Problem of setting up an alert on azure in the event of a freeze of a VM

Fakri SLIMANE 26

Hello,

I would like to know how to set up an alert when my VM freezes, to be able to intervene very quickly.

As you can see on the graph, when the VM freezes, there are small dotted lines where you can see that there is no value, probably a communication problem.

here, I would like to create an alert by sending an email when the VM freezes, but I tried and I can't do it because we can't leave the field without value, is there another way to achieve this? to have an alert?

Cordially,
Fakri

Accepted answer

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2022-09-06T23:47:26.627+00:00

For this type of alerts when you are checking missing data, I highly recommend taking aggregation granularity more than in query itself, for example 10 minutes in this case
Please sign in to rate this answer.
Fakri SLIMANE 26 Reputation points

2022-09-07T00:14:19.73+00:00

Thank you very much for your time, I confirm your method.

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2022-09-07T00:40:52.753+00:00

It's my pleasure to help where I can
Sign in to comment

2 additional answers

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2022-09-05T19:11:35.93+00:00
Hi @Fakri SLIMANE ,

Using VM Insights to capture missing heartbeats is an overkilling approach, if you don't need VM Insights at all.
Install Azure Monitoring Agent to collect for example several events into Log Analytics Workspace (VM Insights is not required in this case), this will deploy Data Collection Rules with Azure Monitoring Agent. The fact is that you can't collect heartbeats only, so that's why you need to workaround this by collecting some minimum amount of data.

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal

Then use the query to check missing heartbeats, create an alert rule based on that query

Heartbeat | summarize LastHeartbeat=max(TimeGenerated) by Computer | where LastHeartbeat < ago(5min) | project Computer, LastHeartbeat, SeverityName_s = "WARNING", AffectedCI_s = strcat(Computer)

When your VM is stuck or "frozen", I will receive a notification like that
Please sign in to rate this answer.

2 people found this answer helpful.
Fakri SLIMANE 26 Reputation points

2022-09-06T21:28:48.297+00:00

Hi @Maxim Sergeev

I tried to implement the method, but I encounter several blocking points:

I created the rule, by choosing the source which is my VM SIGNAC, then which event to choose so that it is enough to detect a freeze of the VM?

to continue creating the rule, I tested with a Data collection endpoint but it didn't work, I tested without setting up the Data collection endpoint, I don't receive any logs on the workspace Log Analytics. Or maybe I'm doing the wrong thing to check the logs

by testing your query I don't get any results is this normal?

a managed identity is activated, but it does not have any RBAC role, is this normal?

on the request you shared, do I have to modify a field to adapt it to my alert?

For the choice of the scope of the alert, is it the Log Analytics workspace that I must choose?

To describe my steps: I created the rule specifying my SIGNAC VM as the source, then I chose the events, and finally I chose my Log Analytics workspace as the destination, once the deployment was complete, the Azure monitor agent is installed on the VM automatically and a system managed identity has been activated on the VM.

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2022-09-06T21:46:45.88+00:00

@Fakri SLIMANE ,

When you configure Data Collection Rule you can use just several events here, to reduce amount of data. I would suggest collecting critical system events only (checkbox System\Critical only).
This will configure Azure Monitoring Agent to start reporting to Log Analytics Workspace.
If the query above shows nothing - it's a good condition as expected.
Can you confirm that the Heartbeat table is being populated?

Heartbeat | summarize LastHeartbeat=max(TimeGenerated) by Computer

by testing your query I don't get any results is this normal?

yes

a managed identity is activated, but it does not have any RBAC role, is this normal?

yes

on the request you shared, do I have to modify a field to adapt it to my alert?

no

For the choice of the scope of the alert, is it the Log Analytics workspace that I must choose?

yes

Fakri SLIMANE 26 Reputation points

2022-09-06T23:37:20.953+00:00

Thank-you for your prompt response,

FYI, I performed the test for the first time on a SIGNAC VM which is in a domain active directory, in a Vnet where a dns is configured on that of a Windows DC sever, for this VM I got nothing as a log, even when executing your query:
heart beat
| summarize LastHeartbeat=max(TimeGenerated) by Computer

For the second test, I deployed a VM Vm02 which is not in the domain, and which is in another Vnet with the default azure dns, and there I get a result:

I performed a test by stopping the VM Vm02, then waiting 5 minutes later, I executed your request, and I get this result:

Now I have configured an alert, as you advised me, but after 5 minutes I do not receive any notification by email, I think I have misconfigured my alert. On this part what should I enter as a number?

Cordially,
Fakri.

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2022-09-06T23:48:23.67+00:00

For this type of alerts when you are checking missing data, I highly recommend taking aggregation granularity more than in query itself, for example 10 minutes in this case
Sign in to comment
kilian goëtz 146 Reputation points

2022-09-05T16:32:58.967+00:00

Hello,

This tutorial could help you https://learn.microsoft.com/en-us/azure/azure-monitor/vm/tutorial-monitor-vm-alert solution is simple, you need VM insight and create a log query.

"Once you enable monitoring with VM insights in Azure Monitor for the virtual machine, a heartbeat is sent to Azure Monitor every minute. You can create a log query alert rule that sends an alert if a heartbeat isn't detected"

Kinds regards, Kilian GOËTZ.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment