Skip to content

Commit 16d44ab

Browse files
ankurch627ankurch627
committed
updated doc for ASE
1 parent 4ff2523 commit 16d44ab

File tree

1 file changed

+106
-0
lines changed

1 file changed

+106
-0
lines changed

‎docs/integrations/microsoft-azure/azure-app-service-environment.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ The below instructions applies to App Service Environment v3.
1616

1717
For Azure App Service Environment, you can collect the following logs:
1818

19+
- **Activity logs**, provides insight into any subscription-level or management group level events that have occurred in the Azure. To learn more, refer to [Azure documentation](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema).
20+
1921
* **App Service Environment Platform Logs**. Logs are only emitted when your App Service Environment has an event (for example, a scale operation with an App Service plan) that triggers the logs. To learn more about the different situations and messages collected for Azure App Service Environment, refer to the [Azure documentation](https://learn.microsoft.com/en-us/azure/app-service/environment/using#logging).
2022

2123
## Setup
@@ -28,8 +30,52 @@ You must explicitly enable diagnostic settings for each Azure App Service Enviro
2830

2931
When you configure the event hubs source or HTTP source, plan your source category to ease the querying process. A hierarchical approach allows you to make use of wildcards. For example: `Azure/AppServiceEnvironment/Logs`, `Azure/AppServiceEnvironment/Metrics`.
3032

33+
### Configure Field Extraction Rules
34+
35+
Create a Field Extraction Rule (FER) by following the instructions [here](/docs/manage/field-extractions/create-field-extraction-rule/). If the FER already exists with same name, then skip this step.
36+
37+
#### Azure Location Extraction FER
38+
39+
```sql
40+
Rule Name: AzureLocationExtractionFER
41+
Applied at: Ingest Time
42+
Scope (Specific Data): tenant_name=*
43+
```
44+
45+
```sql title="Parse Expression"
46+
json "location", "properties.resourceLocation", "properties.region" as location, resourceLocation, service_region nodrop
47+
| replace(toLowerCase(resourceLocation), " ", "") as resourceLocation
48+
| if (!isBlank(resourceLocation), resourceLocation, location) as location
49+
| if (!isBlank(service_region), service_region, location) as location
50+
| if (isBlank(location), "global", location) as location
51+
| fields location
52+
```
53+
54+
#### Resource ID Extraction FER
55+
56+
```sql
57+
Rule Name: AzureResourceIdExtractionFER
58+
Applied at: Ingest Time
59+
Scope (Specific Data): tenant_name=*
60+
```
61+
62+
```sql title="Parse Expression"
63+
json "resourceId", "ResourceId" as resourceId1, resourceId2 nodrop
64+
| if (isBlank(resourceId1), resourceId2, resourceId1) as resourceId
65+
| toUpperCase(resourceId) as resourceId
66+
| parse regex field=resourceId "/SUBSCRIPTIONS/(?<subscription_id>[^/]+)" nodrop
67+
| parse field=resourceId "/RESOURCEGROUPS/*/" as resource_group nodrop
68+
| parse regex field=resourceId "/PROVIDERS/(?<provider_name>[^/]+)" nodrop
69+
| parse regex field=resourceId "/PROVIDERS/[^/]+(?:/LOCATIONS/[^/]+)?/(?<resource_type>[^/]+)/(?<resource_name>.+)" nodrop
70+
| parse regex field=resource_name "(?<parent_resource_name>[^/]+)(?:/PROVIDERS/[^/]+)?/(?<service_type>[^/]+)/?(?<service_name>.+)" nodrop
71+
| if (isBlank(parent_resource_name), resource_name, parent_resource_name) as resource_name
72+
| fields subscription_id, location, provider_name, resource_group, resource_type, resource_name, service_type, service_name
73+
```
74+
3175
### Configure logs collection
3276

77+
#### Diagnostic logs
78+
3379
In this section, you will configure a pipeline for shipping diagnostic logs from Azure Monitor to an Event Hub.
3480

3581
1. To set up the Azure Event Hubs source in Sumo Logic, refer to [Azure Event Hubs Source for Logs](/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/).
@@ -38,3 +84,63 @@ In this section, you will configure a pipeline for shipping diagnostic logs from
3884
* Select `App Service Environment Platform Logs`.
3985
* Use the Event hub namespace and Event hub name configured in previous step in destination details section. You can use the default policy `RootManageSharedAccessKey` as the policy name.
4086

87+
#### Activity logs (optional)
88+
89+
To collect activity logs, follow the instructions [here](/docs/integrations/microsoft-azure/audit). If you are already collecting activity logs for a subscription, do not perform this step.
90+
91+
## Installing the Azure App Service Environment app
92+
93+
This section provides instructions on how to install the Azure App Service Environment app, and shows examples of each of the preconfigured dashboards you can use to analyze your data.
94+
95+
import AppInstall2 from '../../reuse/apps/app-install-v2.md';
96+
97+
<AppInstall2/>
98+
99+
## Viewing Azure App Service Environment dashboards
100+
101+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
102+
103+
<ViewDashboards/>
104+
105+
### Overview
106+
107+
The **Azure AppService - Overview** dashboard provides comprehensive information of all the service health incidents or resource health events associated with Azure AppService in your azure account.
108+
109+
Use this dashboard to:
110+
* View recent resource and service health incidents.
111+
* View distribution of service and resource health by incident type.
112+
113+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Azure-AppServiceEnvironment/Azure-App-Service-Plan-Overview.png')} alt="Azure AppServiceEnvironment Overview dashboard" style={{border: '1px solid gray'}} width="800" />
114+
115+
### Operations
116+
117+
The **Azure AppService - Operations** dashboard offers comprehensive insights into the scaling, upgrade events for your Azure AppServiceEnvironment.
118+
119+
Use this dashboard to:
120+
* Analyze scaling and upgrade events for your App Service Environment
121+
* Identify potential operations issues affecting your webapps.
122+
123+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Azure-AppService/Azure-App-Service-Environment-Operations.png')} alt="Azure AppServiceEnvironment Network dashboard" style={{border: '1px solid gray'}} width="800" />
124+
125+
### Administrative Operations
126+
127+
The **Azure AppService - Administrative Operations** dashboard provides details on read/write/delete specific changes, different operations used, top 10 operations that caused most errors, and users performing admin operations.
128+
129+
Use this dashboard to:
130+
* Identify top users performing administrative operations.
131+
* View Top 10 operations that caused the most errors.
132+
* View recent read, write, and delete operations.
133+
134+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Azure-AppService/Azure-App-Service-Environment-Administrative-Operations.png')} alt="Azure AppServiceEnvironment Administrative Operations dashboard" style={{border: '1px solid gray'}} width="800" />
135+
136+
## Upgrading the Azure App Service Environment app (Optional)
137+
138+
import AppUpdate from '../../reuse/apps/app-update.md';
139+
140+
<AppUpdate/>
141+
142+
## Uninstalling the Azure App Service Environment app (Optional)
143+
144+
import AppUninstall from '../../reuse/apps/app-uninstall.md';
145+
146+
<AppUninstall/>

0 commit comments

Comments
 (0)