Skip to content

Commit f381672

Browse files
huypubhuypub
authored
Merge pull request #276482 from MicrosoftDocs/release-lb-health-model-p1
Release lb health model p1--scheduled release at 10AM of 5/29
2 parents 9de2f4c + c240c11 commit f381672

16 files changed

+385
-33
lines changed

‎articles/load-balancer/TOC.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,8 @@
136136
href: load-balancer-insights.md
137137
- name: Standard Load Balancer metrics and diagnostics
138138
href: load-balancer-standard-diagnostics.md
139+
- name: Load Balancer Health Event Logs
140+
href: load-balancer-health-event-logs.md
139141
- name: Inbound connectivity
140142
items:
141143
- name: Inbound NAT rules
@@ -168,12 +170,14 @@
168170
href: manage-probes-how-to.md
169171
- name: Create a custom HTTP/HTTPS health probe
170172
href: create-custom-http-health-probe-howto.md
171-
- name: Load Balancer metrics
173+
- name: Load Balancer metrics and logs
172174
items:
173175
- name: Get Load Balancer metrics with Azure Monitor CLI
174176
href: load-balancer-monitor-metrics-cli.md
175177
- name: Get Load Balancer metrics with REST
176178
href: load-balancer-query-metrics-rest-api.md
179+
- name: Monitor and alert with LoadBalancerHealthEvent logs
180+
href: load-balancer-monitor-alert-health-event-logs.md
177181
- name: Inbound connectivity
178182
items:
179183
- name: Floating IP configuration
@@ -264,6 +268,8 @@
264268
href: troubleshoot-load-balancer-imds.md
265269
- name: Common deployment errors
266270
href: load-balancer-common-deployment-errors.md
271+
- name: Troubleshoot load balancer health event logs
272+
href: load-balancer-troubleshoot-health-event-logs.md
267273
- name: Reference
268274
items:
269275
- name: Code samples

