Diagnostic settings for resources in Azure - Mini Project: Build & Apply

Diagnostic settings for resources

📖 Scenario: You are managing an Azure environment and want to enable diagnostic settings on a resource to collect logs and metrics for monitoring and troubleshooting.

🎯 Goal: Create a diagnostic settings configuration for an Azure resource that sends logs and metrics to a storage account, an event hub, and a Log Analytics workspace.

📋 What You'll Learn

Create a dictionary called resource with the resource ID.

Create a dictionary called destinations with storage account ID, event hub authorization rule ID, and Log Analytics workspace ID.

Create a dictionary called diagnostic_settings with logs and metrics settings referencing the resource and destinations.

Add the final enabled flag set to true in the diagnostic settings.

💡 Why This Matters

🌍 Real World

Enabling diagnostic settings is essential for monitoring Azure resources, collecting logs and metrics for troubleshooting and compliance.

💼 Career

Cloud engineers and administrators often configure diagnostic settings to ensure visibility into resource health and activity.

1

Create the resource dictionary

Create a dictionary called resource with the key id set to the string "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myVM".

Azure

# Create the resource dictionary with the exact id
# Your code here

Hint

Use a dictionary with key id and the exact resource ID string.

2

Create the destinations dictionary

Create a dictionary called destinations with keys storage_account_id, event_hub_authorization_rule_id, and workspace_id. Set their values to the strings "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Storage/storageAccounts/mystorage", "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.EventHub/namespaces/myeventhub/authorizationRules/RootManageSharedAccessKey", and "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myworkspace" respectively.

Azure

resource = {
    "id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myVM"
}
# Create the destinations dictionary with exact keys and values
# Your code here

Hint

Use a dictionary with the exact keys and values for each destination.

3

Create the diagnostic settings dictionary

Create a dictionary called diagnostic_settings with keys resource_id, logs, metrics, storage_account_id, event_hub_authorization_rule_id, and workspace_id. Set resource_id to resource["id"]. Set logs to a list with one dictionary containing category as "Administrative" and enabled as true. Set metrics to a list with one dictionary containing category as "AllMetrics" and enabled as true. Set the destination IDs from the destinations dictionary accordingly.

Azure

resource = {
    "id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myVM"
}
destinations = {
    "storage_account_id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Storage/storageAccounts/mystorage",
    "event_hub_authorization_rule_id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.EventHub/namespaces/myeventhub/authorizationRules/RootManageSharedAccessKey",
    "workspace_id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myworkspace"
}
# Create the diagnostic_settings dictionary with logs, metrics, and destination IDs
# Your code here

Hint

Use lists for logs and metrics with dictionaries inside. Reference resource["id"] and destinations values.

4

Enable the diagnostic settings

Add the key enabled with the value True to the diagnostic_settings dictionary to activate the diagnostic settings.

Azure

resource = {
    "id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myVM"
}
destinations = {
    "storage_account_id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.Storage/storageAccounts/mystorage",
    "event_hub_authorization_rule_id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.EventHub/namespaces/myeventhub/authorizationRules/RootManageSharedAccessKey",
    "workspace_id": "/subscriptions/12345/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myworkspace"
}
diagnostic_settings = {
    "resource_id": resource["id"],
    "logs": [
        {
            "category": "Administrative",
            "enabled": True
        }
    ],
    "metrics": [
        {
            "category": "AllMetrics",
            "enabled": True
        }
    ],
    "storage_account_id": destinations["storage_account_id"],
    "event_hub_authorization_rule_id": destinations["event_hub_authorization_rule_id"],
    "workspace_id": destinations["workspace_id"]
}
# Add the enabled flag set to True in diagnostic_settings
# Your code here

Hint

Add the key enabled with value True inside the diagnostic_settings dictionary.

Practice

1. What is the main purpose of Diagnostic settings in Azure resources?

easy

A. To collect logs and metrics for monitoring and troubleshooting

B. To create virtual machines automatically

C. To manage user access permissions

D. To deploy web applications

Solution

1. Step 1: Understand diagnostic settings role

   Diagnostic settings collect logs and metrics from Azure resources to help monitor and troubleshoot.

2. Step 2: Compare options with purpose

   Options A, B, and C describe other Azure features unrelated to diagnostics.

3. Final Answer:

   To collect logs and metrics for monitoring and troubleshooting -> Option A

4. Quick Check:

   Diagnostic settings = collect logs and metrics [OK]

Hint: Diagnostic settings always collect logs and metrics [OK]

Common Mistakes:

• Confusing diagnostic settings with access control
• Thinking diagnostic settings deploy resources
• Assuming diagnostic settings manage applications

2. Which of the following is the correct way to specify a diagnostic setting destination in Azure CLI?

easy

A. az network watcher configure --name MyDiag --resource MyResource --workspace MyWorkspace

B. az vm create --name MyDiag --resource MyResource --workspace MyWorkspace

C. az storage account create --name MyDiag --resource MyResource --workspace MyWorkspace

D. az monitor diagnostic-settings create --name MyDiag --resource MyResource --workspace MyWorkspace

Solution

1. Step 1: Identify correct Azure CLI command for diagnostic settings

   The command az monitor diagnostic-settings create is used to create diagnostic settings.

