You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/azure/incident-response-with-alerting-on-azure/includes/8-exercise-activity-log-alerts.md
+69-48Lines changed: 69 additions & 48 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,77 +6,89 @@ Your goal is to set up a Linux virtual machine (VM) and create an activity log m
6
6
7
7
1. Sign in to the [Azure portal](https://portal.azure.com/learn.docs.microsoft.com?azure-portal=true) with the same account you used to activate the sandbox.
8
8
9
+
1. Select your user icon in the top right corner, then go to **Switch directory** and **Switch** to **Microsoft Learn Sandbox**.
10
+
9
11
1. On the Azure portal resource menu or under **Azure services**, select **Monitor**. The **Overview** pane for Monitor appears.
10
12
11
13
1. In the Monitor menu, select **Alerts**. The **Monitor | Alerts** pane appears.
12
14
13
-
1. On the command bar, select **Create +** and select **Alert rule**. The **Create an alert rule** pane appears with the **Scope** section open and the **Select a resource** pane open on the right-hand side of your screen.
15
+
1. On the command bar, select **+ Create** and select **Alert rule** from the dropdown list. The **Create an alert rule** pane appears in the background with the **Scope** section open, and the **Select a resource** overlay pane on the right-hand side of your screen.
16
+
17
+
1. On the **Select a resource** overlay pane in the **Resource types** dropdown list, search for and select **Virtual machines**.
14
18
15
-
1.In the **Resource type** dropdown list, search for and select **Virtual machines**.
19
+
1.You want an alert when any virtual machine in your resource group is deleted. Select the box for the Sandbox resource group **learn-53f3da3b-946a-4d7d-974e-6ac534868856**, then select **Apply**.
16
20
17
-
1. You want an alert when any virtual machine in your resource group is deleted. Select the box for the **<rgn>[sandbox resource group name]</rgn>** resource group, then select **Apply**.
21
+
:::image type="content" source="../media/8-alert-resource.png" lightbox="../media/8-alert-resource.png" alt-text="Screenshot that shows the 'Select a resource' pane with the sandbox resource group selected.":::
18
22
19
-
:::image type="content" source="../media/7-alert-select-resource.png" alt-text="Screenshot that shows the Select a scope pane with the sandbox resource group selected.":::
23
+
1. Back on the **Create an alert rule** pane, the Scope target resource now shows **All Virtual machines**. Select the **Condition** tab.
20
24
21
-
1.The **Create an alert rule**pane reappears with the Scope target resource showing **All Virtual machines**. Select the **Condition** tab. The **Select a signal** pane appears.
25
+
1.On the **Condition**tab, select the **See all signals** link, which opens the **Select a signal**overlay pane to the right-hand side of your screen.
22
26
23
-
1.Select the **See all signals**link, then search for and select **Delete Virtual Machine (Virtual Machines)**. Select**Apply**
27
+
1.On the **Select a signal**overlay pane, search for and select **Delete Virtual Machine (Virtual Machines)**, then select**Apply**
24
28
25
-
1. The **Create an alert rule** pane reappears. You want to receive alerts of all types, so leave **Alert logic** settings at their default of **All selected**. Leave the **Create an alert rule** pane open for the next section.
29
+
:::image type="content" source="../media/8-alert-signal.png" lightbox="../media/8-alert-signal.png" alt-text="Screenshot that shows the 'Select a signal' pane with 'Delete Virtual Machine (Virtual Machines)' selected.":::
30
+
31
+
1. You're back on the **Create an alert rule** pane. To receive alerts of all types, leave **Alert logic** settings at their default of **All selected**. Leave the **Create an alert rule** pane open for the next section.
26
32
27
33
## Add an email alert action
28
34
29
35
For the previous Azure Monitor alert, you didn't add any actions. You just viewed triggered alerts in the Azure portal. Actions let you send an email for notifications, to trigger an Azure function, or to call a webhook. In this exercise, we're adding an email alert when VMs are deleted.