‎articles/load-balancer/load-balancer-health-event-logs.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
title: Azure Load Balancer health event logs
3+
titleSuffix: Azure Load Balancer
4+
description: Learn what health event logs are available for Azure Load Balancer including severity definitions, health event types, and publishing frequency.
5+
author: mbender-ms
6+
ms.service: load-balancer
7+
ms.topic: concept
8+
ms.date: 05/21/2024
9+
ms.author: mbender
10+
ms.custom: references_regions
11+
# customer intent: As a network admin, I want to use LoadBalancerHealthEvent logs for Azure Load Balancer for monitoring and alerting so that I can identify and troubleshoot ongoing issues affecting my load balancer resource’s health.
12+
---
13+
14+
# Azure Load Balancer health event logs
15+
16+
Azure Load Balancer supports health event logs to help you identify and troubleshoot ongoing issues affecting your load balancer resource’s health. These events are provided through the Azure Monitor resource log category LoadBalancerHealthEvent.
17+
18+
These logs are supported for Standard (regional and global tier) and Gateway Load Balancers.
19+
20+
[!INCLUDE [load-balancer-health-event-logs-preview](../../includes/load-balancer-health-event-logs-preview.md)]
21+
22+
23+
## Severity definitions
24+
25+
Each health event type has an associated severity to indicate the level of expected impact. This property can help with filtering logs and creating more individualized alerts based on the urgency of the issue.
26+
27+
| **Severity** | **Description** |
28+
| --- | --- |
29+
| **Critical** | The load balancer resource needs immediate attention. The functionality of the load balancer is affected. This impact can cause issues such as failed connections, unsuccessful CRUD (create, read, update, delete) operations, or misconfigured load balancer components. |
30+
| **Warning** | The load balancer resource needs to be monitored or reviewed. The functionality of the load balancer can be affected in certain scenarios or is operating in a partially degraded state. |
31+
32+
33+
## Health event types and publishing frequency
34+
35+
Health events can be detected in various ways – some events are generated through actively checking the state of the load balancer, while others can be generated when an explicit condition being met. Each event has the possibility of being published every minute, if the event occurred during the detection window.
36+
37+
Once a health event is published, there's an extended window of time when the event isn't republished. This window of time prevents publication of excessive logs when there's a persistent issue. Following this redetection interval, the health event is republished if the issue still persists.
38+
39+
Each event log is published with a timestamp that indicates the time that Azure Load Balancer detects the event at the platform level. There can be a delay between the detection and the event publishing by Azure Monitor.
40+
41+
| **Status** | **LoadBalancerHealthEventType** | **Severity** | **Description** | **Detection window** | **Re-detection interval** | **Supported properties** |
42+
| --- | --- | --- | --- | --- | --- | --- |
43+
| **Preview** | *DataPathAvailabilityWarning* | Warning | This event is published per affected Load Balancer frontend IP, when the Data Path Availability metric of the frontend IP is less than 25% due to platform issues | 1 minute | 5 minutes | Frontend IP address, List of frontend ports associated with affected load balancing rules |
44+
| **Preview** | *DataPathAvailabilityCritical* | Critical | This event is published per affected Load Balancer frontend IP, when the Data Path Availability metric of the frontend IP is less than 90% due to platform issues | 1 minute | 5 minutes | Frontend IP address, List of frontend ports associated with affected load balancing rules |
45+
| **Preview** | *NoHealthyBackends* | Critical | This event is published per Load Balancer frontend IP, when an associated backend pool has no backend instances responding to the configured health probes. As a result, the load balancer has no healthy backends to distribute traffic to. | On-demand | 60 minutes | Frontend IP address, Pairwise list of protocol and frontend ports associated with affected load balancing rules |
46+
| **Preview** | *HighSnatPortUsage* | Warning | This event is published on a per backend instance-level, when a backend instance utilizes more than 75% of its allocated ports from a single frontend IP. | On-demand | 5 minutes | Backend IP address, Frontend IP address |
47+
| **Preview** | *SnatPortExhaustion* | Critical | This event is published on a per backend instance-level. Publication occurs when a backend instance exhausts all allocated ports and fails any further outbound connections. This event continues until ports are released or more ports are allocated. | On-demand | 5 minutes | Backend IP address, Frontend IP address |
48+
49+
For more information on the properties published with each health event log, refer to the Azure Log Analytics reference documentation for the log table [*ALBHealthEvent*](/azure/azure-monitor/reference/tables/albhealthevent).
50+
51+
## Next steps
52+
In this article, you learned about Azure Load Balancer health event logs and health event types.
53+
54+
For more information about how to collect, analyze, and create alerts using these logs, along with troubleshooting each health event type, see:
55+
56+
- [Learn to monitor and alert with Azure Load Balancer health event logs](load-balancer-monitor-alert-health-event-logs.md).
57+
- [Troubleshoot Azure Load Balancer health event logs](load-balancer-troubleshoot-health-event-logs.md)

