As Azure services are growing day by day, it is becoming more important to monitor them in a fully automated way. When it comes to monitoring Azure virtual machines (VMs), it is useful to use Log Analytics, also known as OMS (Operations Management Suite). Its wide range of solutions can monitor various services in Azure.

Baki Onur Okutucu

Onur is a subject matter expert for Office 365, Azure, and PowerShell technologies. He is the founder of Clouderz Ltd, a cloud consultancy based in London. For ten years in a row, Microsoft has recognized him as a Most Valuable Professional. You can follow Onur on Twitter: @BakiOnur.

Log Analytics lets us monitor many infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) offerings in Azure. It also allows us to respond to events using Azure Monitor alerts. With OMS dashboards, we can control events, visualize log searches, and share custom logs with others.

To start monitoring Azure VMs, you need to install Microsoft Monitoring Agent (MMA) provided by OMS on VMs through a VM extension. Although you can perform a manual installation at the operating system level using agent setup files available in Azure Portal, it is much easier to install the extensions on VMs through Azure Portal or using PowerShell. Once the extension installs the OMS agent on a VM, it registers the VM to an existing OMS workspace, and the VM is ready to report to OMS.

Later in this article, we will walk through the steps of installing extensions on multiple VMs and will start monitoring them using PowerShell.

The OMS service is available in the following Azure regions:

East USWest EuropeJapan East
West Central USSoutheast AsiaAustralia Southeast
Central IndiaCanada CentralUK South

Create a new OMS workspace ^

To start monitoring a Windows VM through OMS, we first need to create an OMS workspace. We can use the commands below to do this:

Creating a new Log Analytics (OMS) workspace

Creating a new Log Analytics (OMS) workspace

Each Azure workspace has a workspace ID and a pair of workspace keys we will need later when we install extensions on VMs and enroll them to this workspace. We can get these details in advance using the code below:

Getting the workspace ID and workspace keys

Getting the workspace ID and workspace keys

Installing intelligence packs (solutions) ^

Solutions in OMS have different capabilities. Each solution aims to monitor specific services in Azure. OMS has several solutions not installed by default. Therefore, you need to install the solutions based on an organization's requirements separately.

To list all available intelligence packs in OMS, use the following cmdlet:

Listing all available intelligence packs (solutions) in OMS

Listing all available intelligence packs (solutions) in OMS

To install a specific intelligence pack on an existing OMS workspace, use the cmdlet below. In this example, we are enabling the Update Management Solution.

Enabling an intelligence pack in OMS

Enabling an intelligence pack in OMS

Installing VM extensions ^

Now it is time to install OMS monitoring extensions on VMs using the workspace ID and the workspace key we noted earlier.

With the script below, we can install the OMS extension on all VMs in a resource group. You can modify the script to satisfy your needs.

Installing OMS extensions on VMs

Installing OMS extensions on VMs

Collecting logs from VMs ^

Once we've installed the extensions to the VMs, they are ready to send requested reports to OMS. To set a VM to send certain logs to OMS, we need to create a new event data source specifying Event Log details such as System, Application, Security, and so on.

System Event Logs

To collect System Event Logs from a VM, we can use the following command:

Creating a new data source to collect system logs from a VM

Creating a new data source to collect system logs from a VM

Performance counters

To collect performance counters such as memory or disk details from a VM, we can use the following command:

Creating a new data source to collect performance counter logs from a VM

Creating a new data source to collect performance counter logs from a VM

 

Queries ^

After enabling data sources on VMs, they can then start sending all requested details to OMS on a regular basis. This means we can now easily create custom queries to get specific data that OMS processes and filters.

In the first example, we will get the first 10 results for system events from all VMs. In the second example, we will get the first 10 results for memory performance counters from all VMs.

Example 1

Collecting VM system events from OMS

Collecting VM system events from OMS

Example 2

Collecting VM performance counters from OMS

Collecting VM performance counters from OMS

Conclusion ^

OMS is a very useful end-to-end monitoring solution in Azure with a rich solution portfolio. You can monitor Azure services while having the ability to trigger dynamic actions based on alerts, create dashboards for an advanced visual view, and manage all of these using PowerShell.

Are you an IT pro? Apply for membership!

Your question was not answered? Ask in the forum!

3+
Share
3 Comments
  1. Gaurav Awasthi 1 year ago

    I am trying to find a way to modify /disable/enable any log analytics alert using powershell .Is there a way to do it ?

    0

  2. Author
    Baki Onur Okutucu 11 months ago

    Hi Gaurav,

    You can indirectly use powershell along with Alert API to manage Alerts in Azure.

    Have you checked the following?

    https://docs.microsoft.com/en-us/azure/azure-monitor/platform/api-alerts

    You can use armclient (https://github.com/projectkudu/ARMClient) or Powershell with the API to manage the alerts.

    thanks

    Onur

     

    0

  3. dev reddy 2 weeks ago

    Hi Gaurav,

    1+

    Users who have LIKED this comment:

    • avatar

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2019

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account