30
36
31
-
1. On the **Create an alert rule** pane, select the **Next: Actions** button, and select **Use action groups**.
37
+
1. On the **Create an alert rule** pane, select the **Next: Actions** button.
38
+
39
+
1. Close the **Use quick actions (preview)** overlay pane. Then, select **Use action group** on the **Actions** tab. The **Select action groups** overlay pane appears.
32
40
33
-
1.Select **Create action group** in the **Select action group** pane. The**Create an action group** pane appears.
41
+
1.On the **Select action groups**overlay pane, select**+ Create action group**.
34
42
35
43
1. On the **Basics** tab, enter the following values for each setting.
36
44
37
-
| Setting | Value |
38
-
|---------|---------|
39
-
|**Project details**|
40
-
| Subscription |**Concierge Subscription**|
41
-
| Resource group | From the dropdown list, select your sandbox resource group |
42
-
| Region |**Global** (default) |
43
-
|**Instance details**|
44
-
| Action group name |**Alert the operations team**|
| Resource group | From the dropdown list, select your sandbox resource group.|
50
+
| Region |**Global** (default)|
51
+
|**Instance details**||
52
+
| Action group name |**Alert the operations team**|
53
+
| Display name |**AlertOps**|
46
54
47
-
1. Select **Next: Notifications**, and enter the following values for each setting.
55
+
:::image type="content" source="../media/8-action-group-basics.png" lightbox="../media/8-action-group-basics.png" alt-text="Screenshot that shows the 'Create action group' pane with all Project details and Instance details entered.":::
48
56
49
-
| Setting | Value |
50
-
|---------|---------|
57
+
1. Select **Next: Notifications** and enter the following values for each setting.
| Notification type | Select **Email/SMS message/Push/Voice**|
52
-
| Name |**VM was deleted**|
62
+
| Name |**VM was deleted**|
63
+
64
+
1. The **Email/SMS message/Push/Voice** overlay pane appears automatically on the right-hand side of the screen. If it didn't, select the **Edit** pencil icon.
53
65
54
-
1.The **Email/SMS message/Push/Voice** pane appears automatically. If it didn't, select the **Edit**pencil icon.
66
+
1.On the **Email/SMS message/Push/Voice**overlay pane, select **Email**. Then, in the **Email**field, enter your email address and select **OK**.
55
67
56
-
1. Select **Email**, and in the **Email** box, enter your email address, and then select **OK**.
68
+
:::image type="content" source="../media/8-alert-action.png" lightbox="../media/8-alert-action.png" alt-text="Screenshot that shows the 'Email/SMS message/Push/Voice' pane with Email selected.":::
57
69
58
-
1.Select**Review + create** to validate your input.
70
+
1.Back on the **Create action group** pane, select**Review + create** to validate your input.
59
71
60
72
1. Select **Create**.
61
73
62
74
1. The **Create an alert rule** pane reappears. Select **Next: Details** and enter the following values for each setting.
63
75
64
-
| Setting | Value |
65
-
|---------|---------|
66
-
| Alert rule name |**VM was deleted**|
67
-
| Description |**A VM in your resource group was deleted**|
| Description |**A VM in your resource group was deleted**|
68
80
69
81
1. Expand the **Advanced options** section and confirm that **Enable alert rule upon creation** is selected.
70
82
71
-
:::image type="content" source="../media/7-all-vm-alert-details.png" alt-text="Screenshot that shows a completed alert details section.":::
83
+
:::image type="content" source="../media/8-alert-details.png" lightbox="../media/8-alert-details.png" alt-text="Screenshot that shows a completed alert details section.":::
72
84
73
85
1. Select **Review + create** to validate your input, then select **Create**.
74
86
75
87
Recipients added to the configured action group (operations team) receive a notification:
76
88
77
-
- When they're added to the action group
78
-
- When the alert is activated
79
-
- When the alert is triggered
89
+
* When they're added to the action group
90
+
* When the alert is activated
91
+
* When the alert is triggered
80
92
81
93
It can take up to five minutes for an activity log alert rule to become active. In this exercise, if you delete the virtual machine before the rule deploys, the alert rule might not be triggered. Because of this delay, you might not see the same results in the following steps after you delete the VM.