‎articles/load-balancer/load-balancer-monitor-alert-health-event-logs.md

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
title: Monitor and alert with LoadBalancerHealthEvent logs
3+
titleSuffix: Azure Load Balancer
4+
description: Learn how to monitor and alert with LoadBalancerHealthEvent logs for Azure Load Balancer.
5+
author: mbender-ms
6+
ms.service: load-balancer
7+
ms.topic: how-to
8+
ms.date: 05/21/2024
9+
ms.author: mbender
10+
ms.custom: references_regions
11+
# customer intent: As a network admin, I want to use LoadBalancerHealthEvent logs for Azure Load Balancer for monitoring and alerting so that I can identify and troubleshoot ongoing issues affecting my load balancer resource’s health.
12+
---
13+
14+
# Monitor and alert with LoadBalancerHealthEvent logs
15+
16+
In this article, you learn how to monitor and alert with Azure Load Balancer health event logs. These logs can help you identify and troubleshoot ongoing issues affecting your load balancer resource’s health. The health event logs are provided through the Azure Monitor resource log category *LoadBalancerHealthEvent*.
17+
18+
[!INCLUDE [load-balancer-health-event-logs-preview](../../includes/load-balancer-health-event-logs-preview.md)]
19+
20+
## Prerequisites
21+
22+
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/).
23+
- An Azure Load Balancer resource. To learn how to create a Load Balancer resource, see [Quickstart: Create a public Standard Load Balancer](./quickstart-load-balancer-standard-public-portal.md).
24+
- An Azure Monitor Log Analytics workspace. To learn how to create a Log Analytics workspace, see [Quickstart: Create a Log Analytics workspace](../azure-monitor/logs/quick-create-workspace.md).
25+
26+
## Configuring diagnostic settings to collect LoadBalancerHealthEvent logs
27+
28+
In this section, you learn configure diagnostic settings to collect LoadBalancerHealthEvent logs and store the logs in a log analytics workspace.
29+
30+
> [!IMPORTANT]
31+
> We recommend sending your logs to a Log Analytics workspace, which will enable you to control access, log data retention and archive settings, and more. To learn more about configuring Log Analytics workspaces, see [Log Analytics workspace overview - Azure Monitor](../azure-monitor/logs/log-analytics-workspace-overview.md).
32+
33+
1. In the Azure portal, navigate to your load balancer resource.
34+
1. From your load balancer resource's **Overview** page, choose **Monitoring** > **Diagnostic settings**.
35+
36+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/add-diagnostic-settings.png" alt-text="Screenshot of diagnostic settings window in Azure portal.":::
37+
38+
1. Select **+ Add diagnostic setting**.
39+
1. In the **Diagnostic setting** window, select or enter the following settings:
40+
41+
| **Setting** | **Value** |
42+
| --- | --- |
43+
| **Diagnostic setting name** | Enter a name for the diagnostic setting. |
44+
| **Logs** | |
45+
| **Category Groups** | Select **LoadBalancerHealthEvent** or **Load Balancer Health Event**. |
46+
| **Metrics** | Leave unchecked. |
47+
| **Destination details** | Select **Send to Log Analytics workspace**.</br>Select your subscription and your Log Analytics workspace. |
48+
49+
> [!NOTE]
50+
> Selecting **AllLogs** will result in all new log categories for load balancer resources to be automatically collected as they are supported. If you don't want this option, select only the log categories you want to collect. In this case, Load Balancer Health Event logs.
51+
52+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/configure-diagnostic-settings.png" alt-text="Screenshot of diagnostic settings configuration page configure for allLogs and log analytics workspace.":::
53+
54+
2. Select **Save** and close the **Diagnostic setting** window.
55+
56+
> [!NOTE]
57+
> Once your diagnostic setting has been configured, it can take up to 90 minutes for logs to begin appearing. If there are no health events affecting your load balancer, you may not see any logs.
58+
59+
## Configure a log query
60+
61+
In this section, you learn how to query LoadBalancerHealthEvent logs in a Log Analytics workspace. In this example, you query for the latest *SnatPortExhaustion* health events from the last day, and summarize the events by the load balancer’s *resource IDs* and *frontend IP configurations*.
62+
63+
1. In the Azure portal, navigate to your load balancer resource.
64+
1. From your load balancer resource’s **Overview** page, choose **Monitoring** > **Logs**.
65+
3. In the **Queries** window, enter **Latest SNAT Port** in the search bar.
66+
4. From the results, select **Load to editor** under **Latest SNAT Port Exhaustion per LB Frontend**.
67+
68+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/search-queries.png" alt-text="Screenshot of Queries window performing search for built-in query.":::
69+
70+
5. The following code is displayed in the query editor:
71+
72+
```kusto
73+
// Latest Snat Port Exhaustion Per LB Frontend
