Azure VM Monitoring Considerations

By Ashwin Venugopal -

 




Azure VM Monitoring Considerations

Microsoft has decided to not generally implement the needed functionality into Azure, instead let the customers to deploy the necessary monitoring components and configurations to their Azure VMs, as the monitoring demanded by SAP were particularly specific to SAP applications. However, the deployment and lifecycle management of the monitoring components can be mostly automated by Azure.

To enable SAP monitoring, the solution developed is solely based on the concept of Azure VM Agent and its extensions. The main idea behind this approach is to let (especially in cases like the Azure Monitoring Extension for SAP) the deployment of special functionality into a VM as well as the configuration of such software at deployment time, while the extension is needed for the SAP workloads to be supported on Azure VMs.

The 'Azure VM Agent' that allows you to handle the specific Azure VM Extensions within the VM is introduced to the Windows VMs by default on VM creation, while in case of SUSE, Red Hat or Oracle Linux, the VM agent is already a part of the Azure Marketplace image. However, for custom images it must be installed manually.

Any interaction between the Azure Monitoring Extension for SAP and the SAP system takes place via the SAP host Agent which is a standalone component that does not have any direct dependency on SAP kernel, which can eliminate the requirement to update it during the SAP system updates.

THE SAP monitoring tools SAPOSCOL or SAP Host Agent retrieves Azure VM telemetry via an Azure Monitoring Extension for SAP that allows SAP to collect important performance counters and display them by SAP transactions ST06 and OS07. The Azure monitoring statistics are fed by the extension into the SAP application for operating system monitoring as well as DBA Cockpit functions which helps top investigate performance issues while providing the basis for capacity planning.

You can easily use AZ Powershell or Azure CLI to enable the extension and use the azperflib.exe executable whose output can show all the populated Azure performance counters for SAP, to easily verify the extension functionality on a Windows Azure VM. At the bottom of the list of the collected counters, you can find a summary and a health indicator which reflects the status of the Monitoring Extension. However, to verify the extension functionality on Linux Azure VM, you have to examine the content of the /var/lib/AzrueEnhancedMonitor/PerfCounters file. 

You will have to update the SAP monitoring configuration whenever the joint Microsoft and SAP team extends the capabilities which results in changes to the number and type of performance counters being collected or whenever Microsoft introduces a new version of the underlying Azure infrastructure delivering the monitoring data. Similarly, update of the configuration will be needed if you want to change the number of disks attached to the Azure VM hosting the SAP workload, add new network interfaces to it, or change its size. You can simply repeat the same sequence of steps which you used to install the extension in the first place to easily update the monitoring configuration. 









Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more