Network Watcher for diagnostics in Azure - Mini Project: Build & Apply

Network Watcher for diagnostics

📖 Scenario: You are managing a small Azure environment. You want to set up Network Watcher to monitor and diagnose network issues in your virtual network.

🎯 Goal: Create an Azure Network Watcher resource named NetworkWatcher_eastus in the eastus region, enable it for your subscription, and configure a diagnostic setting to send logs to a storage account.

📋 What You'll Learn

Create a Network Watcher resource named NetworkWatcher_eastus in the eastus region

Verify Network Watcher is enabled for the subscription in eastus

Create a diagnostic setting named MyDiagSetting for NetworkWatcher_eastus

Configure the diagnostic setting to send logs to an existing storage account named mystorageaccount

💡 Why This Matters

🌍 Real World

Network Watcher helps monitor and diagnose network issues in Azure, essential for maintaining healthy cloud infrastructure.

💼 Career

Cloud engineers and network administrators use Network Watcher to troubleshoot connectivity and security issues in Azure environments.

1

Create Network Watcher resource

Create a Network Watcher resource named NetworkWatcher_eastus in the eastus region using Azure CLI syntax.

Azure

# Your code here to create Network Watcher resource

Hint

Use az network watcher configure with --locations eastus and --enabled true.

2

Verify Network Watcher for subscription

Verify Network Watcher for your subscription in the eastus region using Azure CLI.

Azure

az network watcher configure --resource-group NetworkWatcherRG --locations eastus --enabled true
# Your code here to verify Network Watcher for subscription

Hint

Use az network watcher show with --name NetworkWatcher_eastus and --resource-group NetworkWatcherRG.

3

Create diagnostic setting for Network Watcher

Create a diagnostic setting named MyDiagSetting for the Network Watcher resource NetworkWatcher_eastus that sends logs to the storage account mystorageaccount using Azure CLI.

Azure

az network watcher configure --resource-group NetworkWatcherRG --locations eastus --enabled true
az network watcher show --resource-group NetworkWatcherRG --name NetworkWatcher_eastus
# Your code here to create diagnostic setting

Hint

Use az monitor diagnostic-settings create with --name MyDiagSetting, --resource <resource ID>, and --storage-account mystorageaccount.

4

Verify and finalize Network Watcher diagnostics setup

Add the final command to verify the diagnostic settings for NetworkWatcher_eastus using Azure CLI.

Azure

az network watcher configure --resource-group NetworkWatcherRG --locations eastus --enabled true
az network watcher show --resource-group NetworkWatcherRG --name NetworkWatcher_eastus
resource_id=$(az network watcher show --resource-group NetworkWatcherRG --name NetworkWatcher_eastus --query id -o tsv)
az monitor diagnostic-settings create --name MyDiagSetting --resource $resource_id --storage-account mystorageaccount --logs '[{"category": "NetworkSecurityGroupEvent", "enabled": true}]'
# Your code here to verify diagnostic settings

Hint

Use az monitor diagnostic-settings list with --resource <resource ID> to verify.

Practice

1. What is the primary purpose of Azure Network Watcher?

easy

A. To monitor and diagnose network issues in Azure

B. To create virtual machines

C. To manage Azure subscriptions

D. To deploy web applications

Solution

1. Step 1: Understand Network Watcher role

   Network Watcher is designed to monitor and diagnose network problems in Azure environments.

2. Step 2: Compare with other options

   Creating VMs, managing subscriptions, and deploying web apps are unrelated to network diagnostics.

3. Final Answer:

   To monitor and diagnose network issues in Azure -> Option A

4. Quick Check:

   Network Watcher = Monitor and diagnose network issues [OK]

Hint: Network Watcher = network monitoring tool [OK]

Common Mistakes:

• Confusing Network Watcher with VM or app services
• Thinking it manages subscriptions
• Assuming it deploys applications

2. Which Azure resource is required to enable flow logs in Network Watcher?

easy

A. App Service

B. Virtual Machine

C. Storage Account

D. SQL Database

Solution

1. Step 1: Identify flow log storage needs

   Flow logs record network traffic and must be saved somewhere persistent.

2. Step 2: Match resource for storing logs

   Storage Account is used to store flow logs generated by Network Watcher.

3. Final Answer:

   Storage Account -> Option C

4. Quick Check:

   Flow logs need Storage Account [OK]

Hint: Flow logs save data in Storage Account [OK]

Common Mistakes:

• Choosing VM or App Service instead of storage
• Confusing SQL Database with log storage
• Not knowing where logs are saved

3. Given this Azure CLI command to enable flow logs, what will it do?

az network watcher flow-log create --resource-group MyResourceGroup --nsg MyNSG --enabled true --storage-account mystorage

medium

A. Delete flow logs from mystorage

B. Disable flow logs for the NSG

C. Create a new NSG named mystorage

D. Enable flow logs for the NSG and save logs to mystorage

Solution

1. Step 1: Analyze command parameters

   The command enables flow logs (--enabled true) for the NSG named MyNSG in MyResourceGroup.

2. Step 2: Understand storage account usage

   Logs will be saved to the storage account named mystorage as specified.

3. Final Answer:

   Enable flow logs for the NSG and save logs to mystorage -> Option D

4. Quick Check:

   --enabled true + storage-account = enable logs saved [OK]

Hint: Look for --enabled true and storage-account to confirm enabling logs [OK]

Common Mistakes:

• Thinking it disables logs
• Confusing storage account name with NSG
• Assuming it deletes logs

4. You tried to enable flow logs but received an error: "Storage account not found." What is the most likely cause?

medium

A. Network Watcher is disabled in the region

B. The storage account name is misspelled or does not exist

C. The NSG is not created yet

D. Flow logs are already enabled

Solution

1. Step 1: Understand error message

   "Storage account not found" means the specified storage account cannot be located.

2. Step 2: Identify common causes

   Most often this happens if the storage account name is wrong or the account does not exist in the subscription or region.

3. Final Answer:

   The storage account name is misspelled or does not exist -> Option B

4. Quick Check:

   Storage account error = wrong or missing storage account [OK]

Hint: Check storage account name spelling and existence first [OK]

Common Mistakes:

• Assuming NSG or Network Watcher status causes this error
• Thinking flow logs already enabled causes storage error
• Ignoring storage account region or subscription

5. You want to monitor network traffic for multiple NSGs across different regions. Which combination of Azure resources and steps is best practice to set up Network Watcher diagnostics?

hard

A. Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage

B. Create one storage account in any region and configure all NSGs to send flow logs there without enabling Network Watcher in regions

C. Enable Network Watcher only in one region and configure flow logs for NSGs in all regions to that single watcher

D. Use Azure Monitor instead of Network Watcher for NSG flow logs

Solution

1. Step 1: Understand regional scope of Network Watcher

   Network Watcher must be enabled in each Azure region where you want to monitor NSGs.

2. Step 2: Storage account best practice

   Creating a storage account per region reduces latency and complies with data residency rules.

3. Step 3: Configure flow logs per NSG

   Each NSG's flow logs should point to the storage account in its region for efficient storage and retrieval.

4. Final Answer:

   Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage -> Option A

5. Quick Check:

   Regional watchers + regional storage + per-NSG config = best practice [OK]

Hint: Enable watcher and storage per region for best flow log setup [OK]

Common Mistakes:

• Using one watcher or storage for all regions
• Skipping enabling Network Watcher in some regions
• Confusing Azure Monitor with Network Watcher for flow logs