Merge pull request #220949 from bwren/vm-scenario

VM scenario updates for AMA

Author: Stacyrch140

.openpublishing.redirection.azure-monitor.json

@@ -5626,6 +5626,21 @@
             "source_path_from_root": "/articles/azure-monitor/vm/vminsights-health-troubleshoot.md",
             "redirect_url": "/azure/azure-monitor/vm/vminsights-overview",
             "redirect_document_id": false
+        },
+        {
+            "source_path_from_root": "/articles/azure-monitor/vm/monitor-virtual-machine-configure.md",
+            "redirect_url": "/azure/azure-monitor/vm/monitor-virtual-machine-data-collection",
+            "redirect_document_id": false
+        },
+        {
+            "source_path_from_root": "/articles/azure-monitor/vm/monitor-virtual-machine-security.md",
+            "redirect_url": "/azure/azure-monitor/vm/monitor-virtual-machine#security-monitoring",
+            "redirect_document_id": false
+        },
+        {
+            "source_path_from_root": "/articles/azure-monitor/vm/monitor-virtual-machine-workloads.md",
+            "redirect_url": "/azure/azure-monitor/vm/monitor-virtual-machine-data-collection",
+            "redirect_document_id": false
         }
     ]
 }

articles/azure-monitor/agents/agent-linux-troubleshoot.md

@@ -89,7 +89,7 @@ A clean reinstall of the agent fixes most issues. This task might be the first s
 | NOT_DEFINED | Because the necessary dependencies aren't installed, the auoms auditd plug-in won't be installed. Installation of auoms failed. Install package auditd. |
 | 2 | Invalid option provided to the shell bundle. Run `sudo sh ./omsagent-*.universal*.sh --help` for usage. |
 | 3 | No option provided to the shell bundle. Run `sudo sh ./omsagent-*.universal*.sh --help` for usage. |
-| 4 | Invalid package type *or* invalid proxy settings. The omsagent-*rpm*.sh packages can only be installed on RPM-based systems. The omsagent-*deb*.sh packages can only be installed on Debian-based systems. We recommend that you use the universal installer from the [latest release](../vm/monitor-virtual-machine.md#agents). Also review to verify your proxy settings. |
+| 4 | Invalid package type *or* invalid proxy settings. The omsagent-*rpm*.sh packages can only be installed on RPM-based systems. The omsagent-*deb*.sh packages can only be installed on Debian-based systems. We recommend that you use the universal installer from the [latest release](agent-linux.md#agent-install-package). Also review to verify your proxy settings. |
 | 5 | The shell bundle must be executed as root *or* there was a 403 error returned during onboarding. Run your command by using `sudo`. |
 | 6 | Invalid package architecture *or* there was a 200 error returned during onboarding. The omsagent-\*x64.sh packages can only be installed on 64-bit systems. The omsagent-\*x86.sh packages can only be installed on 32-bit systems. Download the correct package for your architecture from the [latest release](https://github.com/Microsoft/OMS-Agent-for-Linux/releases/latest). |
 | 17 | Installation of OMS package failed. Look through the command output for the root failure. |
@@ -200,7 +200,7 @@ Below the output plug-in, uncomment the following section by removing the `#` in
 
 1. Review the section [Update proxy settings](agent-manage.md#update-proxy-settings) to verify you've properly configured the agent to communicate through a proxy server.
 
-1. Double-check that the endpoints outlined in the Azure Monitor [network firewall requirements](./log-analytics-agent.md#firewall-requirements) list are added to an allow list correctly. If you use Azure Automation, the necessary network configuration steps are also linked above.
+1. Double-check that the endpoints outlined in the Azure Monitor [network firewall requirements](./log-analytics-agent.md#firewall-requirements) list are added to an allowlist correctly. If you use Azure Automation, the necessary network configuration steps are also linked above.
 
 ## Issue: You receive a 403 error when trying to onboard
 

articles/azure-monitor/agents/data-collection-iis.md

@@ -79,6 +79,36 @@ To create the data collection rule in the Azure portal:
 > [!NOTE]
 > It can take up to 5 minutes for data to be sent to the destinations after you create the data collection rule.
 
