You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/cosmos-db/audit-control-plane-logs.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,9 @@ The following are some example scenarios where auditing control plane operations
23
23
24
24
## Disable key based metadata write access
25
25
26
-
Before you audit the control plane operations in Azure Cosmos DB, disable the key-based metadata write access on your account. When key based metadata write access is disabled, clients connecting to the Azure Cosmos account through account keys are prevented from accessing the account. You can disable write access by setting the `disableKeyBasedMetadataWriteAccess` property to true. After you set this property, changes to any resource can happen from a user with the proper Role-based access control(RBAC) role and credentials. To learn more on how to set this property, see the [Preventing changes from SDKs](role-based-access-control.md#preventing-changes-from-cosmos-sdk) article. Once this option - disableKeyBasedMetadataWriteAccess - is switched on - SDK based clients will see an error "Operation 'POST' on resource 'ContainerNameorDatabaseName' is not allowed through Azure Cosmos DB endpoint. Please switch on such operations for your account, or perform this operation through Azure Resource Manager, Azure CLI or Azure Powershell. The way to switch back is to reset disableKeyBasedMetadataWriteAccess to false using CLI as described [here](role-based-access-control.md#preventing-changes-from-cosmos-sdk) - remember to change true to false in the cli command.
26
+
Before you audit the control plane operations in Azure Cosmos DB, disable the key-based metadata write access on your account. When key based metadata write access is disabled, clients connecting to the Azure Cosmos account through account keys are prevented from accessing the account. You can disable write access by setting the `disableKeyBasedMetadataWriteAccess` property to true. After you set this property, changes to any resource can happen from a user with the proper Role-based access control(RBAC) role and credentials. To learn more on how to set this property, see the [Preventing changes from SDKs](role-based-access-control.md#preventing-changes-from-cosmos-sdk) article.
27
+
28
+
After the `disableKeyBasedMetadataWriteAccess` is turned on, if the SDK based clients run create or update operations, an error *"Operation 'POST' on resource 'ContainerNameorDatabaseName' is not allowed through Azure Cosmos DB endpoint* is returned. You have to turn on access to such operations for your account, or perform the create/update operations through Azure Resource Manager, Azure CLI or Azure Powershell. To switch back, set the disableKeyBasedMetadataWriteAccess to **false** by using Azure CLI as described in the [Preventing changes from Cosmos SDK](role-based-access-control.md#preventing-changes-from-cosmos-sdk) article. Make sure to change the value of `disableKeyBasedMetadataWriteAccess` to false instead of true.
27
29
28
30
Consider the following points when turning off the metadata write access:
Copy file name to clipboardExpand all lines: articles/cosmos-db/monitor-cosmos-db.md
+5-68Lines changed: 5 additions & 68 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,10 +11,11 @@ ms.custom: subject-monitoring
11
11
---
12
12
13
13
# Monitoring Azure Cosmos DB
14
+
14
15
When you have critical applications and business processes relying on Azure resources, you want to monitor those resources for their availability, performance, and operation. This article describes the monitoring data generated by Azure Cosmos databases and how you can use the features of Azure Monitor to analyze and alert on this data.
15
16
16
17
## What is Azure Monitor?
17
-
Azure Cosmos DB creates monitoring data using [Azure Monitor](../azure-monitor/overview.md) which is a full stack monitoring service in Azure that provides a complete set of features to monitor your Azure resources in addition to resources in other clouds and on-premises.
18
+
Azure Cosmos DB creates monitoring data using [Azure Monitor](../azure-monitor/overview.md) which is a full stack monitoring service in Azure that provides a complete set of features to monitor your Azure resources in addition to resources in other clouds and on-premises.
18
19
19
20
If you're not already familiar with monitoring Azure services, start with the article [Monitoring Azure resources with Azure Monitor](../azure-monitor/insights/monitor-azure-resource.md) which describes the following:
20
21
@@ -27,9 +28,8 @@ If you're not already familiar with monitoring Azure services, start with the ar
27
28
The following sections build on this article by describing the specific data gathered from Azure Cosmos DB and providing examples for configuring data collection and analyzing this data with Azure tools.
28
29
29
30
## Azure Monitor for Cosmos DB (Preview)
30
-
[Azure Monitor for Azure Cosmos DB](../azure-monitor/insights/cosmosdb-insights-overview.md) is based on the [workbooks feature of Azure Monitor](../azure-monitor/app/usage-workbooks.md) and uses the same monitoring data collected for Cosmos DB described in the sections below. Use this tool for a view of the overall performance, failures, capacity, and operational health of all your Azure Cosmos DB resources in a unified interactive experience, and leverage the other features of Azure Monitor for detailed analysis and alerting.
