You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Exercise - Troubleshoot a network by using Network Watcher monitoring and diagnostic tools
5
-
description: In this unit, you'll set up a virtual network with constituent VMs and then use Network Watcher to view the topology and monitor connections.
6
-
ms.date: 01/16/2024
7
-
author: halkazwini
8
-
ms.author: halkazwini
9
-
ms.topic: unit
10
-
ms.custom:
11
-
- devx-track-azurecli
12
-
title: Exercise - Troubleshoot a network by using Network Watcher monitoring and diagnostic tools
title: Exercise - Troubleshoot a network by using Network Watcher monitoring and diagnostic tools
5
+
description: In this unit, you set up a virtual network with constituent virtual machines and then use Network Watcher to view the topology and monitor connections.
6
+
ms.date: 01/16/2024
7
+
author: halkazwini
8
+
ms.author: halkazwini
9
+
ms.topic: unit
10
+
ms.custom:
11
+
- devx-track-azurecli
12
+
title: Exercise - Troubleshoot a network by using Network Watcher monitoring and diagnostic tools
title: Troubleshoot a network by using Network Watcher metrics and logs
5
-
description: In this unit, you'll learn about the information presented in the Network Management metrics and logs, and how they can help you to diagnose issues.
6
-
ms.date: 01/16/2024
7
-
author: halkazwini
8
-
ms.author: halkazwini
9
-
ms.topic: unit
10
-
title: Troubleshoot a network by using Network Watcher metrics and logs
title: Troubleshoot a network by using Network Watcher metrics and logs
5
+
description: In this unit, you learn about the information presented in the Network Management metrics and logs, and how they can help you to diagnose issues.
6
+
ms.date: 01/16/2024
7
+
author: halkazwini
8
+
ms.author: halkazwini
9
+
ms.topic: unit
10
+
title: Troubleshoot a network by using Network Watcher metrics and logs
Copy file name to clipboardExpand all lines: learn-pr/azure/troubleshoot-azure-network-infrastructure/includes/3-exercise-troubleshoot-networking-with-network-watcher.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,13 @@ Azure Network Watcher helps you diagnose configuration errors that prevent virtu
2
2
3
3
Suppose you have two VMs that can't communicate. You want to diagnose the problem and resolve it as fast as possible. You want to use Network Watcher to do that.
4
4
5
-
Here, you'll troubleshoot connectivity between two VMs in different subnets.
5
+
In this unit, you troubleshoot connectivity between two VMs in different subnets.
Let's start by creating the infrastructure. We'll also purposely be creating a configuration error:
11
+
Let's start by creating the infrastructure. We're also going to purposely create a configuration error:
12
12
13
13
1. In your browser, open an [Azure Cloud Shell](https://shell.azure.com/?azure-portal=true) session.
14
14
@@ -64,9 +64,9 @@ Let's start by creating the infrastructure. We'll also purposely be creating a c
64
64
```
65
65
66
66
> [!NOTE]
67
-
> If you get an error "partofthepassword: event not found", create a new password using allowed characters.
67
+
> If you get an error with the message *partofthepassword: event not found*, create a new password using allowed characters.
68
68
69
-
1. Install IIS on **FrontendVM** by running the following code.
69
+
1. Install Internet Information Services (IIS) on **FrontendVM** by running the following code.
70
70
71
71
```azurecli
72
72
az vm extension set \
@@ -154,15 +154,15 @@ az network watcher configure \
154
154
155
155
## Use Network Watcher to show the topology
156
156
157
-
Now, you can use Network Watcher in the Azure portal to troubleshoot connectivity between two VMs in different subnets. Your colleague has reported a connectivity issue over HTTP/HTTPS between the two VMs. First, investigate the network topology.
157
+
Now, you can use Network Watcher in the Azure portal to troubleshoot connectivity between two VMs in different subnets. Your colleague reported a connectivity issue over HTTP/HTTPS between the two VMs. First, investigate the network topology.