82
94
@@ -92,6 +104,8 @@ To trigger an alert, you need to delete the Linux VM that you created in the pre
92
104
93
105
1. Enter *delete* to confirm deletion and select **Delete**.
94
106
107
+
:::image type="content" source="../media/8-delete-vm.png" lightbox="../media/8-delete-vm.png" alt-text="Screenshot that shows the 'Delete Resources' pane with the VM selected.":::
108
+
95
109
1. In the title bar, select the **Notifications** icon and wait until **vm1** is successfully deleted.
96
110
97
111
## View your activity log alerts in Azure Monitor
@@ -100,13 +114,13 @@ In the exercise, you set up an Ubuntu VM and created an activity log rule to det
100
114
101
115
1. You should receive a notification email that reads, **Important notice: Azure Monitor alert VM was deleted was activated...** If not, open your email program and look for an email from [email protected].
102
116
103
-
117
+
:::image type="content" source="../media/8-alert-email.png" lightbox="../media/8-alert-email.png" alt-text="Screenshot that shows the email you receive when an alert fires.":::
104
118
105
119
1. On the Azure portal resource menu, select **Monitor**, and then select **Alerts** in the menu on the left.
106
120
107
121
1. You should have three verbose alerts that were generated by deleting **vm1**.
108
122
109
-
123
+
:::image type="content" source="../media/8-alerts-pane.png" lightbox="../media/8-alerts-pane.png" alt-text="Screenshot that shows all alerts with Name, Severity, Alert condition, User response and Fired time.":::
110
124
111
125
1. Select the name of one of the alerts (For example, **VM was deleted**). An **Alert details** pane appears that shows more details about the event.
112
126
@@ -115,28 +129,35 @@ In the exercise, you set up an Ubuntu VM and created an activity log rule to det
115
129
We're going to schedule a one-time, overnight, planned maintenance. It starts in the evening and continues until the next morning.
116
130
117
131
1. In the Azure portal resource menu, select **Monitor**, select **Alerts** in the menu on the left, and select **Alert processing rules** in the menu bar.
132
+
118
133
1. Select **+ Create**.
134
+
119
135
1. Check the box for your sandbox resource group as the scope of the alert processing rule, then select **Apply**.
136
+
137
+
:::image type="content" source="../media/8-alert-processing-rule-resource.png" lightbox="../media/8-alert-processing-rule-resource.png" alt-text="Screenshot that shows the selected resource group for the alert processing rule.":::
138
+
120
139
1. Select **Next: Rule settings**, then select **Suppress notifications**.
140
+
121
141
1. Select **Next: Scheduling**.
142
+
122
143
1. By default, the rule works all the time, unless you disable it. We're going to define the rule to suppress notifications for a one-time overnight planned maintenance.
123
144
Enter these settings for the scheduling of the alert processing rule:
:::image type="content" source="../media/8-alert-processing-rule-schedule.png" alt-text="Screenshot of the scheduling section of an alert processing rule." lightbox="../media/8-alert-processing-rule-schedule.png":::
153
+
:::image type="content" source="../media/8-alert-processing-rule-schedule.png" lightbox="../media/8-alert-processing-rule-schedule.png" alt-text="Screenshot of the scheduling section of an alert processing rule.":::
133
154
134
155
1. Select **Next: Details** and enter these settings:
135
156
136
-
| Setting | Value |
137
-
|---------|---------|
138
-
|Resource group |Select your sandbox resource group. |
139
-
|Rule name|**Planned Maintenance**|
140
-
|Description|**Suppress notifications during planned maintenance.**|
0 commit comments