses. This operation takes precedence over DNS, and might result in connectivity issues. It can also lead to redirection of traffic to malicious or otherwise dangerous websites.
156156

157157
![A chart showing the hosts file change](./media/change-tracking-file-contents/changes.png)
158158

159159
Let's use this example to discuss the steps for creating alerts on a change.
160160

161161
1. In your Automation account, select **Change tracking** under **Configuration Management**, then select **Log Analytics**.
162-
2. In the Logs search, look for content changes to the **hosts** file with the query `ConfigurationChange | where FieldsChanged contains "FileContentChecksum" and FileSystemPath contains "hosts"`. This query looks for changes that include a change of content for files with a fully qualified path containing the word “hosts”. You can also ask for a specific file by changing the path portion to its fully qualified form, for example, using `FileSystemPath == "c:\windows\system32\drivers\etc\hosts"`.
162+
2. In the Logs search, look for content changes to the **hosts** file with the query `ConfigurationChange | where FieldsChanged contains "FileContentChecksum" and FileSystemPath contains "hosts"`. This query looks for a content change for files with a fully qualified path containing the word “hosts”. You can also ask for a specific file by changing the path portion to its fully qualified form, for example, using `FileSystemPath == "c:\windows\system32\drivers\etc\hosts"`.
163163

164164
3. After the query returns the desired results, click **New alert rule** in the log search to open the alert creation page. You can also navigate to this page through **Azure Monitor** in the Azure portal.
165165

articles/automation/change-tracking.md

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Overview of Change Tracking and Inventory in Azure Automation
3-
description: Change tracking and inventory helps you identify software and Windows service changes that occur in your environment.
3+
description: Change Tracking and Inventory helps you identify software and Microsoft service changes that occur in your environment.
44
services: automation
55
ms.subservice: change-inventory-management
66
ms.date: 01/28/2019
@@ -9,21 +9,21 @@ ms.topic: conceptual
99

1010
# Overview of Change Tracking and Inventory
1111

12-
This article introduces you to Change Tracking and Inventory in Azure Automation. This feature tracks changes in virtual machines and server infrastructure to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager. Items that are specifically tracked by Change Tracking and Inventory include:
12+
This article introduces you to Change Tracking and Inventory in Azure Automation. This feature tracks changes in virtual machines and server infrastructure to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager. Items that are tracked by Change Tracking and Inventory include:
1313

1414
- Windows software
1515
- Linux software (packages)
1616
- Windows and Linux files
1717
- Windows registry keys
18-
- Windows services
18+
- Microsoft services
1919
- Linux daemons
2020

21-
Change Tracking and Inventory obtains its data from the Azure Monitor service in the cloud. Azure sends changes to installed software, Windows services, Windows registry and files, and Linux daemons on monitored servers to Azure Monitor for processing. The cloud service applies logic to the received data, records it, and makes it available.
21+
Change Tracking and Inventory obtains its data from the Azure Monitor service in the cloud. Azure sends changes to installed software, Microsoft services, Windows registry and files, and Linux daemons on monitored servers to Azure Monitor for processing. The cloud service applies logic to the received data, records it, and makes it available.
2222

2323
> [!NOTE]
2424
> To track Azure Resource Manager property changes, see the Azure Resource Graph [change history](../governance/resource-graph/how-to/get-resource-changes.md).
2525
26-
Change Tracking and Inventory currentlyy doesn't support the following items:
26+
Change Tracking and Inventory currently doesn't support the following items:
2727

2828
* Recursion for Windows registry tracking
2929
* Network filesystems
@@ -98,7 +98,7 @@ You can click on a change or event to bring up its details. The available change
9898
* Files
9999
* Registry
100100
* Software
101-
* Windows services
101+
* Microsoft services
102102

103103
You are able to add, modify, or remove each change. In the example below, you can see a change in the startup type of a service from Manual to Auto.
104104

@@ -110,13 +110,13 @@ For tracking changes in files on both Windows and Linux, Change Tracking and Inv
110110

