{"id":19155,"date":"2018-03-08T19:04:00","date_gmt":"2018-03-08T19:04:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/premier_developer\/?p=19155"},"modified":"2019-03-01T10:18:09","modified_gmt":"2019-03-01T17:18:09","slug":"integrating-logic-apps-and-azure-monitor","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/premier-developer\/integrating-logic-apps-and-azure-monitor\/","title":{"rendered":"Integrating Logic Apps and Azure Monitor"},"content":{"rendered":"

In this post, App Dev Manager Jason Venema<\/a> walks us through a practical example using Logic Apps and Azure Monitor to track down who created a Virtual Machine.<\/p>\n

\n

Have you ever needed to quickly find out who created a specific virtual machine in one of your Azure subscriptions? If it hasn\u2019t happened yet, it probably will someday. Maybe your Cloud Ops team received an alert that the VM was low on disk space, or maybe it was flagged as being non-compliant. If that happens, you would probably want to contact the person who created the VM so you could inform them of the problem.<\/p>\n

\u201cNo problem,\u201d you think to yourself. \u201cI\u2019ll just check the Azure Portal. It\u2019s probably on the VM overview blade.\u201d<\/p>\n

\"\"<\/p>\n

\u201cHmm\u2026 I don\u2019t see it there. It must be in the properties blade.\u201d<\/p>\n

\"blade1\"<\/a><\/p>\n

Not there, either. What about PowerShell, you ask? Let me save you the trouble: It\u2019s not there, either.<\/p>\n

Alright, that\u2019s a little unexpected, but no worries! You can always go to the Azure Activity Logs. They contain logs for pretty much everything that happens in the Azure portal.<\/p>\n

\"clip_image006\"<\/a><\/p>\n

Sure enough, there it is. The problem is that the Activity logs, in addition to being somewhat slow and unwieldy to search through when you have a large number of subscriptions and users, only store events for the past 90 days. If your VM was created more than 90 days ago, you\u2019re out of luck \u2013 unless you happen to ship your Activity logs to blob storage, in which case you have an even more unwieldy search experience ahead of you.<\/p>\n

There has to be a better way! The good news is that, with a little bit of effort on our part, there is. In this post, I\u2019ll show you how to easily store the creation timestamp and email address of the creator of a VM as tags on the VM itself. My solution leverages Azure Monitor alerts and Logic Apps to create a no-code solution that can be easily extended to record and trigger actions for other important lifecycle events on your Azure resources.<\/p>\n

Step 1: Create an Activity Log alert using Azure Monitor<\/h3>\n

Have you heard of Azure Monitor<\/a>? It provides base-level metrics and diagnostic logs for nearly every service in Azure. It is also the place you go to find the Azure Activity Logs. Best of all, it\u2019s free!<\/p>\n

We\u2019re going to use Azure Monitor to quickly set up an alert that calls a Webhook, but other actions are available including email and SMS. Remember earlier when I said that VM creation and modification events are recorded in the Activity Logs? We\u2019re going to use those events as the trigger for calling a Webhook.<\/p>\n

The first step is to head over to Azure Monitor in the management portal and click on Alerts<\/b> in the menu.<\/p>\n

\"\"<\/p>\n

Click the Add activity log alert <\/b>button. This opens a dialog where you can fill in the details for the alert you want to create.<\/p>\n

\"\"<\/p>\n

The top set of fields are all for the alert itself. For example, \u201cResource Group\u201d is the resource group that the alert<\/i> should be placed in (not the resource group containing the resource you\u2019re alerting on<\/i>). Fill in the fields using values similar to those in the screenshot. The \u201cEvent Category\u201d should be \u201cAdministrative\u201d because that\u2019s the category that Create and Modify events fall under. For the operation name, choose \u201cCreate or Update Virtual Machine (virtualMachines)\u201d so you will only trigger alerts when a VM is created or updated.<\/p>\n

Now we need to configure an action to take when the alert is triggered. For this, we\u2019ll create an action group<\/i>. We\u2019ll be calling a webhook endpoint for our solution, but other options include sending an email or SMS. Select an Action Type of \u201cWebhook\u201d and edit the details. For now, we\u2019ll leave the URL blank, but we\u2019ll come back to this part later after we create our Logic App. Save the alert and we\u2019re ready to move on to the next step.<\/p>\n

\"clip_image012\"<\/a><\/p>\n

Step 2: Create the Logic App<\/h3>\n

Logic Apps are amazing. You can create workflows that respond to any of the numerous built-in triggers, with a vast array of out-of-the-box actions. We\u2019re going to create a Logic App that responds to our Activity Log alert webhook that we just created.<\/p>\n