74+
// List the latest SNAT port exhaustion event per load balancer Frontend IP
75+
ALBHealthEvent
76+
| where TimeGenerated > ago(1d)
77+
| where HealthEventType == "SnatPortExhaustion"
78+
| summarize arg_max(TimeGenerated, *) by LoadBalancerResourceId, FrontendIP
79+
```
80+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/view-snat-query.png" alt-text="Screenshot of query editor with SNAT port exhaustion kusto query.":::
81+
82+
6. Select **Run** to execute the query.
83+
1. If you want to modify and save the query, make your query changes and select **Save**>**Save as query**.
84+
1. In the **Save a query** window, enter a name for the query, other optional information, and select **Save**.
85+
86+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/save-snat-query.png" alt-text="Screenshot of Save a query window.":::
87+
88+
## Create alerts based on LoadBalancerHealthEvent logs
89+
90+
In this section, you learn how to create an alert that sends an email whenever a *SnatPortExhaustion* event is logged within the past 5 minutes. You can create alerts based on log queries to be notified immediately when health event logs are generated, indicating potential impact to your load balancer resource.
91+
92+
1. In the Azure portal, navigate to your load balancer resource.
93+
1. From your load balancer resource’s **Overview** page, choose **Monitoring** > **Alerts**.
94+
3. On the **Alerts** page, select **Create customer alert rule**.
95+
4. On the **Create an alert rule** page, choose **Custom log search** under **Signal name**.
96+
5. In the **Logs** window for Log Analytics, enter the following query and select **Run**:
97+
98+
```kusto
99+
ALBHealthEvent
100+
| where TimeGenerated > ago(5m)
101+
| where HealthEventType == "SnatPortExhaustion"
102+
| summarize arg_max(TimeGenerated, *) by LoadBalancerResourceId, FrontendIP
103+
```
104+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/add-query-to-alert-rule.png" alt-text="Screenshot of Logs editor with query entered and run.":::
105+
106+
1. Select **Continue Editing Alert**
107+
2. On the **Conditions** tab, set the **Threshold value** to 0 under **Alert logic**.
108+
1. Select **Next: Actions>** or the **Actions** tab.
109+
2. On the **Select an action group** page, select **+ Create action group**.
110+
3. On the **Basics** tab, enter the following settings then select **Next: Notifications**:
111+
112+
| **Setting** | **Value** |
113+
| --- | --- |
114+
| **Project details** | |
115+
| **Subscription** | Select your subscription. |
116+
| **Resource group** | Select the resource group that contains your Log Analytics workspace. |
117+
| **Region** | Select the region for the action group. |
118+
| **Instance details** | |
119+
| **Action group name** | Enter a name for the action group. |
120+
| **Display name** | Enter a display name for the action group. |
121+
122+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/create-action-group.png" alt-text="Screenshot of Create action group window.":::
123+
124+
4. On the **Notifications** tab, enter the following settings:
125+
126+
| **Setting** | **Value** |
127+
| --- | --- |
128+
| **Notification type** | Select **Email/SMS message/Push/Voice**.</br>Enter the email address to receive the alert.</br>Select **Ok**. |
129+
| **Name** | Enter a name for the notification. |
130+
131+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/create-notification.png" alt-text="Screenshot of Notifications tab in Create action group window with email notification settings.":::
132+
133+
5. Select **Review + create** then **Create** to create the action group.
134+
6. On the **Create an alert rule** page, select **Next: Details** or the **Details** tab.
135+
7. On the **Details** tab, enter the following settings:
136+
8.
137+
| **Setting** | **Value** |
138+
| --- | --- |
139+
| **Severity** | Select the severity level for the alert. |
140+
| **Alert rule name** | Enter a name for the alert rule. |
141+
| **Alert rule description** | Enter a description for the alert rule. |
142+
| **Severity** | Select the severity level for the alert. |
143+
| **Region** | Select the region for the alert rule. |
144+
145+
:::image type="content" source="media/monitor-alert-load-balancer-health-event-logs/create-alert-rule-details-tab.png" alt-text="Screenshot of Details tab in Create an alert rule window.":::
146+
147+
9. Select **Review + create** then **Create** to create the alert rule.
148+
149+
## Next steps
150+
In this article, you learned how to collect, analyze, and create alerts using these logs.
151+
152+
For more information about Azure Load Balancer health event logs and health event types, along with how to troubleshoot each health event type, see:
153+
154+
- [Azure Load Balancer health event logs](load-balancer-health-event-logs.md)
155+
- [Troubleshoot load balancer health event logs](./load-balancer-troubleshoot-health-event-logs.md)

0 commit comments

Comments
 (0)