158
158
159
159
1. Sign in to the [Azure portal](https://portal.azure.com?azure-portal=true).
160
160
161
161
1. In the global search, enter **Network Watcher** and select that service. The **Network Watcher** Overview pane appears, listing the active network watcher.
162
162
163
163
1. In the Network Watcher menu, under **Monitoring**, select **Topology**. The **Network Watcher | Topology** pane appears.
164
164
165
-
1. In the dropdown fields, select your **Subscription** and **Resource Group** for this exercise. The network topology for **MyVNet1** displays the frontend and backend VM interfaces. This is the virtual network you created at the beginning of this exercise.
165
+
1. In the dropdown fields, select your **Subscription** and **Resource Group** for this exercise. The network topology for **MyVNet1** displays the frontend and backend VM interfaces. This virtual network is the one you created at the beginning of this exercise.
166
166
167
167
:::image type="content" source="../media/3-network-topology.png" alt-text="Screenshot showing the exercise network topology." lightbox="../media/3-network-topology.png":::
168
168
@@ -209,7 +209,7 @@ The topology appears to be correct. To get more information, let's set up some t
209
209
| Test Frequency | Every 30 seconds |
210
210
|*Keep the default values for the remaining settings*|
211
211
212
-
1. Select **Add Test configuration** to add this test configuration to your test group. The **Add test group details** reappears with your test configuration identified.
212
+
1. Select **Add Test configuration** to add this test configuration to your test group. The **Add test group details** reappears with your test configuration identified.
213
213
214
214
1. In the **Destinations** box, select **Add destinations**. The **Add Destinations** pane appears.
215
215
@@ -301,4 +301,4 @@ Let's use the IP flow verify tool to get more information.
301
301
302
302
1. The Result shows Access denied because of NSG and security rules.
303
303
304
-
In this exercise, you have successfully used Network Watcher tools to discover the connectivity issue between the two subnets. Communication is allowed one way but blocked the other way because of NSG rules.
304
+
In this exercise, you successfully used Network Watcher tools to discover the connectivity issue between the two subnets. Communication is allowed one way but blocked the other way because of NSG rules.
Copy file name to clipboardExpand all lines: learn-pr/azure/troubleshoot-azure-network-infrastructure/includes/4-troubleshoot-networking-with-network-watcher-metrics-logs.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,13 @@ If you want to diagnose a problem quickly, you have to understand the informatio
2
2
3
3
In your engineering company, you want to minimize the time it takes for your staff to diagnose and resolve any network configuration problem. You want to ensure they know which information is available in which logs.
4
4
5
-
In this module, you'll focus on flow logs, diagnostic logs, and traffic analytics. You'll learn how these tools can help to troubleshoot the Azure network.
5
+
In this module, you focus on flow logs, diagnostic logs, and traffic analytics, learning how these tools can help to troubleshoot the Azure network.
6
6
7
7
## Usage and quotas
8
8
9
9
You can use each Microsoft Azure resource up to its quota. Each subscription has separate quotas, and usage is tracked per subscription. Only one instance of Network Watcher is required per subscription per region. This instance gives you a view of usage and quotas so that you can see if you're at risk of hitting a quota.
10
10
11
-
To view the usage and quota information, go to **All Services** > **Networking** > **Network Watcher**, and then select **Usage and quotas**. You'll see granular data based on usage and resource location. Data for the following metrics is captured:
11
+
To view the usage and quota information, go to **All Services** > **Networking** > **Network Watcher**, and then select **Usage and quotas**. Here, you see granular data based on usage and resource location. Data for the following metrics is captured:
12
12
13
13
- Network interfaces
14
14
- Network security groups (NSGs)
@@ -21,7 +21,7 @@ Here's an example that shows usage and quotas in the portal:
21
21
22
22
## Logs
23
23
24
-
Network diagnostic logs provide granular data. You'll use this data to understand connectivity and performance issues better. There are three log display tools in Network Watcher:
24
+
Network diagnostic logs provide granular data that allow you to better understand connectivity and performance issues. There are three log display tools in Network Watcher:
25
25
26
26
- NSG Flow logs
27
27
- Diagnostic logs
@@ -59,15 +59,15 @@ You can also use open-source tools to analyze your logs, such as Elastic Stack,
59
59
60
60
### Diagnostic logs
61
61
62
-
In Network Watcher, diagnostic logs are a central place to enable and disable logs for Azure network resources. These resources might include NSGs, public IPs, load balancers, and app gateways. After you've enabled the logs that interest you, you can use the tools to query and view log entries.
