Create a new monitor dashboard

Copper Contributor

Hi

I'm new to Azure and am trying to setup a new dashboard that reports on machines that are online and offline. I think the heartbeat monitor should be used but I am struggling with the details of getting it just right

I cant seem to find any  

7 Replies

@stuart355 

 

There is a built-in Azure Monitor Workbook (many Dashboards are now moved or are moving to Workbooks) called "Agent Health".  All Workbooks can be adapted to suit and you can look at the Log Analytics query as well, for ideas or to adjust. 

 

clipboard_image_1.png

 

clipboard_image_0.png

 

Also remember HeartBeat isn't necessarily offline / online.   e.g. of a machine goes offline without updating the agent there will be no HeartBeat until it comes online again.  There is a similar Workbook for VM Availability.

In a Workbook you can also perform an Azure Resource Graph (ARG) query, also based on KQL.  See here for a sample workbook: https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-and-azure-arc/ba-p/999379So for any Azure resource (such as a VM); you can get an immediate status - this is a workbook that shows Security data about a VM as a sample.  there is also a ARG example at the end of the post. 

This would also show Hybrid and VMs and their status.

 From the ARG Explorer (in the Azure Portal) 

clipboard_image_3.png

 resources
| where type in( "microsoft.hybridcompute/machines"  , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
//| summarize count(name) by type 

 

clipboard_image_2.png

 

 

 

@CliveWatson 

Thanks]for that. I'm in the Workbooks and see this

clipboard_image_0.png

 

Problem is I have no idea what to do next. Could you give some pointers please

Many thanks

@stuart355 

 

Ok, try this step by step guide.

 

Start with the "Agent Health" one, click on it to open it,

clipboard_image_2.png

 

After it loads you need to set your Subscription and Workspace from the Parameter drop downs

 

clipboard_image_0.png

The main view is quite useful (assuming you have Heartbeat data).  

 

clipboard_image_1.png

------------------------------------------------

 

Now if you wanted to update that Workbook.  Click on EDIT

 

clipboard_image_4.png

 

Lets now update the Title.  There are EDIT buttons located (normally) below each section, so press the one marked.

 

clipboard_image_5.png

 

You can now add some changed Text - press "done Editing" when you have finished with the Text box.  Its the [done editing] that relates to the section you want to press, not the overall one at the very top

clipboard_image_7.png

 

clipboard_image_6.png

 

Now lets use that Azure Resource Graph query I supplied.

Scroll to the bottom, and press "Add Query"

clipboard_image_8.png

 

Swap the "data Source" to Azure Resource Graph"

clipboard_image_9.png

 

Then paste, this text into the form

 resources
| where type in( "microsoft.hybridcompute/machines"  , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
//| summarize count(name) by type 

Next, you need to tell the Query where to get its Data.  The Workspace name is on the drop down we used earlier, so set the "Subscriptions" option to "workspace" - essentially, whatever workspace name is selected will be used.

clipboard_image_10.png


You should get some data back:

clipboard_image_12.png

 

To make it more readable, let do two things:

1. Un-comment the last line of code, so it looks like this - remove the "//":

 
 resources
| where type in( "microsoft.hybridcompute/machines"  , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
| summarize count(name) by type 

Then press "Run Query"

2. Lets now turn that data into a Pie Chart - click [Visualizations] , and then [Pie Chart]

clipboard_image_13.png

Press [Done Editing] again, and you should have something like:

 

 

clipboard_image_14.png

 

Finally, press the top "Done Editing" -

 

then SAVE - and other details.

clipboard_image_17.png

 

You should have something that looks like this.

 

clipboard_image_15.png

 

Does that help, a phase two would be to, maybe have a Drop Down Parameter - that allows you to select a computer you can see by the graph is having issues.  e.g.

 

clipboard_image_19.png

Thanks for that Clive
Looking at the default query for agent health, this is beyond my skills for writing queries. I was hoping there maybe somewhere where I can download templates for things like disk space and memory, or even Azure SQL related queries
Many thanks

@stuart355 

 

There are quite a few examples within this community.

 

You can also see other examples, when you open a new Logs Pane in Log Analytics - just press run to see what they do:

clipboard_image_0.png

Top tip: Use the free demo workspace for the above - as its fully (in most cases) populated https://ms.portal.azure.com/#blade/Microsoft_Azure_Monitoring_Logs/DemoLogsBlade 

 

There are 100s of samples in the Pluralsight course material, open Query Explorer (also from the above demo workspace)  sourcehttps://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch

clipboard_image_1.png

 

Also note:

 

clipboard_image_2.png

@CliveWatson 

I'd like to point out that while this is a great leap forward (workbooks, ARG, ARC), Workbooks and ARG are severely limited for very large enterprises. For example, in our org:

 

  • The Agent Health workbook times out--we apparently have far too many machines:clipboard_image_0.png
  • ARG is extremely limited on what it can return in large environments (status from running your query above):
    clipboard_image_1.png

These limiting problems will only be exacerbated when we deploy ARC for servers. Here's to hoping that Microsoft doesn't forget the large enterprises! :) 

@Scott Allison 

 

1. Thanks for the feedback, let me take a look at that workbook (its not mine!)

 

2. Regarding ARG, my original query was very basic and could well return too many rows.  This (sample) may improve things

resources
| where type in( "microsoft.hybridcompute/machines"  , "microsoft.compute/virtualmachines")
| extend statusState = trim(' ', tostring(properties.provisioningState))
| project name, type, statusState, subscriptionId
| summarize count(name) by type 

or better still a last row of 

 

summarize count(name) by type, statusState

 
I will keep looking at this....
 
Best wishes Clive