ALZ Monitoring

This module deploys all resources to enable the monitoring of a Log Analytics Workspace for all managed resources by the managed services provider. This includes Action group to send alerts to event pipeline of MSP, alerts for specific resources and a automation to add information (especially tags) to the LAW.

To enable usage of tags and resource properties in monitoring queries an existing automation account is used to import resource metadata into the central log analytics workspace.

Usage

To use this module a resource group and log analytics workspace is required. The webhook URL needs to point to a valid receiver for pipeline events. If authentication or other options are required they need to be included in the URL as path or query parameters.

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "rg-Monitor-dev-01"
  location = "westeurope"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "law-cust-Management-Monitor-01"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
}

resource "azurerm_automation_account" "example" {
  name                = "aac-Management-Monitor-dev-01"
  sku_name            = "Basic"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

module "monitor" {
  source                  = "../.."
  log_analytics_workspace = azurerm_log_analytics_workspace.example

  additional_regions = ["northeurope"]
  event_pipeline_config = {
    enabled                 = true
    name                    = "QBY EventPipeline"
    service_uri             = "https://qbeyond.de/Webhook?code={{secret}}}&clientid=fctkey-cust-prd-eventpipeline-01"
    service_uri_integration = "https://qbeyond.de/WebhookIntegration?code={{secret}}}&clientid=fctkey-cust-int-eventpipeline-01"
  }

  automation_account = azurerm_automation_account.example
  secret             = "impressum"
  secret_integration = "integration"
  tags = {
    "MyTagName" = "MyTagValue"
  }
}

Extra Queries

You can specify additional kusto queries to monitor.

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "rg-Monitor-dev-01"
  location = "westeurope"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "law-cust-Management-Monitor-01"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
}

resource "azurerm_automation_account" "example" {
  name                = "aac-Management-Monitor-dev-01"
  sku_name            = "Basic"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

module "monitor" {
  source                  = "../.."
  log_analytics_workspace = azurerm_log_analytics_workspace.example

  event_pipeline_config = {
    enabled     = true
    name        = "QBY EventPipeline"
    service_uri = "https://qbeyond.de/Webhook?code={{secret}}}&clientid=fctkey-cust-prd-eventpipeline-01"
  }
  automation_account = azurerm_automation_account.example
  secret             = "impressum"

  additional_queries = {
    "alr-prd-diskspace-bkp-law-logsea-warn-01" : {
      query_path  = "${path.module}/queries/failed_jobs.kusto"
      description = "Example of monitoring for failed backup jobs"
      time_window = 2280
    }
  }
}

queries/failed_jobs.kusto

// Example from Azure:
// All Failed Jobs 
// View all failed jobs in the selected time range. 
AddonAzureBackupJobs
| summarize arg_max(TimeGenerated,*) by JobUniqueId
| where JobStatus == "Failed"

Requirements

Name	Version
terraform	>=1.5.0
azapi	>= 1.14.0
azurerm	>= 3.7.0

Inputs

Name	Description	Type	Default	Required
automation_account	Automation account where the resource graph script will be deployed.	object({ name = string id = string location = string resource_group_name = string })	n/a	yes
log_analytics_workspace	Log Analytics Worksapce that all VMs are connected to for monitoring.	object({ id = string name = string resource_group_name = string location = string workspace_id = string primary_shared_key = string })	n/a	yes
additional_queries	List of additional alert rule queries to create with a file path, description and time_window.	map(object({ query_path = string description = string time_window = string frequency = string non_productive = optional(bool) }))	`{}`	no
additional_regions	Regions for additional data collection endpoints outside of the LAWs region.	`set(string)`	`[]`	no
event_pipeline_config	{ enabled = Enable the action group if you want to send data to a monitoring service. name = Name of the alert webhook. service_uri = Link to the webhook receiver URL. Must contain the placeholder "{{secret}}". This placeholder will be replaced by the secret value from var.secret. This is used to add authentication to the webhook URL as a query parameter. service_uri_integration = Same as service_uri for non productive monitoring alerts, the secret value from var.secret_integration will be used here. }	object({ enabled = bool name = optional(string, "QBY EventPipeline") service_uri = optional(string) service_uri_integration = optional(string) })	{ "enabled": false }	no
root_management_group_id	The management group that will be scanned by the Import-ResourceGraphToLogAnalytics runbook.	`string`	`"alz"`	no
secret	Value that will replace the placeholder `{{secret}}` in `event_pipeline_config.service_uri`.	`string`	`""`	no
secret_integration	Value that will replace the placeholder `{{secret}}` in `event_pipeline_config.service_uri_integration`.	`string`	`""`	no
tags	Tags that will be assigned to all resources.	`map(string)`	`{}`	no

Outputs

Name	Description
action_group_id	The id of the action group created for the event pipeline.
linux_dcr_ids	Map of DCRs and their resource IDs that should be associated to linux VMs.
vminsights_dcr_id	Resource ID of the VM-Insights DCR that should be associated with every VM.
windows_dcr_ids	Map of DCRs and their resource IDs that should be associated to windows VMs.

