☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • πŸ“– 8.1 Why Monitor Azure Resources?
  • πŸ“œ 8.2 Viewing Activity Logs with Azure CLI
  • πŸ“Š 8.3 Viewing Metrics for Resources
  • 🩺 8.4 Diagnosing Virtual Machine Issues
  • βš™οΈ 8.5 Configuring Diagnostics Settings
  • πŸ”₯ 8.6 Real-World Troubleshooting Example
  • πŸ›‘οΈ 8.7 Best Practices for Monitoring and Troubleshooting
  • πŸ“ Module 8 Summary
  1. Azure CLI

Monitoring and Troubleshooting in Azure CLI

πŸ“– 8.1 Why Monitor Azure Resources?

Monitoring helps you:

Benefit
Why It’s Important

Detect issues early

Spot problems before they cause downtime

Optimize performance

Track resource usage and adjust accordingly

Improve security

Detect suspicious activities

Audit changes

Track who made what changes and when

βœ… Monitoring is proactive β€” it’s the key to maintaining a healthy Azure environment!


πŸ“œ 8.2 Viewing Activity Logs with Azure CLI

The Activity Log records operations on resources at the control plane (e.g., resource creation, deletion).


πŸ› οΈ View Recent Activity Logs

bashCopyEditaz monitor activity-log list --output table

βœ… Displays recent activities like create, delete, and update operations.


Filter by Resource Group

bashCopyEditaz monitor activity-log list \
  --resource-group myResourceGroup \
  --output table

βœ… Only shows activity in a specific Resource Group.


Filter by Time

Get logs from the past hour:

bashCopyEditaz monitor activity-log list --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ) --output table

βœ… Useful for investigating recent changes.


πŸ“Š 8.3 Viewing Metrics for Resources

Azure Metrics provide near real-time data on resource performance.


πŸ› οΈ List Available Metrics for a VM

bashCopyEditaz monitor metrics list-definitions \
  --resource /subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Compute/virtualMachines/<vm-name> \
  --output table

βœ… Shows all available metrics for the VM (CPU usage, Disk IO, etc.).


πŸ› οΈ Get CPU Usage Metrics

bashCopyEditaz monitor metrics list \
  --resource /subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Compute/virtualMachines/<vm-name> \
  --metric "Percentage CPU" \
  --interval PT1M \
  --output table
TimeStamp
Average

2025-04-05T14:00:00Z

12.5

2025-04-05T14:01:00Z

14.2

βœ… See how busy your VM is!


🩺 8.4 Diagnosing Virtual Machine Issues

When VMs act weird (fail to boot, slow down, crash), diagnostics are your friend.


πŸ› οΈ Enable Boot Diagnostics

bashCopyEditaz vm boot-diagnostics enable \
  --resource-group myResourceGroup \
  --name myVM

βœ… Captures screenshots and logs during VM startup.


πŸ› οΈ View Boot Diagnostics Info

bashCopyEditaz vm boot-diagnostics get-boot-log \
  --resource-group myResourceGroup \
  --name myVM

βœ… See the boot log and screenshot to help diagnose issues.


βš™οΈ 8.5 Configuring Diagnostics Settings

Azure resources can send logs and metrics to:

  • Log Analytics Workspace

  • Storage Account

  • Event Hub

βœ… You can set this up with Azure CLI too!


πŸ› οΈ Example: Send Diagnostics to a Log Analytics Workspace

bashCopyEditaz monitor diagnostic-settings create \
  --name myDiagnosticsSetting \
  --resource /subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Compute/virtualMachines/<vm-name> \
  --workspace <workspace-id> \
  --metrics '[{"category": "AllMetrics","enabled": true}]' \
  --logs '[{"category": "Administrative","enabled": true}]'

βœ… Centralized logging = easier troubleshooting!


πŸ”₯ 8.6 Real-World Troubleshooting Example

Problem: You can't connect to your new Linux VM.

βœ… Here’s a basic troubleshooting flow:

Step
CLI Command
Purpose

1

az vm show

Verify VM exists and is running

2

az network nic show

Check NIC (network interface) status

3

az network nsg rule list

Verify NSG allows SSH inbound (port 22)

4

az vm boot-diagnostics get-boot-log

Check if VM booted properly

If SSH port is blocked or the VM failed to boot β€” you’ll know fast.


πŸ›‘οΈ 8.7 Best Practices for Monitoring and Troubleshooting

Best Practice
Why It Matters

Enable diagnostics from the start

Avoid scrambling during incidents

Send logs to Log Analytics

Centralized monitoring and analysis

Regularly review Activity Logs

Detect unauthorized or suspicious changes

Monitor key metrics (CPU, Disk)

Avoid outages from resource exhaustion

Script common troubleshooting tasks

Save time during incidents


πŸ“ Module 8 Summary

Topic
Key Points

View Activity Logs

az monitor activity-log list

Monitor Metrics

az monitor metrics list

Diagnose VMs

Boot diagnostics help fix startup problems

Configure Diagnostics Settings

Send logs/metrics to centralized locations

Troubleshooting best practices

Proactive monitoring saves time and resources

Last updated 2 months ago