31
31
32
-

32
+
Azure Monitor for Azure Cosmos DB is based on the [workbooks feature of Azure Monitor](../azure-monitor/app/usage-workbooks.md) and uses the same monitoring data collected for Cosmos DB described in the sections below. Use Azure Monitor for a view of the overall performance, failures, capacity, and operational health of all your Azure Cosmos DB resources in a unified interactive experience, and leverage the other features of Azure Monitor for detailed analysis and alerting. To learn more, see the [Explore Azure Monitor for Azure Cosmos DB](../azure-monitor/insights/cosmosdb-insights-overview.md) article.
33
33
34
34
> [!NOTE]
35
35
> When creating containers, make sure you don’t create two containers with the same name but different casing. That’s because some parts of the Azure platform are not case-sensitive, and this can result in confusion/collision of telemetry and actions on containers with such names.
@@ -82,7 +82,6 @@ You can analyze metrics for Azure Cosmos DB with metrics from other Azure servic
82
82
- Region
83
83
- StatusCode
84
84
85
-
86
85
## Analyzing log data
87
86
Data in Azure Monitor Logs is stored in tables which each table having its own set of unique properties. Azure Cosmos DB stores data in the following tables.
88
87
@@ -109,22 +108,6 @@ Following are queries that you can use to help you monitor your Azure Cosmos dat
109
108
110
109
```
111
110
112
-
* To query for the 10 most recently logged events:
113
-
114
-
```Kusto
115
-
AzureDiagnostics
116
-
| where ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests"
117
-
| limit 10
118
-
```
119
-
120
-
* To query for all operations, grouped by operation type:
121
-
122
-
```Kusto
123
-
AzureDiagnostics
124
-
| where ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests"
125
-
| summarize count() by OperationName
126
-
```
127
-
128
111
* To query for all operations, grouped by resource:
129
112
130
113
```Kusto
@@ -141,59 +124,13 @@ Following are queries that you can use to help you monitor your Azure Cosmos dat
141
124
| where Caller == "[email protected]" and ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests"
142
125
| summarize count() by Resource
143
126
```
144
-
* To get all queries greater than 100 RUs joined with data from **DataPlaneRequests** and **QueryRunTimeStatistics**.
145
-
146
-
```Kusto
147
-
AzureDiagnostics
148
-
| where ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests" and todouble(requestCharge_s) > 100.0
149
-
| project activityId_g, requestCharge_s
150
-
| join kind= inner (
151
-
AzureDiagnostics
152
-
| where ResourceProvider =="MICROSOFT.DOCUMENTDB" and Category == "QueryRuntimeStatistics"
153
-
| project activityId_g, querytext_s
154
-
) on $left.activityId_g == $right.activityId_g
155
-
| order by requestCharge_s desc
156
-
| limit 100
157
-
```
158
-
159
-
* To query for which operations take longer than 3 milliseconds:
160
-
161
-
```Kusto
162
-
AzureDiagnostics
163
-
| where toint(duration_s) > 3 and ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests"
164
-
| summarize count() by clientIpAddress_s, TimeGenerated
165
-
```
166
-
167
-
* To query for which agent is running the operations:
168
-
169
-
```Kusto
170
-
AzureDiagnostics
171
-
| where ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests"
172
-
| summarize count() by OperationName, userAgent_s
173
-
```
174
-
175
-
* To query for when the long running operations were performed:
176
-
177
-
```Kusto
178
-
AzureDiagnostics
179
-
| where ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="DataPlaneRequests"
180
-
| project TimeGenerated , duration_s
181
-
| summarize count() by bin(TimeGenerated, 5s)
182
-
| render timechart
183
-
```
184
-
185
-
* To get Partition Key statistics to evaluate skew across top 3 partitions for database account:
186
-
187
-
```Kusto
188
-
AzureDiagnostics
189
-
| where ResourceProvider=="MICROSOFT.DOCUMENTDB" and Category=="PartitionKeyStatistics"
The account level metrics available in the portal, such as account storage usage and total requests, are not available via the SQL APIs. However, you can retrieve usage data at the collection level by using the SQL APIs. To retrieve collection level data, do the following:
195
131
196
132
* To use the REST API, [perform a GET on the collection](https://msdn.microsoft.com/library/mt489073.aspx). The quota and usage information for the collection is returned in the x-ms-resource-quota and x-ms-resource-usage headers in the response.
133
+
197
134
* To use the .NET SDK, use the [DocumentClient.ReadDocumentCollectionAsync](https://msdn.microsoft.com/library/microsoft.azure.documents.client.documentclient.readdocumentcollectionasync.aspx) method, which returns a [ResourceResponse](https://msdn.microsoft.com/library/dn799209.aspx) that contains a number of usage properties such as **CollectionSizeUsage**, **DatabaseUsage**, **DocumentUsage**, and more.
198
135
199
136
To access additional metrics, use the [Azure Monitor SDK](https://www.nuget.org/packages/Microsoft.Azure.Insights). Available metric definitions can be retrieved by calling:
0 commit comments