How to see Azure Alerts: Query rules and Activity Log in SCOM through Azure Management Pack

pack https://www.microsoft.com/en-us/download/details.aspx?id=50013 is designed to enable hybrid scenario where SCOM is used as a single pane of glass to monitor both Azure and on-prem resources. If you want to monitor your Azure resources like , accounts, Application Insights, (just to name few) in SCOM, then Azure MP can certainly help. 

Azure gives you an option to create Alerts based on the metrics or logs collected through telemetry. Today we will talk about how Azure MP brings Log Search and Activity Log alerts from Azure in SCOM for your Azure resource. 

AlertsSignal.PNG

Let's start:

We have an availability test where we are pinging a url from 16 locations every 5 minutes. We have configured Log search alert named “SummitDemoAvailTest” for a threshold lesser than 16.

LogSearch.PNG

Now we will configure an Activity Log alert named “Run Command on DemoVM1” for an activity “Run command on Virtual Machine”. 

ActLogAlert.PNG

Now that these alerts are configured in portal,  let's learn how we can see them in SCOM.

Configure Azure MP in SCOM

We will import pack and connect to Azure subscription via Administration tab in SCOM console.

Under Authoring-> Add Monitoring Wizard we will select Service Types as scheduledqueryrules and activitylogalerts for monitoring. and complete the wizard and we are done.

ServiceTypes.PNG

Under Monitoring tab -> Microsoft Azure -> Service State, we can see alerts we had configured in Azure. The name also contains the type which helps to easily  identify the type of alert from the name itself.

AlertsSQR.PNG

 
 
For additional details about the alert in terms of subscription, resource group, threshold values, alert description is updated like below. 
Same as any other alert you can integrate this alert with your ticketing system.
 
SQR and Activity Log alerts are implemented as monitor based alerts in SCOM. As you can see from “Number of raised alerts” in Alert description, there are 11 alerts in portal while in SCOM we only see one alert. This is implemented to reduce alert noise in SCOM. 
 
Please note that you cannot close alerts from SCOM in Azure portal. While any alert which will be closed or disabled in portal will be reflected in SCOM.
 
SQRDescr.PNG
 
You can use HTML5 dashboard and create Alert widgets to see all these alerts in web console. is also capable of bringing Performance metrics for the service types for which monitoring is enabled. You can view perf metrics as well as configure SCOM alerts on this performance metrics in SCOM. We can discuss this in the next post.
 
As always, we look forward to hear back from you about your experience with Azure Management pack. Please leave your comments or reach out through SCOM user voice.
 
Hope this article helps.
 
Thanks,
Neha

 

This article was originally published by Microsoft's ITOps Talk Blog. You can find the original article here.