Skip to content

Add Bicep example for VM watch plus small alignment in Markdown #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add Bicep example for VM watch plus small alignment in Markdown #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b7fad30
Add Bicep example for VM watch plus small alignment in Markdown
Gijsreyn Mar 11, 2025
603e061
Update tab group
Gijsreyn Mar 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions articles/virtual-machines/configure-eventhub-vm-watch.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ VM watch can send signal data to a preconfigured [Event Hub](/azure/event-hubs/e
This article provides instructions on configuring Event Hubs to access signals collected by VM watch

### Prerequisites

This article assumes that you're familiar with:
- [Azure Event Hubs](/azure/event-hubs/event-hubs-about)
- [VM watch checks, metrics, and logs](/azure/virtual-machines/azure-vm-watch)
Expand All @@ -23,6 +24,7 @@ This article assumes that you're familiar with:
### Enable Event Hubs Output

#### 1: Prepare Event Hubs for VM watch

- [Deploy an Event Hub](/azure/event-hubs/event-hubs-create)
- [Authorize access to the Azure Event Hub](/azure/event-hubs/authorize-access-event-hubs)
> [!IMPORTANT]
Expand Down Expand Up @@ -50,14 +52,15 @@ For all authentication methods, the following parameter set applies:
##### Authentication specific parameters for Event Hubs output

#### [Managed Identity](#tab/managedidentity-1)

|**Parameter**|**Is required**|**Description**|
| -------- | -------- | -------- |
|`EVENT_HUB_OUTPUT_USE_MANAGED_IDENTITY`|No|Set this value to "true." Default is "false"|
|`EVENT_HUB_OUTPUT_MANAGED_IDENTITY_CLIENT_ID`|No|If you're using a specific managed identity to authenticate, specify this value|

For example, the following VM watch JSON configuration sets the environment variables `EVENT_HUB_OUTPUT_NAMESPACE`, `EVENT_HUB_OUTPUT_NAME`, and `EVENT_HUB_OUTPUT_USE_MANAGED_IDENTITY`. This allows Event Hubs to use managed identity as the authentication method without needing to specify a managed identity client ID.

```
```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -70,14 +73,18 @@ For example, the following VM watch JSON configuration sets the environment vari
}
```

> [!NOTE]
> When using managed identity, ensure it has the necessary permissions to send messages to the Event Hub.

#### [SAS Token](#tab/sastoken-1)

|**Parameter**|**Is required**|**Description**|
| -------- | -------- | -------- |
|`EVENT_HUB_OUTPUT_SAS_TOKEN_BASE64`|No|If using SAS token to authenticate, specify this value|

For example, the following VM watch JSON configuration enables Event Hubs as an output by using a SAS token for authentication.

```
```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -91,13 +98,14 @@ For example, the following VM watch JSON configuration enables Event Hubs as an
```

#### [Connection String](#tab/connectionstring-1)

|**Parameter**|**Is required**|**Description**|
| -------- | -------- | -------- |
|`EVENT_HUB_OUTPUT_CONNECTION_STRING_BASE64`|No|If using connection string token to authenticate, encode it with base64. The connection string should follow the following format: `Endpoint=sb://<NamespaceName>.<DomainName>/;SharedAccessKeyName=<KeyName>;SharedAccessKey=<KeyValue>`. This should **not** include the entity path `;EntityPath=<EventHubName>` in the connection string.|

For example, the following VM watch JSON configuration enables Event Hubs as an output by using a connection string for authentication

```
```json
{
"vmWatchSettings": {
"enabled": true,
Expand Down Expand Up @@ -153,10 +161,13 @@ Each Event Hub event has the following schema:
If there are no events in Event Hubs after several minutes, check the VM watch logs in the following directories on the virtual machine or virtual machine scale set to diagnose the issue:

#### [Linux](#tab/linux-1)

```
/var/log/azure/Microsoft.ManagedServices.ApplicationHealthLinux/vmwatch.log
```

#### [Windows](#tab/windows-1)

```
C:/WindowsAzure/Logs/Plugins/Microsoft.ManagedServices.ApplicationHealthWindows/vmwatch.log
```
Expand Down
116 changes: 92 additions & 24 deletions articles/virtual-machines/configure-vm-watch.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,11 @@ This article assumes that you're familiar with:
> The code segment is identical for both Windows and Linux except for the value of the parameter `<application health extension type>` passed into the Extension Type. Replace `<application health extension type>` with `ApplicationHealthLinux` for Linux and `ApplicationHealthWindows` for Windows installations.

#### [ARM Template](#tab/ARM-template-1)

1. Navigate to the Overview page on [Azure portal](https://portal.azure.com/) and click on the JSON view for the VM to find the code segment below.
2. Copy the code segment to an IDE such as Visual Studio Code and make customizations as needed

```
```json
{
"settings": {
"vmWatchSettings": {
Expand All @@ -40,62 +41,85 @@ This article assumes that you're familiar with:
```

#### [CLI](#tab/cli-1)
```

```bash
az vm extension show -g <your resource group name> --vm-name <your vm name> -n <application health extension type>
```

#### [PowerShell](#tab/powershell-1)
```

```powershell
Get-AzVMExtension -ResourceGroupName "<your resource group name>" -VMName "<your vm name>" -Name "<application health extension type>"
```

---

### Customize VM watch configurations
VM watch signals can be customized by configuring the `vmWatchSettings` properties to meet specific requirements. The following table lists the properties for `vmWatchSettings`.

#### vmWatchSettings Properties
| **Name** | **Type** | **Description** | **Is Required**
|---|---|---|---|
| **enabled** | `bool` | This allows you to enable or disable VM watch | true
| **signalFilters** | `object` | This filters the enabled / disabled signals, either by tag or collector name. | false
| **parameterOverrides** | `object` | This specifies the parameters that can be overwritten for each signal execution. The full list of overwritable parameters can be found in the [VM watch Collectors Suite](/azure/virtual-machines/vm-watch-collector-suite) page. | false
| **environmentAttributes** | `object` | This specifies any environment attributes that help decide if a test is eligible to execute or not. | false

| **Name** | **Type** | **Description** | **Is Required** |
| ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
| **enabled** | `bool` | This allows you to enable or disable VM watch | true |
| **signalFilters** | `object` | This filters the enabled / disabled signals, either by tag or collector name. | false |
| **parameterOverrides** | `object` | This specifies the parameters that can be overwritten for each signal execution. The full list of overwritable parameters can be found in the [VM watch Collectors Suite](/azure/virtual-machines/vm-watch-collector-suite) page. | false |
| **environmentAttributes** | `object` | This specifies any environment attributes that help decide if a test is eligible to execute or not. | false |

> [!IMPORTANT]
> For the full list of collectors, associated signals, tags, overwritable parameters, and environment attributes, visit [VM watch Collectors Suite](/azure/virtual-machines/vm-watch-collector-suite) page
>


#### Switch on/off VM watch

VM watch can be switched on / off by configuring the `enabled` property, as shown in the code segment.

```
#### [ARM Template](#tab/ARM-template-2)

```json
{
"vmWatchSettings": {
"enabled": true
}
}
```

#### [CLI](#tab/cli-2)

```bash
az vm extension set -g <your resource group name> --vm-name <your vm name> -n <your extension name> --settings '{"vmWatchSettings":{"enabled":true}}'
```

#### [PowerShell](#tab/powershell-2)

```powershell
Set-AzVMExtension -ResourceGroupName '<your resource group name>' -VMName 'your vm name' -Settings @{ vmWatchSettings = @{enabled = $true}}
```


> [!NOTE]
>
> | **Name** | **Description** |
> |---|---|
> | **true** | This setting enables VM watch |
> | **false** | This setting disables VM watch |
>


#### Enable/Disable signal execution

By default, only the core group signals are enabled. However, the `signalFilters` property can be used to control and configure the signals to be executed. This property includes the following subfields.

| **Subfields** | **Description** |
|---|------|
| **enabledTags** | This enables the signals in the optional group specified with tags provided by the user |
| **disabledTags** | This disables the signals in the core and optional groups specified with tags provided by the user |
| **enabledOptionalSignals** | This enables signals specified in optional group. Provide collector name(s) as parameter |
| **disabledSignals** | This disables the signals specified in the core and optional groups. Provide collector name(s) as parameter |
| **Subfields** | **Description** |
| -------------------------- | ----------------------------------------------------------------------------------------------------------- |
| **enabledTags** | This enables the signals in the optional group specified with tags provided by the user |
| **disabledTags** | This disables the signals in the core and optional groups specified with tags provided by the user |
| **enabledOptionalSignals** | This enables signals specified in optional group. Provide collector name(s) as parameter |
| **disabledSignals** | This disables the signals specified in the core and optional groups. Provide collector name(s) as parameter |