First, navigate to the Logic Apps service in the Azure management portal (it might easier to open a new tab, so you can easily come back to your Activity Log alert later). Click the \u201cAdd\u201d button to create a new Logic App. This part is pretty straightforward, and all you really need to provide is the name and location for the app.<\/p>\n

\"\"<\/p>\n

After that\u2019s done, you will see the overview blade for your Logic App. Click the Edit <\/b>button in the toolbar to begin editing the app. This is where we\u2019ll add the triggers and actions. The first trigger we want to add is the \u201cWhen an HTTP request is received\u201d trigger, which will kick off the app when our activity log alert fires. The webhook uses a POST request to send a message body in JSON, and we need to paste the schema of that message into our action. Logic Apps will generate the schema for you if you click the \u201cUse sample payload to generate schema\u201d button and paste in a sample JSON payload. For our Activity Log alert, you can get a sample payload by adding an additional Webhook to the alert and pointing it to a service like RequestBin<\/a>. Once you have the sample payload, paste it into the Logic App and click OK<\/b>.<\/p>\n

\"clip_image015\"<\/a><\/p>\n

Here\u2019s a simplified version of the JSON payload that the activity log alert sends, with some of the non-relevant fields removed. For the purposes of tagging our VM, we are most interested in the highlighted fields:<\/p>\n