62
+
In Network Watcher, diagnostic logs are a central place to enable and disable logs for Azure network resources. These resources might include NSGs, public IPs, load balancers, and app gateways. After you enable the logs that interest you, you can use the tools to query and view log entries.
63
63
64
64
You can import diagnostic logs into Power BI and other tools to analyze them.
65
65
66
66
### Traffic analytics
67
67
68
68
To investigate user and app activity across your cloud networks, use traffic analytics.
69
69
70
-
The tool gives insights into network activity across subscriptions. You can diagnose security threats such as open ports, VMs communicating with known bad networks, and traffic flow patterns. Traffic analytics analyzes NSG flow logs across Azure regions and subscriptions. You can use the data to optimize network performance.
70
+
The tool gives insights into network activity across subscriptions. You can diagnose security threats such as open ports, virtual machines (VMs) communicating with known bad networks, and traffic flow patterns. Traffic analytics analyzes NSG flow logs across Azure regions and subscriptions. You can use the data to optimize network performance.
71
71
72
72
This tool requires Log Analytics. The Log Analytics workspace must exist in a supported region.
73
73
@@ -89,7 +89,7 @@ First, check that the VM size is appropriate for the job. Next, enable Azure Dia
89
89
90
90
Let's assume you have a VM that has been running fine. However, the VM's performance has recently degraded. To identify if you have any resource bottlenecks, you need to review the captured data.
91
91
92
-
Start with a time range of captured data before, during, and after the reported problem to get an accurate view of performance. These graphs can also be useful for cross-referencing different resource behaviors in the same period. You'll check for:
92
+
Start with a time range of captured data before, during, and after the reported problem to get an accurate view of performance. These graphs can also be useful for cross-referencing different resource behaviors in the same period. You check for:
93
93
94
94
- CPU bottlenecks
95
95
- Memory bottlenecks
@@ -113,23 +113,23 @@ If you scale up the VM and the CPU is still running at above 95 percent, is app
113
113
114
114
#### Memory bottlenecks
115
115
116
-
You can view the amount of memory that the VM uses. Logs will help you understand the trend and if it maps to the time at which you see issues. You shouldn't have less than 100 MB of available memory at any time. Watch out for the following trends:
116
+
You can view the amount of memory that the VM uses. Logs can help you understand the trend and if it maps to the time at which you see issues. You shouldn't have less than 100 MB of available memory at any time. Watch out for the following trends:
117
117
118
-
-**Spike up and constant consumption**. High memory utilization might not be the cause of bad performance. Some apps, such as relational database engines, are memory intensive by design. But if there are multiple memory-hungry apps, you might see bad performance because memory contention causes trimming and paging to disk. These processes will cause a negative performance impact.
118
+
-**Spike up and constant consumption**. High memory utilization might not be the cause of bad performance. Some apps, such as relational database engines, are memory intensive by design. But if there are multiple memory-hungry apps, you might see bad performance because memory contention causes trimming and paging to disk. These processes cause a negative performance impact.
119
119
-**Steadily increasing consumption**. This trend might be an app *warming up*. It's common when database engines start up. However, it might also be a sign of a memory leak in an app.
120
120
-**Page or swap file usage**. Check if you're using the Windows page file heavily, or the Linux swap file, located in /dev/sdb.
121
121
122
122
To resolve high memory utilization, consider these solutions:
123
123
124
-
-For immediate relief or page file usage, increase the size of the VM to add memory, and then monitor.
