|
| 1 | +--- |
| 2 | +id: azure-virtual-machine |
| 3 | +title: Azure Virtual Machine |
| 4 | +description: Learn about the Sumo Logic collection process for the Azure Virtual Machine service. |
| 5 | +--- |
| 6 | + |
| 7 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 8 | + |
| 9 | +<img src={useBaseUrl('img/integrations/microsoft-azure/azure-vm-icon.png')} alt="Thumbnail icon" width="50"/> |
| 10 | + |
| 11 | +[Azure Virtual Machine](https://learn.microsoft.com/en-us/azure/virtual-machines/) is a virtualized computing environment on Microsoft's cloud platform, that allows users to run applications and tasks on a dedicated, scalable, and on-demand basis. Azure Virtual Machine (VM) provides scalable computing capacity in the Azure Cloud. You can use Azure VM to launch as many or as few virtual servers as you need, configure security and networking, and manage storage. |
| 12 | + |
| 13 | +The Sumo Logic app for Azure VM allows you to collect your VM instance metrics and display them using predefined dashboards. The app provides dashboards to display analysis of VM instance metrics for CPU, disk, network, cache, and memory. Also, it provides detailed insights into all audit events associated with VM instances and specifically helps identify changes, errors, and user activities. |
| 14 | + |
| 15 | +## Log and metric types |
| 16 | + |
| 17 | +For Azure Virtual Machine, you can collect the following logs and metrics: |
| 18 | + |
| 19 | +* **Activity logs**. To learn more about the different Activity log category types and schemas collected for Azure Virtual Machine, refer to the [Azure documentation](https://learn.microsoft.com/en-us/azure/virtual-machines/monitor-vm-reference#activity-log). |
| 20 | +* **Virtual Machine Metrics**. These metrics are available in [Microsoft.Compute/virtualMachines, Microsoft.Compute/virtualmachineScaleSets](https://learn.microsoft.com/en-us/azure/virtual-machines/monitor-vm-reference#metrics) namespace. For more information on supported metrics and their units, refer to the [Azure documentation](https://learn.microsoft.com/en-us/azure/virtual-machines/monitor-vm-reference#supported-metrics-for-microsoftcomputevirtualmachines). |
| 21 | + |
| 22 | +## Setup |
| 23 | + |
| 24 | +Azure service sends monitoring data to Azure Monitor, which can then [stream data to Eventhub](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs). Sumo Logic supports: |
| 25 | + |
| 26 | +* Logs collection from [Azure Monitor](https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-get-started) using our [Azure Event Hubs source](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). |
| 27 | + |
| 28 | +You must explicitly enable diagnostic settings for each Virtual Machine you want to monitor. You can forward logs to the same event hub provided they satisfy the limitations and permissions as described [here](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destination-limitations). |
| 29 | + |
| 30 | +When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/VM/ActivityLogs`, `Azure/VM/Metrics`. |
| 31 | + |
| 32 | +### Configure field in field schema |
| 33 | + |
| 34 | +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. |
| 35 | +1. Search for the following fields: |
| 36 | + - `tenant_name`. This field is tagged at the collector level. You can get the tenant name using the instructions [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name). |
| 37 | + - `location`. The region to which the resource name belongs to. |
| 38 | + - `subscription_id`. ID associated with a subscription where the resource is present. |
| 39 | + - `resource_group`. The resource group name where the Azure resource is present. |
| 40 | + - `provider_name`. Azure resource provider name (for example, Microsoft.Network). |
| 41 | + - `resource_type`. Azure resource type (for example, storage accounts). |
| 42 | + - `resource_name`. The name of the resource (for example, storage account name). |
| 43 | + - `service_type`. Type of the service that can be accessed with a Azure resource. |
| 44 | + - `service_name`. Services that can be accessed with an Azure resource (for example, in Azure Container Instances service is Subscriptions). |
| 45 | +1. Create the fields if they are not present. Refer to [Manage fields](/docs/manage/fields/#manage-fields). |
| 46 | + |
| 47 | +### Configure metric rules |
| 48 | + |
| 49 | +* **Azure Observability Metadata Extraction VMName** |
| 50 | + |
| 51 | + In case this rule already exists, then no need to create it again. |
| 52 | + |
| 53 | +```sql |
| 54 | +Rule Name: AzureObservabilityMetadataExtractionVMName |
| 55 | +``` |
| 56 | + |
| 57 | +```sql title="Metric match expression" |
| 58 | +tenant_name=* namespace=Microsoft.Compute/virtualMachines resource_name=* |
| 59 | +``` |
| 60 | + |
| 61 | +| Fields extracted | Metric rule | |
| 62 | +|:--|:--| |
| 63 | +| `vmname` | `$resource_name._1` | |
| 64 | + |
| 65 | +### Configure metrics collection |
| 66 | + |
| 67 | +:::note |
| 68 | +The Sumo Logic metrics source for Azure is currently in Beta. To participate, contact your Sumo Logic account executive. |
| 69 | +::: |
| 70 | + |
| 71 | +1. To set up the Azure Metrics source in Sumo Logic, refer to the shared beta documentation. |
| 72 | +1. In the Sumo Logic Azure Metrics source configuration, configure namespaces as `Microsoft.Compute/virtualMachines` and `Microsoft.Compute/virtualMachineScaleSets`. |
| 73 | +<img src={useBaseUrl('img/integrations/microsoft-azure/azure-virtual-machine-namespaces.png')} alt="Azure Virtual Machine Namespaces" style={{border: '1px solid gray'}} width="500" /> |
| 74 | + |
| 75 | +### Configure logs collection |
| 76 | + |
| 77 | +In this section, you will configure a pipeline for shipping diagnostic logs from Azure Monitor to an Event Hub. |
| 78 | + |
| 79 | +#### Diagnostic logs |
| 80 | + |
| 81 | +1. To set up the Azure Event Hubs source in Sumo Logic, refer to the [Azure Event Hubs Source for Logs](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/). |
| 82 | +1. To create the Diagnostic settings in Azure portal, refer to the [Azure documentation](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#create-diagnostic-settings). Perform the steps below for each Azure Virtual Machine namespace that you want to monitor. |
| 83 | + 1. Choose `Stream to an event hub` as the destination. |
| 84 | + 1. Select `allLogs`. |
| 85 | + 1. Use the Event Hub namespace and Event Hub name configured in the previous step in the destination details section. You can use the default policy `RootManageSharedAccessKey` as the policy name.< br/><img src={useBaseUrl('img/send-data/azure-eventgrid-logs.png')} alt="Azure Event Grid logs" style={{border: '1px solid gray'}} width="800" /> |
| 86 | +1. Tag the location field in the source with the right location value. < br/><img src={useBaseUrl('img/integrations/microsoft-azure/Azure-Storage-Tag-Location.png')} alt="Azure Virtual Machine Tag Location" style={{border: '1px solid gray'}} width="400" /> |
| 87 | + |
| 88 | +#### Activity Logs |
| 89 | + |
| 90 | +To collect activity logs, refer to the [Collecting Logs for the Azure Audit App from Event Hub](/docs/integrations/microsoft-azure/audit) section in the Azure Audit documentation. Do not perform this step in case you are already collecting activity logs for a subscription. |
| 91 | + |
| 92 | +:::note |
| 93 | +Since this source contains logs from multiple regions, make sure that you do not tag this source with the location tag. |
| 94 | +::: |
| 95 | + |
| 96 | +## Installing the Azure Virtual Machine app |
| 97 | + |
| 98 | +import AppInstallNoDataSourceV2 from '../../reuse/apps/app-install-index-apps-v2.md'; |
| 99 | + |
| 100 | +<AppInstallNoDataSourceV2/> |
| 101 | + |
| 102 | +## Viewing the Azure Virtual Machine dashboards |
| 103 | + |
| 104 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 105 | + |
| 106 | +<ViewDashboards/> |
| 107 | + |
| 108 | +### Overview |
| 109 | + |
| 110 | +The **Azure Virtual Machine - Overview** dashboard allows you to gain insights into the performance of your VMs by monitoring and analyzing your VM's usage metrics such as VM availability, CPU usage, read/write ops, cache hits, VM usage, and average latencies. |
| 111 | + |
| 112 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Overview.png')} alt="Azure Key Vault - Overview dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 113 | + |
| 114 | +### OS/Disk |
| 115 | + |
| 116 | +The **Azure VM - OS/Disk** dashboard provides details on the operational activities and status of your Azure VM OS and Data disks. |
| 117 | + |
| 118 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+OS%3AData+Disk.png')} alt="Azure Key Vault - Operations Overview dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 119 | + |
| 120 | +### Network |
| 121 | + |
| 122 | +The **Azure VM - Network** dashboard provides detailed information about VM network activities based on incoming and outgoing packets and bytes. |
| 123 | + |
| 124 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Network.png')} alt="Azure Key Vault - Operations Detailed dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 125 | + |
| 126 | +### Disk |
| 127 | + |
| 128 | +The **Azure VM - Disk** dashboard provides details on the operational activities and status of your Azure VM disks and premium disks. |