{  \r\n   \"schemaId\": \"Microsoft.Insights\/activityLogs\",\r\n   \"data\": {\r\n      \"status\": \"Activated\",\r\n      \"context\": {\r\n         \"activityLog\": {\r\n            \"channels\": \"Operation\",\r\n            \"caller\": email_address@microsoft.com,\r\n            \"eventSource\": \"Administrative\",\r\n            \"eventTimestamp\": \"2018-01-23T15:03:53.121842+00:00\",\r\n            \"operationName\": \"Microsoft.Compute\/virtualMachines\/write\",\r\n            \"resourceId\": \"\/subscriptions\/a763e64b-7e94-4c23-9479-30a6e258a7a3\/resourcegroups\/TestRG3\/providers\/Microsoft.Compute\/virtualMachines\/jvwebvm09\",\r\n            \"resourceGroupName\": \"TestRG3\",\r\n            \"resourceProviderName\": \"Microsoft.Compute\",\r\n            \"status\": \"Accepted\",\r\n            \"subStatus\": \"Created\",\r\n            \"subscriptionId\": \"a763e64b-7e94-4c23-9479-30a6e258a7a3\",\r\n            \"resourceType\": \"Microsoft.Compute\/virtualMachines\"\r\n         }\r\n      }\r\n   }\r\n}\r\n<\/pre>\n
At this point, we need to grab the HTTP POST URL <\/b>from the top of the trigger dialog and paste it into our Activity Log Webhook (hopefully you still have that open in another browser tab). You can copy the URL from the top of the HTTP request action dialog. This is what allows our alert to kick off the Logic App when a new VM is created or update.<\/p>\n
Now our Logic App will trigger every time a new VM is created or updated, but it won\u2019t actually do anything<\/i> until we add some actions. First, though, let\u2019s add a condition to make sure that the event was actually for a VM create \u2013 we don\u2019t care about VM updates, but the alert will trigger for both creates and updates. To differentiate, we\u2019ll look at the value of the subStatus <\/b>field in the JSON payload. Logic Apps makes it easy to examine the value of a field from a previous step using the Dynamic Content selector.<\/p>\n
\"\"<\/p>\n
Now the app will only perform an action if our subStatus is equal to the string literal \u201cCreated\u201d. If it is, then we want to take a few actions. We\u2019ll add the following 4 actions that are based on the Azure Resource Manager connector<\/a> to our \u201cIf true\u201d block in order to apply the tag to the new VM:<\/p>\n
\"table1\"<\/a><\/p>\n
When all 4 of these actions have been added, the \u201cIf True\u201d block of our condition should look like this (Note that I renamed my actions to the titles you see in the title bars, to make them easier to tell apart when I was debugging later):<\/p>\n
\"\"<\/p>\n
The \u201cAdd createdBy tag\u201d and \u201cAdd createdDate tag\u201d actions are straightforward to configure. Let\u2019s look at the \u201cRead a resource\u201d action.<\/p>\n
\"clip_image019\"<\/a><\/p>\n
There are a few more fields to fill in here, but they can all be filled easily using Dynamic Content from previous steps. Specifically, the \u201cresourceGroupName\u201d and \u201cresourceProviderName\u201d values both come from the JSON payload that was received in the HTTP request trigger. The \u201cx-ms-api-version\u201d value is a string literal that represents the latest API version.<\/p>\n
The tricky part was getting the Short Resource Id<\/b>. This required some string parsing, since the JSON provides the \u201cresourceId\u201d but not \u201cShort Resource Id\u201d. A \u201cShort Resource ID\u201d is basically just the last 2 forward-slash-delimited values in the \u201cresourceId\u201d. See the highlighted section below.<\/p>\n
\"resourceId\": \"\/subscriptions\/a763e64b-7e94-4c23-9479-30a6e258a7a3\/resourcegroups\/TestRG3\/providers\/Microsoft.Compute\/virtualMachines\/jvwebvm09\"<\/pre>\n
Thankfully, Logic Apps have several built-in string parsing functions and I managed to work out just the bit I needed using the following (somewhat complicated) expression:<\/p>\n
\"clip_image021\"<\/a><\/p>\n
substring(triggerBody()?['data']?['context']?['activityLog']?['resourceId'],indexOf(triggerBody()?['data']?['context']?['activityLog']?['resourceId'],'virtualMachines\/'),sub(length(triggerBody()?['data']?['context']?['activityLog']?['resourceId']),add(96,length(triggerBody()?['data']?['context']?['activityLog']?['resourceGroupName']))))<\/pre>\n
I know I said it was no-code, and I stand by that. The Expression editor in the Logic App designer made this pretty easy to write.<\/p>\n
You might be wondering why we need the \u201cRead a resource\u201d action at all, since we already have a lot of data from the alert JSON payload. The whole purpose of adding this action is to get the location (Azure region) of the newly created VM, which we need in the next action.<\/p>\n
In the next and final action, we are going to update the \u201ccreatedBy\u201d and \u201ccreatedDate\u201d tags.<\/p>\n
\"\"<\/p>\n
The properties for this action are similar to the previous action (including the complicated \u201cShort Resource Id\u201d expression). The difference is that this action includes a required \u201cLocation\u201d field, which we can populate from the previous action\u2019s output.<\/p>\n
We also need to set the names and values of the tags we want to set on the VM. These are specified with a bit of JSON in the \u201cTags\u201d field. We can use the value of the \u201ccaller\u201d field from the Activity Log alert JSON payload for the \u201ccreatedBy\u201d tag, and the value of the \u201ceventTimestamp\u201d field for the \u201ccreatedDate\u201d field. I decided to format<\/a> my \u201ccreatedDate\u201d field using the expression below so it\u2019s a little easier to read in the tag.<\/p>\n
formatDateTime(triggerBody()?['data']?['context']?['activityLog']?['eventTimestamp'],'g')<\/pre>\n
Completed Logic App<\/h3>\n
The completed Logic App should look like this:<\/p>\n
\"clip_image024\"<\/a><\/p>\n
Click the \u201cSave\u201d button and now we are ready to test it out. Navigate to the Virtual Machine blade in Azure and create a new VM \u2013 you can configure the VM however you like. Once the creation is complete, the overview blade for your Logic App should show a few successful runs in the \u201cRuns History\u201d pane.<\/p>\n
\"clip_image025\"<\/a><\/p>\n
If you happen to see any errors in this pane, you can click on them to see the raw inputs and output of each step in your Logic App, along with error messages. The debugging experience is seriously fantastic.<\/p>\n
Assuming your runs were a success, let\u2019s check the tags for our new VM.<\/p>\n
\"clip_image027\"<\/a><\/p>\n
Success! You will never have to wonder who created a VM (and when) again.<\/p>\n
This example may have been simplistic, but the principles apply to more complex scenarios, as well. You can probably imagine several other ways to leverage both Azure Activity Log alerts and Logic Apps to create simple no-code solutions in Azure.<\/p>\n
\n
Premier Support for Developers<\/strong><\/a> provides strategic technology guidance, critical support coverage, and a range of essential services to help teams optimize development lifecycles and improve software quality.\u00a0 Contact your Application Development Manager (ADM) or email us<\/b><\/a> to learn more about what we can do for you.<\/p>\n
\n","protected":false},"excerpt":{"rendered":"
In this post, App Dev Manager Jason Venema walks us through a practical example using Logic Apps and Azure Monitor to track down who created a Virtual Machine. Have you ever needed to quickly find out who created a specific virtual machine in one of your Azure subscriptions? If it hasn\u2019t happened yet, it probably […]<\/p>\n","protected":false},"author":582,"featured_media":37840,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[25],"tags":[24,59,60,3],"class_list":["post-19155","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-azure-monitor","tag-logic-apps","tag-team"],"acf":[],"blog_post_summary":"
In this post, App Dev Manager Jason Venema walks us through a practical example using Logic Apps and Azure Monitor to track down who created a Virtual Machine. Have you ever needed to quickly find out who created a specific virtual machine in one of your Azure subscriptions? If it hasn\u2019t happened yet, it probably […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/19155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/users\/582"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/comments?post=19155"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/19155\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media\/37840"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media?parent=19155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/categories?post=19155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/tags?post=19155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}