124
+
-Increase the size of the VM to add memory, and then monitor. For immediate relief or excess page file usage.
125
125
- Investigate the issue further. Locate the app or process causing the bottleneck and troubleshoot it. If you know the app, see if you can cap the memory allocation.
126
126
127
127
#### Disk bottlenecks
128
128
129
129
Network performance might also be related to the storage subsystem of the VM. You can investigate the storage account for the VM in the portal. To identify issues with storage, look at performance metrics from the storage account diagnostics and the VM diagnostics. Look for key trends when the issues occur within a particular time range.
130
130
131
131
- To check for Azure Storage timeout, use the metrics **ClientTimeOutError**, **ServerTimeOutError**, **AverageE2ELatency**, **AverageServerLatency**, and **TotalRequests**. If you see values in the **TimeOutError** metrics, an I/O operation took too long and timed out. If you see **AverageServerLatency** increase at the same time as **TimeOutErrors**, it might be a platform issue. Raise a case with Microsoft technical support.
132
-
- To check for Azure Storage throttling, use the storage account metric **ThrottlingError**. If you see throttling, you're hitting the IOPS limit of the account. You can check this problem by investigating the metric **TotalRequests**.
132
+
- To check for Azure Storage throttling, use the storage account metric **ThrottlingError**. If you see throttling, you're hitting the input/output operations per second (IOPS) limit of the account. You can check this problem by investigating the metric **TotalRequests**.
133
133
134
134
To remediate high disk utilization and latency issues:
135
135
@@ -138,18 +138,18 @@ To remediate high disk utilization and latency issues:
138
138
139
139
#### Virtual machine firewall rules that block traffic
140
140
141
-
To troubleshoot an NSG flow issue, use the Network Watcher IP flow verify tool and NSG flow logging to determine whether an NSG or User Defined Routing (UDR) is interfering with traffic flow.
141
+
To troubleshoot an NSG flow issue, use the Network Watcher tool IP flow verify and NSG flow logging, to determine whether an NSG or User Defined Routing (UDR) is interfering with traffic flow.
142
142
143
143
Run IP flow verify, and specify the local VM and the remote VM. After you select **Check**, Azure runs a logical test on rules in place. If the result is that access is allowed, use NSG flow logs.
144
144
145
145
In the portal, go to the NSGs. Under the flow log settings, select **On**. Now try to connect to the VM again. Use Network Watcher traffic analytics to visualize the data. If the result is that access is allowed, there's no NSG rule in the way.
146
146
147
-
If you've reached this point and still haven't diagnosed the problem, there might be something wrong on the remote VM. Disable the firewall on the remote VM, and then retest connectivity. If you can connect to the remote VM with the firewall disabled, verify the remote firewall settings. Then re-enable the firewall.
147
+
If you reach this point and the problem still isn't diagnosed, there might be something wrong on the remote VM. Disable the firewall on the remote VM, and then retest connectivity. If you can connect to the remote VM with the firewall disabled, verify the remote firewall settings. Then re-enable the firewall.
148
148
149
149
#### Inability of the front end and back end subnets to communicate
150
150
151
151
By default, all subnets can communicate in Azure. If two VMs on two subnets can't communicate, there must be a configuration that's blocking communication. Before you check the flow logs, run the IP flow verify tool from the front end VM to the back end VM. This tool runs a logical test on the rules on the network.
152
152
153
153
If the result is an NSG on the back end subnet blocking all communication, reconfigure that NSG. For security purposes, you must block some communication with the front end because the front end is exposed to the public internet.
154
154
155
-
By blocking communication to the back end, you limit the amount of exposure in the event of a malware or security attack. However, if the NSG blocks everything, then it's incorrectly configured. Enable the specific protocols and ports that are required.
155
+
By blocking communication to the back end, you limit the amount of exposure if there's a malware or security attack. However, if the NSG blocks everything, then its configuration isn't correct. Enable the specific protocols and ports that are required.
0 commit comments