| 129 | + |
| 130 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Disk.png')} alt="Azure Key Vault - Errors and Failures dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 131 | + |
| 132 | +### Administrative Operations |
| 133 | + |
| 134 | +The **Azure VM - Administrative Operations** dashboard provides details on the operational activities and status of your Azure Virtual Machine resources. |
| 135 | + |
| 136 | +Use this dashboard to: |
| 137 | +* Monitor the distribution of operation types and their success rates to ensure proper functioning of your Virtual Machine. |
| 138 | +* Identify potential issues by analyzing the top operations causing errors and correlating them with specific users or applications. |
| 139 | +* Track recent write and delete operations to maintain an audit trail of changes made to your Virtual Machine. |
| 140 | + |
| 141 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Administrative+Operations.png')} alt="Azure Key Vault - Administrative Operations dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 142 | + |
| 143 | +### Policy and Recommendations |
| 144 | + |
| 145 | +The **Azure Virtual Machine - Policy and Recommendations** dashboard provides details on policy events and recommendations for your Azure Virtual Machine resources. |
| 146 | + |
| 147 | +Use this dashboard to: |
| 148 | +* Monitor the success and failure rates of policy events to ensure proper configuration and compliance. |
| 149 | +* Track and analyse recent recommendations to improve the performance and security of your Vaults setup. |
| 150 | +* Identify trends in policy events and recommendations over time to proactively address potential issues. |
| 151 | + |
| 152 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Policy+and+Recommendations.png')} alt="Azure Key Vault - Policy and Recommendations dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 153 | + |
| 154 | +### CPU |
| 155 | + |
| 156 | +The **Azure VM - CPU** dashboard provides details on the CPU metrics and usage of your Azure VM CPU. |
| 157 | + |
| 158 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+CPU.png')} alt="Azure Key Vault - Vault Health dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 159 | + |
| 160 | +### Cache |
| 161 | + |
| 162 | +The **Azure VM - Cache** dashboard provides details on the status and usage of your Azure VM cache resources. |
| 163 | + |
| 164 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Cache.png')} alt="Azure Key Vault - Compliance dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 165 | + |
| 166 | +### Temp Disk |
| 167 | + |
| 168 | +The **Azure VM - Temp Disk** dashboard provides details on the operational activities and status of your Azure VM Temp Disk. |
| 169 | + |
| 170 | +<img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AzureVM/Azure+VM+-+Temp+Disk.png')} alt="Azure Key Vault - Compliance dashboard" style={{border: '1px solid gray'}} width="800" /> |
| 171 | + |
| 172 | +## Create monitors for Azure Virtual Machine app |
| 173 | + |
| 174 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 175 | + |
| 176 | +<CreateMonitors/> |
| 177 | + |
| 178 | +### Azure Virtual Machine alerts |
| 179 | +These alerts are metric based and will work for all Virtual Machine. |
| 180 | + |
| 181 | +| Alert Name | Description | Alert Condition | Recover Condition | |
| 182 | +|:--|:--|:--|:--| |
| 183 | +| `Azure Virtual Machine - Available Memory Monitor` | This alert is triggered when memory drop under 1GB are detected for any VM.| Count < 1 | Count >= 1 | |
| 184 | +| `Azure Virtual Machine - CPU Usage Percentage Monitor` | This alert is triggered when CPU usage spikes above 80% are detected for any VM. | Count >= 80 | Count < 80 | |
| 185 | +| `Azure Virtual Machine - Availability Monitor` | This alert is triggered when VM Availability drops under 100% are detected for any VM. | Count < 1 | Count = 1 | |
| 186 | +| `Azure Virtual Machine - Data Disk IOPs Consumed Monitor` | This alert is triggered when Data Disk IOPs consumption percentage spikes above 95% are detected for any VM. | Count > 95 | Count =< 95 | |
| 187 | +| `Azure Virtual Machine - OS Disk IOPs Consumed Monitor`| This alert is triggered when OS Disk IOPs consumption percentage spikes above 95% are detected for any VM. | Count > 95 | Count =< 95 | |
| 188 | + |
| 189 | +## Upgrade/Downgrade the Azure Virtual Network app (optional) |
| 190 | + |
| 191 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 192 | + |
| 193 | +<AppUpdate/> |
| 194 | + |
| 195 | +## Uninstalling the Azure Virtual Network app (optional) |
| 196 | + |
| 197 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
0 commit comments