111111
## Tracking of file content changes
112112

113-
Change Tracking and Inventory allows you to view the contents of a Windows or Linux file before and after a file change. For each change to a file, Change Tracking and Inventory stores the contents of the file in an [Azure storage account](../storage/common/storage-create-storage-account.md). When you're tracking the file, you can view its contents before or after a change, inline or side by side.
113+
Change Tracking and Inventory allows you to view the contents of a Windows or Linux file before and after a file change. For each change to a file, Change Tracking and Inventory stores the contents of the file in an [Azure Storage account](../storage/common/storage-create-storage-account.md). When you're tracking the file, you can view its contents before or after a change. You can view the contents either inline or side by side.
114114

115115
![View changes in a file](./media/change-tracking/view-file-changes.png)
116116

117117
## Tracking of registry keys
118118

119-
Change Tracking and Inventory allows monitoring of changes to registry keys so that you can pinpoint extensibility points where third-party code and malware can activate. The following table lists preconfigured (but not enabled) registry keys. To track these keys, you must enable each one.
119+
Change Tracking and Inventory allows monitoring of changes to registry keys. Monitoring allows you to pinpoint extensibility points where third-party code and malware can activate. The following table lists preconfigured (but not enabled) registry keys. To track these keys, you must enable each one.
120120

121121
> [!div class="mx-tdBreakAll"]
122122
> |Registry Key | Purpose |
@@ -144,16 +144,16 @@ Change Tracking and Inventory allows monitoring of changes to registry keys so t
144144
Change Tracking and Inventory makes use of [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring). While FIM monitors files and registries only, the full Change Tracking and Inventory feature also includes tracking for:
145145

146146
- Software changes
147-
- Windows services
147+
- Microsoft services
148148
- Linux daemons
149149

150150
## Recursion support
151151

152-
Change Tracking and Inventory supports recursion, which allows you to specify wildcards to simplify tracking across directories. Recursion also provides environment variables to allow you to track files across environments with multiple or dynamic drive names. The following list includes ommon information you should know when configuring recursion:
152+
Change Tracking and Inventory supports recursion, which allows you to specify wildcards to simplify tracking across directories. Recursion also provides environment variables to allow you to track files across environments with multiple or dynamic drive names. The following list includes Common information you should know when configuring recursion:
153153

154154
* Wildcards are required for tracking multiple files.
155155
* Wildcards can be used only in the last segment of a path, for example, **c:\folder\\file*** or **/etc/*.conf**.
156-
* If an environment variable has an invalid path, validation succeeds but the path fails when Change Tracking and Inventory runs.
156+
* If an environment variable has an invalid path, validation succeeds but the path fails during execution.
157157
* Avoid general path names when setting the path, as this type of setting can cause too many folders to be traversed.
158158

159159
## Change Tracking and Inventory data collection
@@ -165,7 +165,7 @@ The next table shows the data collection frequency for the types of changes supp
165165
| Windows registry | 50 minutes |
166166
| Windows file | 30 minutes |
167167
| Linux file | 15 minutes |
168-
| Windows services | 10 seconds to 30 minutes</br> Default: 30 minutes |
168+
| Microsoft services | 10 seconds to 30 minutes</br> Default: 30 minutes |
169169
| Linux daemons | 5 minutes |
170170
| Windows software | 30 minutes |
171171
| Linux software | 5 minutes |
@@ -183,29 +183,29 @@ The following table shows the tracked item limits per machine for Change Trackin
183183

184184
The average Log Analytics data usage for a machine using Change Tracking and Inventory is approximately 40 MB per month. This value is only an approximation and is subject to change based on your environment. It's recommended that you monitor your environment to see the exact usage that you have.
185185

186-
### Windows service data
186+
### Microsoft service data
187187

188-
The default collection frequency for Windows services is 30 minutes. You can configure the frequency using a slider on the **Windows Services** tab under **Edit Settings**.
188+
The default collection frequency for Microsoft services is 30 minutes. You can configure the frequency using a slider on the **Microsoft services** tab under **Edit Settings**.
189189

190-
![Windows services slider](./media/change-tracking/windowservices.png)
190+
![Microsoft services slider](./media/change-tracking/windowservices.png)
191191

