Previous

Next

Exercise - Use activity log alerts to alert on events within your Azure infrastructure

Completed

The shipping company you work for wants to avoid any future issues with updates to its applications on the Azure platform. To improve the alerting capabilities within Azure, you'll use activity log alerts.

Your goal is to set up a Linux VM and create an activity log monitoring rule to detect when a VM is deleted. You'll then delete the VM to trigger this alert.

Create the Azure activity log monitor

1. Sign in to the Azure portal with the same account you used to activate the sandbox.

2. On the Azure portal resource menu or under Azure services, select Monitor. The Overview pane for Monitor appears.

3. In the Monitor menu, select Alerts. The Monitor | Alerts pane appears.

4. On the command bar, select Create + and select Alert rule. The Create an alert rule pane appears with the Scope section open and the Select a resource pane open on the right.

5. In the Select a resource pane, the Filter by subscription field should already be populated with Concierge Subscription. In the Filter by resource type dropdown list, search for and select Virtual machines.

6. You want an alert when any virtual machine in your resource group is deleted. Select the box for the [sandbox resource group name] resource group, then select Done.

   

7. The Create an alert rule pane reappears with the Scope target resource showing All Virtual machines. Select the Condition tab. The Select a signal pane appears.

8. In the Search by signal name box, enter Delete, and then select Delete Virtual Machine (Microsoft.Compute/virtualMachines).

9. The Create an alert rule pane reappears. You want to receive alerts of all types, so leave Alert logic settings at their default of All selected. Leave the Create an alert rule pane open for the next section.

Add an email alert action

For the previous Azure Monitor alert, you didn't add any actions. You just viewed triggered alerts in the Azure portal. Actions let you send an email for notifications, to trigger an Azure function, or to call a webhook. You'll now add an email alert when VMs are deleted.

1. On the Create an alert rule pane, select the Next: Actions button, and select Create action group. The Create an action group pane appears.

2. On the Basics tab, enter the following values for each setting.

   Setting	Value
   Project details
   Subscription	Concierge Subscription
   Resource group	From the dropdown list, name of your sandbox resource group
   Region	Global (default)
   Instance details
   Action group name	Alert the operations team
   Display name	AlertOpsTeam

3. Select Next : Notifications, and enter the following values for each setting.

   Setting	Value
   Notification type	Select Email/SMS message/Push/Voice
   Name	VM was deleted

4. The Email/SMS message/Push/Voice pane appears automatically. If it didn't, select the Edit pencil icon.

5. Select Email, and in the Email box, enter your email address, and then select OK.

6. Select Review + create to validate your input.

7. Select Create.

8. The Create an alert rule pane reappears. Select the Next: Details button and enter the following values for each setting.

   Setting	Value
   Alert rule name	VM was deleted
   Description	A VM in your resource group was deleted

9. Open the Advanced options section, and confirm that the following value is set.

   Setting	Value
   Enable alert rule upon creation	Check - Yes

   

10. Select Review + create to validate your input.

11. Select Create.

Recipients added to the configured action group (operations team) will receive a notification:

• When they're added to the action group
• When the alert is activated
• When the alert is triggered

It can take up to five minutes for an activity log alert rule to become active. In this exercise, if you delete the virtual machine before the rule has been deployed, the alert rule might not be triggered. Because of this delay, you might not see the same results in the following steps after you delete the VM.

Delete your virtual machine

To trigger an alert, you need to delete the Linux VM machine that you created in the previous exercise.

1. On the Azure portal menu or from the Home page, select Virtual machines. This action shows a list of the virtual machines.

2. Select the vm1 virtual machine.

3. Select Delete from the menu bar.

4. To confirm the deletion, check the box at the bottom of the pane to confirm, then select Delete.

5. In the title bar, select the Notifications icon and wait until vm1 is successfully deleted.

View your activity log alerts in Azure Monitor

In the exercise, you set up an Ubuntu VM and created an activity log rule to detect when the VM was deleted. You then deleted a VM from your resource group. Let's check whether an alert was triggered.

1. You should've received a notification email that reads, Important notice: Azure Monitor alert VM was deleted was activated... If not, open your email program and look for an email from azure-noreply@microsoft.com.

   

2. On the Azure portal resource menu, select Monitor, and then in the Monitor | Alerts menu select Alerts.

3. You should have three verbose alerts that were generated by deleting vm1.

   

4. Select the name of one of the alerts (For example, VM was deleted). An Alert details pane appears that shows more details about the event.

Continue