+
+### Sample log queries
+
+- **Count the IIS log entries by URL for the host www.contoso.com.**
+    
+    ```kusto
+    W3CIISLog 
+    | where csHost=="www.contoso.com" 
+    | summarize count() by csUriStem
+    ```
+
+- **Review the total bytes received by each IIS machine.**
+
+    ```kusto
+    W3CIISLog 
+    | summarize sum(csBytes) by Computer
+    ```
+
+
+## Sample alert rule
+
+- **Create an alert rule on any record with a return status of 500.**
+    
+    ```kusto
+    W3CIISLog 
+    | where scStatus==500
+    | summarize AggregatedValue = count() by Computer, bin(TimeGenerated, 15m)
+    ```
+
+
 ## Troubleshoot
 Use the following steps to troubleshoot collection of IIS logs. 
 

articles/azure-monitor/agents/data-collection-text-log.md

@@ -30,9 +30,9 @@ To complete this procedure, you need:
 
 This step will create a new custom table, which is any table name that ends in \_CL. Currently a direct REST call to the table management endpoint is used to create a table. The script at the end of this section is the input to the REST call.
 
-The table created in the script has two columns TimeGenerated: datetime and RawData: string, which is the default schema for a custom text log. If you know your final schema, then you can add columns in the script before creating the table. If you do not, columns can always be added in the log analytics table UI.  
+The table created in the script has two columns TimeGenerated: datetime and RawData: string, which is the default schema for a custom text log. If you know your final schema, then you can add columns in the script before creating the table. If you don't, columns can always be added in the log analytics table UI.  
 
-The easiest way to make the REST call is from an Azure Cloud PowerShell command line (CLI). To open the shell, go to the Azure Portal, press the Cloud Shell button, and select PowerShell. If this is your first-time using Azure Cloud PowerShell, you will need to walk through the one-time configuration wizard.
+The easiest way to make the REST call is from an Azure Cloud PowerShell command line (CLI). To open the shell, go to the Azure portal, press the Cloud Shell button, and select PowerShell. If this is your first-time using Azure Cloud PowerShell, you will need to walk through the one-time configuration wizard.
 
 
 Copy and paste the following script in to PowerShell to create the table in your workspace. Make sure to replace the {subscription}, {resource group}, {workspace name}, and {table name} in the script. Make sure that there are no extra blanks at the beginning or end of the parameters
@@ -325,6 +325,29 @@ To create the data collection rule in the Azure portal:
 
 > [!NOTE]
 > It can take up to 5 minutes for data to be sent to the destinations after you create the data collection rule.
+
+### Sample log queries
+The column names used here are for example only. The column names for your log will most likely be different.
+
+- **Count the number of events by code.**
+    
+    ```kusto
+    MyApp_CL
+    | summarize count() by code
+    ```
+
+### Sample alert rule
+
+- **Create an alert rule on any error event.**
+    
+    ```kusto
+    MyApp_CL
+    | where status == "Error"
+    | summarize AggregatedValue = count() by Computer, bin(TimeGenerated, 15m)
+    ```
+
+
+
 ## Troubleshoot
 Use the following steps to troubleshoot collection of text logs. 
 

articles/azure-monitor/best-practices-cost.md

@@ -80,7 +80,7 @@ Since Azure Monitor charges for the collection of data, your goal should be to c
 
 | Recommendation | Description |
 |:---|:---|
-| Configure VM agents to collect only critical events. | Virtual machines can vary significantly in the amount of data they collect, depending on the amount of telemetry generated by the applications and services they have installed. See [Monitor virtual machines with Azure Monitor: Workloads](vm/monitor-virtual-machine-workloads.md#controlling-costs) for guidance on data to collect and strategies for using XPath queries and transformations to limit it.|
+| Configure VM agents to collect only critical events. | Virtual machines can vary significantly in the amount of data they collect, depending on the amount of telemetry generated by the applications and services they have installed. See [Monitor virtual machines with Azure Monitor: Workloads](vm/monitor-virtual-machine-data-collection.md#controlling-costs) for guidance on data to collect and strategies for using XPath queries and transformations to limit it.|
 | Ensure that VMs aren't sending duplicate data. | Any configuration that uses multiple agents on a single machine or where you multi-home agents to send data to multiple workspaces may incur charges for the same data multiple times. If you do multi-home agents, make sure you're sending unique data to each workspace. See [Analyze usage in Log Analytics workspace](logs/analyze-usage.md) for guidance on analyzing your collected data to make sure you aren't collecting duplicate data. If you're migrating between agents, continue to use the Log Analytics agent until you [migrate to the Azure Monitor agent](./agents/azure-monitor-agent-migration.md) rather than using both together unless you can ensure that each is collecting unique data. |
 
 #### Container insights

articles/azure-monitor/containers/container-insights-log-alerts.md

@@ -43,7 +43,7 @@ You might also decide not to split when you want a condition on multiple resourc
 You might want to see a list of the alerts by affected computer. You can use a custom workbook that uses a custom [resource graph](../../governance/resource-graph/overview.md) to provide this view. Use the following query to display alerts, and use the data source **Azure Resource Graph** in the workbook.
 
 ## Create a log query alert rule
-To create a log query alert rule by using the portal, see [this example of a log query alert](../vm/monitor-virtual-machine-alerts.md#example-log-query-alert), which provides a complete walkthrough. You can use these same processes to create alert rules for AKS clusters by using queries similar to the ones in this article.
+To create a log query alert rule by using the portal, see [this example of a log query alert](../alerts/tutorial-log-alert.md), which provides a complete walkthrough. You can use these same processes to create alert rules for AKS clusters by using queries similar to the ones in this article.
 
 To create a query alert rule by using an Azure Resource Manager (ARM) template, see [Resource Manager template samples for log alert rules in Azure Monitor](../alerts/resource-manager-alerts-log.md). You can use these same processes to create ARM templates for the log queries in this article.
 

articles/azure-monitor/toc.yml

@@ -56,16 +56,16 @@ items:
       items:
       - name: Overview
         href: vm/monitor-virtual-machine.md
-      - name: Configure monitoring
-        href: vm/monitor-virtual-machine-configure.md
+      - name: Deploy agents
+        href: vm/monitor-virtual-machine-agent.md
+      - name: Collect data
+        href: vm/monitor-virtual-machine-data-collection.md
       - name: Analyze data
         href: vm/monitor-virtual-machine-analyze.md
-      - name: Monitor security
-        href: vm/monitor-virtual-machine-security.md
       - name: Create alerts
         href: vm/monitor-virtual-machine-alerts.md
-      - name: Monitor workloads
-        href: vm/monitor-virtual-machine-workloads.md
+      - name: Migrate management pack logic
+        href: vm/monitor-virtual-machine-management-packs.md
     - name: Enable recommended alerts
       href: vm/tutorial-monitor-vm-alert-recommended.md
     - name: Create availability alert

articles/azure-monitor/visualize/vmext-troubleshoot.md

@@ -32,7 +32,7 @@ If the *Microsoft Monitoring Agent* VM extension is not installing or reporting,
 1. Check if the Azure VM agent is installed and working correctly by using the steps in [KB 2965986](https://support.microsoft.com/kb/2965986#mt1).
    * You can also review the VM agent log file `C:\WindowsAzure\logs\WaAppAgent.log`
    * If the log does not exist, the VM agent is not installed.
-   * [Install the Azure VM Agent](../vm/monitor-virtual-machine.md#agents)
+   * [Install the Azure VM Agent](../../virtual-machines/extensions/agent-windows.md#install-the-vm-agent)
 2. Review the Microsoft Monitoring Agent VM extension log files in `C:\Packages\Plugins\Microsoft.EnterpriseCloud.Monitoring.MicrosoftMonitoringAgent`
 3. Ensure the virtual machine can run PowerShell scripts
 4. Ensure permissions on C:\Windows\temp haven’t been changed