2. Step 2: Verify other commands

   Commands for VM, storage account, and network watcher do not create diagnostic settings.

3. Final Answer:

   az monitor diagnostic-settings create --name MyDiag --resource MyResource --workspace MyWorkspace -> Option D

4. Quick Check:

   Diagnostic settings use az monitor diagnostic-settings create [OK]

Hint: Use 'az monitor diagnostic-settings create' to configure diagnostics [OK]

Common Mistakes:

• Using VM or storage commands instead of monitor diagnostic-settings
• Confusing resource creation with diagnostic configuration
• Missing required parameters for diagnostic settings

3. Given this Azure CLI command:

az monitor diagnostic-settings create --name Diag1 --resource /subscriptions/123/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1 --workspace ws1 --logs '[{"category": "Administrative", "enabled": true}]'

What will this command do?

medium

A. Create a new virtual machine named Diag1

B. Enable Administrative logs to be sent to Log Analytics workspace ws1 for VM vm1

C. Disable all logs for the virtual machine vm1

D. Send metrics only to storage account ws1

Solution

1. Step 1: Analyze command parameters

   The command creates diagnostic settings named Diag1 for VM vm1, sending logs to workspace ws1, enabling Administrative logs.

2. Step 2: Interpret log category and destination

   Logs category "Administrative" is enabled and sent to Log Analytics workspace ws1.

3. Final Answer:

   Enable Administrative logs to be sent to Log Analytics workspace ws1 for VM vm1 -> Option B

4. Quick Check:

   Diagnostic settings send logs to workspace = Enable Administrative logs to be sent to Log Analytics workspace ws1 for VM vm1 [OK]

Hint: Look for --logs and --workspace to identify log destination [OK]

Common Mistakes:

• Thinking it creates a VM instead of diagnostic settings
• Confusing logs with metrics or storage
• Assuming logs are disabled

4. You tried to create a diagnostic setting with this command:

az monitor diagnostic-settings create --name Diag2 --resource /subscriptions/123/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/sa1 --storage-account sa1 --metrics '[{"category": "AllMetrics", "enabled": true}]'

But you get an error. What is the most likely cause?

medium

A. Diagnostic settings cannot send metrics to storage accounts

B. The metrics category "AllMetrics" is invalid

C. The storage account name is missing or incorrect

D. The resource ID format is wrong

Solution

1. Step 1: Understand diagnostic settings destinations

   Diagnostic settings can send logs and metrics to Log Analytics, Storage, or Event Hub. The --storage-account parameter requires the full ARM resource ID of the storage account.

2. Step 2: Check command parameters

   The command specifies --storage-account sa1, which is only the short name and cannot be resolved by the CLI.

3. Final Answer:

   The storage account name is missing or incorrect -> Option C

4. Quick Check:

   --storage-account requires full ID [OK]

Hint: Use full ARM ID for --storage-account [OK]

Common Mistakes:

• Using short name instead of full resource ID for --storage-account
• Thinking metrics cannot be sent to storage accounts
• Assuming invalid metrics category or wrong resource ID

5. You want to monitor an Azure SQL Database and send both logs and metrics to a Log Analytics workspace. Which combination of diagnostic settings configuration is correct?

hard

A. Enable logs categories 'SQLSecurityAuditEvents' and 'SQLInsights' and enable metrics category 'AllMetrics' with destination set to Log Analytics workspace

B. Enable only logs categories and send to Storage account

C. Enable metrics only and send to Event Hub

D. Enable logs and metrics but send logs to Storage and metrics to Log Analytics workspace

Solution

1. Step 1: Identify correct log and metric categories for Azure SQL Database

   Logs like 'SQLSecurityAuditEvents' and 'SQLInsights' and metrics 'AllMetrics' are valid categories for Azure SQL Database diagnostics.

2. Step 2: Confirm destination for logs and metrics

   Both logs and metrics can be sent to Log Analytics workspace for monitoring and analysis.

3. Final Answer:

   Enable logs categories 'SQLSecurityAuditEvents' and 'SQLInsights' and enable metrics category 'AllMetrics' with destination set to Log Analytics workspace -> Option A

4. Quick Check:

   Logs and metrics to Log Analytics = Enable logs categories 'SQLSecurityAuditEvents' and 'SQLInsights' and enable metrics category 'AllMetrics' with destination set to Log Analytics workspace [OK]

Hint: Send both logs and metrics to Log Analytics for full monitoring [OK]

Common Mistakes:

• Sending logs to storage but metrics elsewhere
• Enabling only logs or only metrics
• Using wrong categories for Azure SQL Database