Push Win VM Security log events to Az Monitor - azure-monitoring

Is there any guidance available specifically for capturing Windows event logs from Az VMs in Az Monitor? I’d like to capture successful login events from the Security log across 30 VMs in Az Monitor. So far I’ve enabled each VM in it’s diagnostic settings blade, but I’m less clear on how to find and filter the data in Azure Monitor.
Thanks
Mark

Related

Setting up basic logging

In azure log analytics we are reading windows logs from an onpremise server. We would like to setup some basic metricks, like disk, CPU, RAM etc to make sure it is running. However we have like thousands to choose from in Azure. Can someone recommend some basic performance counters to monitor, or link to some documentation?
Setting up basic logging
I have created a Log Analytics Workspace and tried to add the Windows Performance Counters.
Navigate to
Your Log Analytics Workspace => Agents Configuration => Click on Add recommended counters and click on Apply , all the required basic counters will be added by default.
We can add the performance counter one by one , based on your requirement
Please refer Configure Basic Logs in Azure Monitor and Configuring Performance counters for more information

Azure IoT Edge: How to monitor the edge module (install) state for all devices on IoT hub

Is it possible to read events from IoT hubs in a way that we receive all status changes for IoT edge module installs? Possibly by receiving state changes to the edge agent reported properties of all connected devices?
Background: We are allowing users to "install" applications (represented by edge modules) on their edge devices on the fly through our own portal. We want to monitor changes to IoT devices and their modules, and note the changes in our database, so we can flag the corresponding apps as installed, removed, or failed.
Right now I can only find Event Grid based events for Device connected / disconnected events. I can also see that I can manually query the desired properties of each edge device's edge Agent separately. But since we will a large number of edge devices connected (>5000), polling them all just to see if something changed is not feasible.
Are the edge agent status changes of all IoT edge devices available as an event stream somewhere? Or is there a better solution?
IoT Edge's integration with Azure Monitor may help (docs). It has a module view that shows which modules are running and their availability. Since all the data is available in Log Analytics, you can create custom visualizations and processes using the data.
The Module twins in Azure IoT Hub shall help in below based on the information stored with it.
Monitoring the connectivity of the system
Monitoring the health of IoT Edge deployments
The Azure IoT Edge runtime has "IoT Edge Agent" as one of two modules that performs installation / initiation of modules and updating / reporting of the status of the modules to the IoT Hub. The $edgeAgent maintains the health and connectivity data about both the IoT Edge agent and IoT Edge hub runtime modules.
The Azure IoT Edge hub runtime maintains the data about communications between the "IoT Edge hub" running on the device and that of Azure IoT hub via the $edgeHub.
High level Overview :
Here is "Azure Monitor workbooks for IoT" that provides views couple of views :
An overview / state of active devices can be seen in the "Devices" View
Alerts display as per rules configured for the devices in "Alerts" View
Azure Monitor workbooks can be tuned for seeing data at any level (device state, app status) of interest. The public templates can be modified to meet the need/requirement in hand. The data shall fetched based on resource-centric KQL queries on the InsightsMetrics table.
Screenshot of Devices View :
Screenshot of Alerts View:
References :
Monitor Module Twins
Monitor Workbooks

How to integrate and start Datadog monitoring for Windows Apache web servers?

I need to integrate Datadog monitoring on Apache web servers which are on Windows servers. Is there a link/blog available detailing the same for Windows server specifically ? I got a blog link from Datadog but it seems not to cover Windows servers. Need it specifically for Windows servers.
Window option available... Go to integration and click on agents.. There is an option available windows ( left side ).. Click on windows then u get link..... Just copy the link and paste it on ur windows Server.... Then datadog starts monitoring... It takes 5 minutes to monitor

Web UI to manage computer machines in the network

I'm looking for a platform with Web UI access that allows me to do the following:
Maintain a list of computers and add / remove based on their IP address.
Provide the SSH information for each computer machine.
Monitor if the machines are up ( ping ? )
Restart the machines with a web UI using the ssh information on the backend of the application.
I'm close to start making such an app myself since I can't seem to find anything close to that in the internet. Any clues if such an application exists ?
You might want to take a look at MeshCentral: https://meshcentral.com/ - you can add systems that you are managing and do some remote operations.
http://info.meshcentral.com/: Meshcentral is open source and is both a peer-to-peer technology with a wide array of uses and web service that is targeted for remote monitoring and management of computers and devices. Users can manage all their devices from a single web site, no matter the location of the computers or if they are behind routers or proxies.
If you are looking for source code you could take a look at the "Open Manageabilty Developer's Toolkit" http://opentools.homeip.net/open-manageability. This tool was built for managing systems with Intel Active Management Technology, but it does a lot of what you are looking for. You can download the source and see if you can use any of it if you decide to write your own UI.