Resource types

  | Type | Used |
  |------|-------|
    | [azapi_resource](https://registry.terraform.io/providers/azure/azapi/latest/docs/resources/resource) | 3 |
    | [azurerm_automation_job_schedule](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_job_schedule) | 1 |
    | [azurerm_automation_module](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_module) | 2 |
    | [azurerm_automation_runbook](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_runbook) | 1 |
    | [azurerm_automation_schedule](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_schedule) | 1 |
    | [azurerm_automation_variable_string](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_variable_string) | 1 |
    | [azurerm_monitor_action_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_action_group) | 2 |
    | [azurerm_monitor_data_collection_endpoint](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_endpoint) | 2 |
    | [azurerm_monitor_data_collection_rule](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_rule) | 4 |
    | [azurerm_monitor_scheduled_query_rules_alert_v2](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_scheduled_query_rules_alert_v2) | 1 |
    | [time_static](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/static) | 1 |

  **`Used` only includes resource blocks.** `for_each` and `count` meta arguments, as well as resource blocks of modules are not considered.

Modules

No modules.

    ## Resources by Files

        ### custom_logs.tf

        | Name | Type |
        |------|------|
              | [azapi_resource.data_collection_json_logs_table](https://registry.terraform.io/providers/azure/azapi/latest/docs/resources/resource) | resource |
              | [azapi_resource.data_collection_text_logs_table](https://registry.terraform.io/providers/azure/azapi/latest/docs/resources/resource) | resource |
              | [azapi_resource.dcr_custom_json_logs](https://registry.terraform.io/providers/azure/azapi/latest/docs/resources/resource) | resource |
              | [azurerm_monitor_data_collection_rule.dcr_custom_text_logs](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_rule) | resource |

        ### data_collection_rules.tf

        | Name | Type |
        |------|------|
              | [azurerm_monitor_data_collection_rule.event_log](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_rule) | resource |
              | [azurerm_monitor_data_collection_rule.syslog](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_rule) | resource |
              | [azurerm_monitor_data_collection_rule.vm_insight](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_rule) | resource |

        ### main.tf

        | Name | Type |
        |------|------|
              | [azurerm_monitor_action_group.eventpipeline](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_action_group) | resource |
              | [azurerm_monitor_action_group.optional](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_action_group) | resource |
              | [azurerm_monitor_data_collection_endpoint.additional_dces](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_endpoint) | resource |
              | [azurerm_monitor_data_collection_endpoint.dce](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_endpoint) | resource |
              | [azurerm_monitor_scheduled_query_rules_alert_v2.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_scheduled_query_rules_alert_v2) | resource |
              | [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |

        ### resourcegraph.tf

        | Name | Type |
        |------|------|
              | [azurerm_automation_job_schedule.resourcegraph_query](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_job_schedule) | resource |
              | [azurerm_automation_module.az_accounts](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_module) | resource |
              | [azurerm_automation_module.az_resourcegraph](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_module) | resource |
              | [azurerm_automation_runbook.resourcegraph_query](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_runbook) | resource |
              | [azurerm_automation_schedule.twice_daily](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_schedule) | resource |
              | [azurerm_automation_variable_string.law_sharedkey](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/automation_variable_string) | resource |
              | [time_static.automation_schedule_tomorrow_5am](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/static) | resource |

Contribute

Please use Pull requests to contribute.

When a new Feature or Fix is ready to be released, create a new Github release and adhere to Semantic Versioning 2.0.0.

Tests

To test this module all examples should be applied. This can be done by running terraform test.

Name		Name	Last commit message	Last commit date
Latest commit History 276 Commits
.github/workflows		.github/workflows
examples		examples
queries		queries
resourcegraph		resourcegraph
tests		tests
.gitignore		.gitignore
.terraform-docs.yml		.terraform-docs.yml
.terraform.lock.hcl		.terraform.lock.hcl
CHANGELOG.md		CHANGELOG.md
LICENSE		LICENSE
README.md		README.md
custom_logs.tf		custom_logs.tf
data_collection_rules.tf		data_collection_rules.tf
locals.tf		locals.tf
main.tf		main.tf
outputs.tf		outputs.tf
resourcegraph.tf		resourcegraph.tf
terraform.tf		terraform.tf
variables.tf		variables.tf

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

ALZ Monitoring

Usage

Extra Queries

Requirements

Inputs

Outputs

Resource types

Modules

Contribute

Tests

About

Releases 20

Packages

Contributors 11

Languages

License

qbeyond/terraform-azurerm-alz-monitoring

Folders and files

Latest commit

History

Repository files navigation

ALZ Monitoring

Usage

Extra Queries

Requirements

Inputs

Outputs

Resource types

Modules

Contribute

Tests

About

Resources

License

Stars

Watchers

Forks

Releases 20

Packages 0

Contributors 11

Languages

Packages