One of the common ask I get from customers is to alert on new resources when they are created. I typically hesitate to alert every time a single resource is created because I think the better approach is to generate a report of new resource on a schedule. So, for this blog I want to walk you through utilizing Azure Logic Apps along with Azure Log Analytics to generate a useful report that you can schedule.
Before we jump into implementation let’s look at what the Logic Apps looks like.
As you can see this is a simple Logic App. We only have 3 steps in this process:
Below is an example of the HTML Report:
Prerequisites
If you’re interested in implementing this Logic App you need to be aware of a few requirements:
1. You need to send you’re Azure Activity Logs to a Log Analytics Workspace in order for the Log Analytics query to come back with any results.
Azure Activity log - Azure Monitor | Microsoft Docs
2. For the example below I use the connector to Office365. So you either need an Office365 account or you need to use a different action for the email.
Hopefully, everyone is still interested and wants to look at this in your environment. Well let’s walk through importing the Logic App!
You can follow the below document to create a Logic App if you’ve never created one before:
You can name you’re Logic App whatever you like. I chose to name mine “NewResourcesReport”
When you create the Logic App it will bring you to the Template page. You can choose “Recurrence” to get started with the Logic App.
I typically like to rename my steps before I do anything. So whenever I mention renaming a step you simply click on the “…” for the step and choose rename:
Complete the following for the “Recurrence” step:
Click on “+ New Step”, search for “Azure Monitor”, and choose “Azure Monitor Logs”
This will bring up the actions available for “Azure Monitor Logs” and we will use the “Run query and visualize results”
Rename the action to “Query for New Resources”
Enter the following values to connect to the Log Analytics Workspace where your “Azure Activity Logs” are being sent.
let ResourceCreation=AzureActivity
| where OperationNameValue =~ 'MICROSOFT.RESOURCES/DEPLOYMENTS/WRITE';
ResourceCreation
| summarize arg_max(TimeGenerated, *) by CorrelationId
| where ActivityStatusValue =~ 'Success'
| project CorrelationId
| join kind=inner (ResourceCreation
| summarize arg_min(TimeGenerated, *) by CorrelationId) on CorrelationId
| project TimeGenerated, Caller, CallerIpAddress, ResourceGroup, ResourceId
Click on “+ New Step” below this activity, search for “send an email (v2)”, and choose the Office 365 Outlook action named “Send an email (V2)”
Rename the Action to “Email HTML Report” and fill out the following:
That’s it for the Logic App. You should now click on “Save” and once the Logic App is saved click on “Run”
With the help of Azure Log Analytics and the Kusto query language we are able to create a simple 3 step Logic App that will generate a HTML report that is emailed out on a recurring basis. This is a great example of how Azure Logic Apps can be a great tool to utilize as an Azure Administrator.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.