What's the best way to monitor rabbitmq to make sure everything is running smoothly?

Many times, I get:
-Frozen, load goes to 5.0. Can't use my box.
-Just doesn't work.
Do following steps:
1.rabbitmq-plugins enable rabbitmq_management
2.service rabbitmq-server restart
3.browse to http://rabbitmq-server-ip:15672
4.login with
username: guest
password: guest
Dont forget to change your password later.
As sheki notes, rabbitmqctl is your first port of call for diagnostics, and for building monitoring on top of, but it's not suitable for actual monitoring directly being a manual command line.
I've found DataDog very good to monitor both the MQ details, plus the host platform in parallel. e.g. you can watch the queue levels and set alerts on queues backing-up, while also watching the CPU/memory/IO inflicted by these queue levels. It really helps to get ratios of resource usage, and the alerts are good. Having a uniform platform for both infrastructure and application level monitoring is surprisingly rare, but speeds up diagnoses of production issues hugely.
NewRelic is similar and also has a RabbitMQ plugin, although I've not used this plugin specifically, I've used NR for years and found it invaluable in diagnosing operational issues.
AppDynamics is another example. Similarly this allows you to drill down into your app from a high-level dashboard, and visually navigate from problems to causes. It's especially good with visualising the network of a distributed application across various services/servers. I've used this, for example, to find complex problems in .NET applications and SQL Server clusters using 3rd party Web Services (e.g. latency and its consequences to your app over chatty protocols). These things are very difficult to diagnose, especially for developers who are limited to checking their code. Diagnosing operational issues requires a much broader picture.
I gave up trying to even install and configure Nagios. I know it's the 'best' but it's the best of an old breed of self-configured beasts which we don't have time to manage. I didn't even get it going... and eventually turned to the more 'modern' cloud approach. Once you get over the trust factor, it's pretty liberating.
I'm using these APM platforms together* to aggregate data from:
Windows O/S level Event Logs/Services
Linux O/S level
AWS console level
RDS, EC2
Apache
MySQL
App integrations / custom NR plugins I've written
Rabbit MQ
*NewRelic can feed into Datadog! So if you are already using NR you don't need to install DD on those hosts as well.
Being able to view all these levels together gives you a view on the publishers, middleware, MQ servers, workers and front-end app - all in one dashboard.
I would highly recommend an approach like this, because just looking at one server alone leads you to a lot of head-scratching. Seeing an entire stack in one customisable dashboard is just so illuminating it takes most of the guesswork out of it.
Worried about installing these things? I found New Relic to be especially light-weight and unobtrusive. AppDynamics seemed to stress the host a bit more, but mostly that's because you had to run the visualisation tools on the host! (this may have changed). DataDog seems performant, but creates a lot of control panels/icons on the target host (perhaps just a visual impression).
To a four year old question - this answer probably wasn't available in 2011, but in 2015 these once 'startup' style APM services are just tens or hundred dollars a month for an unbelievably rich enterprise-level solution.
There are bunch of RabbitMQ monitoring plugins available for different monitoring systems like Nagios, Zabbix etc.
Look at http://www.rabbitmq.com/how.html#management
Using rabbitmqctl is the most straight forward solution to check the status of the node.
$ rabbitmqctl status
This should tell you the status of the RabbitMQ node.
If you have PRTG (or any probe system with a HTTP sensor check), you can check the server status described at the following page:
https://blog.cdemi.io/monitoring-rabbitmq-in-prtg/
In particular you have to
Enable Management Plugin
The rabbitmq-management plugin provides an HTTP-based API for management and monitoring of your RabbitMQ
server, along with a browser-based UI and a command line tool,
rabbitmqadmin. The management plugin is included in the RabbitMQ
distribution. To enable it, we need to run: rabbitmq-plugins enable
rabbitmq_management on the RabbitMQ nodes. For more details on the
Management plugin refer to RabbitMQ Documentation.
The web UI is located at: http://server-name:15672/ The HTTP API and
its documentation are both located at: http://server-name:15672/api/
Once done, you can check the overview of your server with the API:
http://server-name:15672/api/overview
Where you have a JSON with all details about the server, active connections, queues, etc.
This cmd will help you service rabbitmq-server status
OR try theseservice rabbitmq-server stop and service rabbitmq-server start then service rabbitmq-server status.