AzureVMで死活監視を実装してみた（DCRとAzure Monitor アラート）

 # ID情報取得コマンドの例
$ws_info = az monitor log-analytics workspace show -g $rg_name -n $ws_name | ConvertFrom-Json
$ws_rid = $ws_info.id  ## →　workspaceResourceId
$ws_id = $ws_info.customerId  ## →　workspaceId

{
    "properties": {
        "dataSources": {
            "windowsEventLogs": [
                {
                    "streams": [
                        "Microsoft-Event"
                    ],
                    "xPathQueries": [
                        "Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]",
                        "Security!*[System[(band(Keywords,13510798882111488))]]",
                        "System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]"
                    ],
                    "name": "eventLogsDataSource"
                }
            ]
        },
        "destinations": {
            "logAnalytics": [
                {
                    "workspaceResourceId": "＜ワークスペースのリソースID＞",
                    "workspaceId": "＜ワークスペースID＞",
                    "name": "LogAnalytics"
                }
            ]
        },
        "dataFlows": [
            {
                "streams": [
                    "Microsoft-Event"
                ],
                "destinations": [
                    "LogAnalytics"
                ],
                "transformKql": "source",
                "outputStream": "Microsoft-Event"
            }
        ]
    }
}

 # パラメータの定義
$dcr_name = "test-dcr"
$association_name = "test_as"
$file_path = "＜JSONファイルのパス＞"

 #DCRの作成 
az monitor data-collection rule create `
 -g $rg_name `
 --location "japaneast" `
 --name $dcr_name `
 --rule-file $file_path

 # DCRのID取得（DCR作成後）
$dcr_info = az monitor data-collection rule show -g $rg_name -n $dcr_name | ConvertFrom-Json
$dcr_id = $dcr_info.id

 # VMのID取得
$vm_name = "VM-Test-Windows"
$vm_info = az vm show -g $rg_name -n $vm_name | ConvertFrom-Json
$vm_id = $vm_info.id

 # DCRの関連付け
az monitor data-collection rule association create `
 -n $association_name `
 --resource $vm_id `
 --rule-id $dcr_id

 # VMに対して拡張機能のインストール
az vm extension set `
 --subscription TestSub02 `
 --resource-group $rg_name `
 --vm-name $vm_name `
 --name AzureMonitorWindowsAgent `
 --publisher Microsoft.Azure.Monitor

$ws_info = az monitor log-analytics workspace show -g $rg_name -n $ws_name | ConvertFrom-Json
$ws_id = $ws_info.customerId

 # クエリ実行コマンド 
$result = az monitor log-analytics query -w $ws_id  --analytics-query "Heartbeat | where TimeGenerated >= ago(30m)" | ConvertFrom-Json
$result | Format-Table -Property TimeGenerated, Computer

PS C:\> $result = az monitor log-analytics query -w $ws_id  --analytics-query "Heartbeat | where TimeGenerated >= ago(30m)" | ConvertFrom-Json
PS C:\> $result | Format-Table -Property TimeGenerated, Computer

TimeGenerated                Computer
-------------                --------
2025-08-26T07:01:08.6538434Z VM-Test-Windows
2025-08-26T07:02:08.6606775Z VM-Test-Windows
2025-08-26T07:00:08.6441802Z VM-Test-Windows
2025-08-26T07:03:08.6689546Z VM-Test-Windows
2025-08-26T07:04:08.6770638Z VM-Test-Windows
2025-08-26T07:05:08.6933919Z VM-Test-Windows


PS C:\>

 # パラメータの定義
$rg_name = "RG-Test-VM"
$ws_name = "Test-la"
$ws_info = az monitor log-analytics workspace show -g $rg_name -n $ws_name | ConvertFrom-Json
$ws_rid = $ws_info.id
$actiong_name = "testactiongroup"
$condition = "count 'result' > 0"
$email = "hogehoge@hogehoge.com"
$alert_name = "AliveMonitoring"

 # アクショングループの作成
az monitor action-group create `
 -n $actiong_name `
 -g $rg_name `
 --action email admin $email

 # アクショングループのリソースID取得
$ag_info = az monitor action-group show -n $actiong_name -g $rg_name | ConvertFrom-Json
$ag_id = $ag_info.id

 # アラートの作成
az monitor scheduled-query create `
    --name $alert_name `
    --resource-group $rg_name `
    --scopes $ws_id `
    --action-groups $ag_id `
    --window-size 60m `
    --evaluation-frequency 5m `
    --severity 0 `
    --condition $condition `
    --condition-query result="Heartbeat | where Computer == 'VM-Test-Windows' | extend JapanTimeStamp = TimeGenerated + 9h | summarize Lastcall = max(JapanTimeStamp) by Computer | where Lastcall <= (ago(15m) + 9h)"

 # パラメータの定義
$rg_name = "RG-Test-VM"
$nsg1_name = "NSG-Test-Windows"
$nsgrule_name_monitor = "AllowToAzureMonitorOutBound"
$nsgrule_name_ARM = "AllowToAzureResourceManagerOutBound"

 # NSGのルール追加（サービスタグ）
az network nsg rule create `
 -g $rg_name `
 --nsg-name $nsg1_name `
 -n $nsgrule_name_monitor `
 --destination-address-prefixes "AzureMonitor" `
 --destination-port-range "*" `
 --direction "Outbound" `
 --priority 300

az network nsg rule create `
 -g $rg_name `
 --nsg-name $nsg1_name `
 -n $nsgrule_name_ARM `
 --destination-address-prefixes "AzureResourceManager" `
 --destination-port-range "*" `
 --direction "Outbound" `
 --priority 310