Azure Monitor Alert based on Custom Metric - azure-monitoring

I've created a custom metric to monitor free disk C: space on my Azure VM.
But when i'n trying to create an alert rule (not classic), i can't find my custom metrics in the options list. i'm thinking that this is due to the fact that i'm using the new Rule alrts insted of the Classic Rules.
Has someone succeeded to create a new alert rule based on a custom metric?
Using a query can give me the output, but i don't know from where this info are coming (VM extension ? Diagnostic Log?):
Perf
| where TimeGenerated >ago(1d)
| where CounterName == "% Free Space" and ObjectName == "LogicalDisk" and InstanceName == "C:" and CounterValue > 90
| sort by TimeGenerated desc

Related

how to check if splunk has received the logs from 100 different hosts

I am new to splunk. Wanted to create a splunk alert to check if logs has been received from all the host or not and if not need to set a alert trigger.
| tstats latest(_time) as latest where index=* earliest=-24h by host
| eval recent = if(latest > relative_time(now(),"-5m"),1,0), realLatest = strftime(latest,"%c")
| where recent=0
is the above splunk Query correct?
The query looks good, but the best way to know is to try it. Does it produce the desired results?

Kusto memory status for an operation id

I executed the following control command
.set-or-append async XXXX<|fillXXXX()
This returned me an operation id
Now I want to check how much CPU/MEMORY usage (Query stats) happened for this operation id.
How can we do that?
When you run the command, you also get the ClientRequestId, and that's what you should use to get the resources used to run the command, :
.show commands
| where StartedOn > ago(1d)
| where ClientActivityId == "KE.RunCommand;9763ec24-910c-4e86-a823-339db440216e"
| where CommandType == "TableSetOrAppend"
| project ResourcesUtilization

Is it possible to create log source health alerts in Azure Sentinel?

I am attempting to create an alert that lets me know if a data source stops providing logs to Sentinel. While I know it displays anomalies in log data on the dash board, I am hoping to receive alerts if a source stops providing logs for an extended period of time.
Something like creating a rule with the following query (CEF in this case):
CommonSecurityLog
| where TimeGenerated > ago(24h)
| summarize count() by DeviceVendor, DeviceProduct, DeviceName, DeviceExternalID
| where count_ == 0

MQL4 How To Detect Status During Change of Account (Completed Downloading of Historical Trades)

In MT4, there exists a stage/state: when we switch from AccountA to AccountB, when Connection is established and init() and start() are triggered by MT4; but before the "blinnnggg" (sound) when all the historical/outstanding trades are loaded from Server.
Switch Account>Establish Connection>Trigger Init()/Start() events>Start Downloading of Outstanding/Historical trades>Completed Downloading (issue "bliinng" sound).
I need to know (in MQL4) that all the trades are completed downloaded from the tradeServer --to know that the account is truly empty -vs- still downloading history from tradeServer.
Any pointer will be appreciated. I've explored IsTradeAllowed() IsContextBusy() and IsConnected(). All these are in "normal" state and the init() and start() events are all fired ok. But I cannot figure out if the history/outstanding trade lists has completed downloading.
UPDATE: The final workaround I finally implemented was to use the OrdersHistoryTotal(). Apparently this number will be ZERO (0) during downloading of order history. And it will NEVER be zero (due to initial deposit). So, I ended-up using this as a "flag".
Observation
As the problem was posted, there seems no such "integrated" method for MT4-Terminal.
IsTradeAllowed() reflects an administrative state of the account/access to the execution of the Trading Services { IsTradeAllowed | !IsTradeAllowed }
IsConnected() reflects a technical state of the visibility / login credentials / connection used upon an attempt to setup/maintain an online connection between a localhost <-> Server { IsConnected() | !IsConnected() }
init() {...} is a one-stop setup facility, that is/was being called once an MT4-programme { ExpertAdvisor | Script | TechnicalIndicator } was launched on a localhost machine. This facility is strongly advised to be non-blocking and non-re-entrant. A change from the user account_A to another user account_B is typically ( via an MT4-configuration options ) a reason to stop an execution of a previously loaded MQL4-code ( be it an EA / a Script / a Technical Indicator ) )
start() {...} is an event-handler facility, that endlessly waits, for a next occurrence of an FX-Market Event appearance ( being propagated down the line by the Broker MT4-Server automation ) that is being announced via an established connection downwards, to the MT4-Terminal process, being run on a localhost machine.
A Workaround Solution
As understood, the problem may be detected and handled indirectly.
While the MT4 platform seems to have no direct method to distinguish between the complete / in-complete refresh of the list of { current | historical } trades, let me propose a method of an indirect detection thereof.
Try to launch a "signal"-trade ( a pending order, placed geometrically well far away, in the PriceDOMAIN, from the current Ask/Bid-levels ).
Once this trade would be end-to-end registered ( Server-side acknowledged ), the local-side would have confirmed the valid state of the db.POOL
Making this a request/response pattern between localhost/MT4-Server processes, the localhost int init(){...} / int start(){...} functionality may thus reflect a moment, when the both sides have synchronised state of the records in db.POOL

Embedded - DM3730 processor

I am referring the TRM of DM3730 and modifying the pad configurations on an EVM 3530 accordingly. I couldn't understand the following properly.
1) What are CORE power domain and WKUP power domain?
2) What is core control module and Wake-Up control module?
3) The above two questions may be completely hardware-oriented. But the reason I'm asking is, in EVM 3530 source code, in pad configurations, certain pins are defined as PAD_ENTRY and certain others as WKUP_PAD_ENTRY. What makes the difference?
#define PAD_ENTRY(x,y) {PAD_ID(x),y,0},
#define WKUP_PAD_ENTRY(x,y) {WKUP_PAD_ID(x),y,0},
#define I2C3_PADS \
PAD_ENTRY(I2C3_SCL, INPUT_ENABLED | PULL_RESISTOR_DISABLED | MUXMODE(0)) \
PAD_ENTRY(I2C3_SDA, INPUT_ENABLED | PULL_RESISTOR_DISABLED | MUXMODE(0))
#define I2C4_PADS \
WKUP_PAD_ENTRY(I2C4_SCL, INPUT_ENABLED | PULL_RESISTOR_DISABLED | MUXMODE(0)) \
WKUP_PAD_ENTRY(I2C4_SDA, INPUT_ENABLED | PULL_RESISTOR_DISABLED | MUXMODE(0))
Any kind of guidance is welcome.
WKUP provides functions for sections of the OMAP SoC to come out of power-saving mode.
A power domain can be turned on/off without affecting others (4.1.3.2). WKUP power domain is continously active, it allows for switching others. CORE power domain comprises interconnect / memory / peripheral core functions.
Wake-up control module and core control module provide for save and restore of pad configurations (7.3) when switched off.
It looks like the pads which can be configured as I2C4 SCL/SDA can also be configured with wakeup capabilities. Then in your code base (Windows CE 6 BSP?) a different macro from generic PAD_ENTRY is appropriate, probably there is an error check of (x) to confirm pad ID is valid. The non-wakeup-related macro parameters should work the same for you, there won't be a difference.
Section references are to OMAP35x-TRM.