For instance, to enable signals in the optional group containing `Network` tag and disable signals containing `Disk` tag, specify such tags under the `enabledTags` and `disabledTags` as shown:
```

```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -113,7 +137,7 @@ For instance, to enable signals in the optional group containing `Network` tag a

Similarly, to enable an optional group signal with name `hardware_health_monitor`, and disable signals with name `process` and `dns`, specify such names under the `enabledOptionalSignals` and `disabledSignals` as shown:

```
```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -134,7 +158,10 @@ Similarly, to enable an optional group signal with name `hardware_health_monitor

The signal execution frequency can be customized by adjusting the `parameterOverrides` property.
For instance, to set the `outbound_connectivity` test execution frequency to 120 seconds, specify the following configuration:
```

#### [ARM Template](#tab/ARM-template-3)

```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -144,12 +171,27 @@ For instance, to set the `outbound_connectivity` test execution frequency to 120
}
}
```

#### [CLI](#tab/cli-3)

```bash
az vm extension set -g <your resource group name> --vm-name <your vm name> -n <your extension name> --settings '{"vmWatchSettings":{"enabled":true,"parameterOverrides":{"OUTBOUND_CONNECTIVITY_INTERVAL":"120s"}}}'
```

#### [PowerShell](#tab/powershell-3)

```powershell
Set-AzVMExtension -ResourceGroupName '<your resource group name>' -VMName 'your vm name' -Settings @{vmWatchSettings = @{enabled = $true; parameterOverrides = @{OUTBOUND_CONNECTIVITY_INTERVAL = '120s'}}}
```


#### Override default signal execution parameters

Signal execution parameters can be overwritten by setting the `parameterOverrides` property. For instance, to set `disk_io` signal mount point to `/mnt`, the following configuration can be specified:
```

#### [ARM Template](#tab/ARM-template-4)

```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -158,14 +200,28 @@ Signal execution parameters can be overwritten by setting the `parameterOverride
}
}
}

```

#### [CLI](#tab/cli-4)

```bash
az vm extension set -g <your resource group name> --vm-name <your vm name> -n <your extension name> --settings '{"vmWatchSettings":{"enabled":true,"parameterOverrides":{"DISK_IO_MOUNT_POINTS":"/mnt"}}}'
```

#### [PowerShell](#tab/powershell-4)

```powershell
Set-AzVMExtension -ResourceGroupName '<your resource group name>' -VMName 'your vm name' -Settings @{vmWatchSettings = @{enabled = $true; parameterOverrides = @{DISK_IO_MOUNT_POINTS = '/mnt'}}}
```

#### Environment attribute enrichments

In addition to tags, VM watch also checks the eligibility of the signals before execution. The `environmentAttributes` can be specified to help VM watch determine the eligibility of each signal for execution.
For instance, if outbound traffic has been disabled on a VM, this information can be provided to VM watch. This ensures that any outbound network-related signal execution will be marked as ineligible.
```

#### [ARM Template](#tab/ARM-template-5)

```json
{
"vmWatchSettings": {
"enabled": true,
Expand All @@ -176,6 +232,18 @@ For instance, if outbound traffic has been disabled on a VM, this information ca
}
```

#### [CLI](#tab/cli-5)

```bash
az vm extension set -g <your resource group name> --vm-name <your vm name> -n <your extension name> --settings '{"vmWatchSettings":{"enabled":true,"environmentAttributes":{"OutboundConnectivityDisabled":true}}}'
```

#### [PowerShell](#tab/powershell-5)

```powershell
Set-AzVMExtension -ResourceGroupName '<your resource group name>' -VMName 'your vm name' -Settings @{vmWatchSettings = @{enabled = $true; environmentAttributes = @{OutboundConnectivityDisabled = $true}}}
```

### Next steps

- [VM watch Collectors Suite](/azure/virtual-machines/vm-watch-collector-suite)
Expand Down
Loading