192-
The Log Analytics agent only tracks changes, which optimizes the agent's performance. Setting a high threshold might miss changes if the service reverts to its original state. Setting the frequency to a smaller value allows you to catch changes that might be missed otherwise.
192+
To optimize performance, the Log Analytics agent only tracks changes. Setting a high threshold might miss changes if the service reverts to its original state. Setting the frequency to a smaller value allows you to catch changes that might be missed otherwise.
193193

194194
> [!NOTE]
195195
> While the agent can track changes down to a 10-second interval, the data still takes a few minutes to display in the Azure portal. Changes that occur during the time to display in the portal are still tracked and logged.
196196
197197
## Support for alerts on configuration state
198198

199-
A key capability of Change Tracking and Inventory is alerting on changes to the configuration state of your hybrid environment. Many useful actions are available to trigger in response to alerts, for example, actions on Azure functions, Automation runbooks, webhooks, and the like. Alerting on changes to the **C:\windows\system32\drivers\etc\hosts** file for a machine is one good application of alerts for Change Tracking and Inventory data. There are many more scenarios for alerting as well, including those defined in the next table.
199+
A key capability of Change Tracking and Inventory is alerting on changes to the configuration state of your hybrid environment. Many useful actions are available to trigger in response to alerts, for example, actions on Azure functions, Automation runbooks, webhooks, and the like. Alerting on changes to the **C:\windows\system32\drivers\etc\hosts** file for a machine is one good application of alerts for Change Tracking and Inventory data. There are many more scenarios for alerting as well, including the query scenarios defined in the next table.
200200

201201
|Query |Description |
202202
|---------|---------|
203203
|ConfigurationChange <br>&#124; where ConfigChangeType == "Files" and FileSystemPath contains " c:\\windows\\system32\\drivers\\"|Useful for tracking changes to system-critical files.|
204204
|ConfigurationChange <br>&#124; where FieldsChanged contains "FileContentChecksum" and FileSystemPath == "c:\\windows\\system32\\drivers\\etc\\hosts"|Useful for tracking modifications to key configuration files.|
205-
|ConfigurationChange <br>&#124; where ConfigChangeType == "WindowsServices" and SvcName contains "w3svc" and SvcState == "Stopped"|Useful for tracking changes to system-critical services.|
206-
|ConfigurationChange <br>&#124; where ConfigChangeType == "Daemons" and SvcName contains "ssh" and SvcState != "Running"|Useful for tracking changes to system-critical services.|
205+
|ConfigurationChange <br>&#124; where ConfigChangeType == "Microsoft services" and SvcName contains "w3svc" and SvcState == "Stopped"|Useful for tracking changes to system-critical services.|
206+
|ConfigurationChange <br>&#124; where ConfigChangeType == "Daemons" and SvcName contains "ssh" and SvcState!= "Running"|Useful for tracking changes to system-critical services.|
207207
|ConfigurationChange <br>&#124; where ConfigChangeType == "Software" and ChangeCategory == "Added"|Useful for environments that need locked-down software configurations.|
208-
|ConfigurationData <br>&#124; where SoftwareName contains "Monitoring Agent" and CurrentVersion != "8.0.11081.0"|Useful for seeing which machines have outdated or noncompliant software version installed. This query reports the last reported configuration state, but does not report changes.|
208+
|ConfigurationData <br>&#124; where SoftwareName contains "Monitoring Agent" and CurrentVersion!= "8.0.11081.0"|Useful for seeing which machines have outdated or noncompliant software version installed. This query reports the last reported configuration state, but doesn't report changes.|
209209
|ConfigurationChange <br>&#124; where RegistryKey == @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat"| Useful for tracking changes to crucial antivirus keys.|
210210
|ConfigurationChange <br>&#124; where RegistryKey contains @"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy"| Useful for tracking changes to firewall settings.|
211211

articles/automation/graphical-runbook-sdk.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.topic: conceptual
1313

1414
## Prerequisites
1515

16-
Import the `Microsoft.Azure.Automation.GraphicalRunbook.Model` package into your project.
16+
Import the `Microsoft.Azure.Management.Automation.GraphicalRunbook.Model` package into your project.
1717

1818
## Create a runbook object instance
1919

0 commit comments

Comments
 (0)