Port monitoring in Azure Monitor

Simran Kaur Deol 41

Hi everyone,

I'm new to Azure and need some expert suggestions on the challenge that I'm facing.

I'm working towards migrating from an existing monitoring tool to Azure monitor in order to track different KPIs (such as URLs, Ports, DB) of our servers in one place. Currently, I wanted to monitor all ports of VMs, check their status, give out alerts in case a port is not responding but couldn't really find a way to do that.

Please let me know if there's a way to do it.

AnuragSingh-MSFT 19,686 Reputation points

2022-05-05T11:31:45.973+00:00

@Simran Kaur Deol , Following up to check if you had a chance to review the answer below by Alistair. Please let us know if you have any queries or concerns.

Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.

Accepted answer

Alistair Ross 7,101 Reputation points Microsoft Employee

2022-05-03T10:15:22.223+00:00

Ho @Simran Kaur Deol

Azure Monitor for Virtual Machines will monitor local ports on a VM from within the OS, monitoring inbound and outbound traffic.

Depending on your need you can use Application Insights URL ping tests, Standard tests, or Connection monitor for URL monitoring.

SQL insights can be used for monitoring SQL databases on VM's as well.

All of this can be alerted on in using Log Alerts, though some (like connection monitor and the URL tests) build the alerts as part of the deployment wizard.
Please sign in to rate this answer.

1 person found this answer helpful.
Simran Kaur Deol 41 Reputation points

2022-05-04T06:30:26.03+00:00

Hi @Alistair Ross

Thanks for the response.

From what I've understood we can setup a query, which will fetch data for the inbound/outbound or we can setup a workbook for open/active ports.

But I couldn't find a way to set alerts on these options. In alerts section of VM, options of inbound, outbound and so are available, not of ports.

Please let me know if I'm missing something?

Alistair Ross 7,101 Reputation points Microsoft Employee

2022-05-04T08:55:28.463+00:00

Hi @Simran Kaur Deol

If you are using Azure Monitor for Virtual machines, you can write a simple (or complex) query like below:

VMConnection | where Direction == "outbound" | where ProcessName == "MonitoringHost" | where DestinationPort in (443, 80) | where LinksFailed > 0

This would return any failures within the specified time period for outbound connections from the process "MonitoringHost". I've added the DestinationPort, but you can remove this and it will capture all ports used by this process.

To create an alert, there is a "New alert rule" button from the logs view. Full details on creating and managing these alerts can be found here https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log.

On the topic of creating workbooks, this solution comes with some great out of the box workbooks for analyzing and drill down through this data.

Simran Kaur Deol 41 Reputation points

2022-05-09T08:01:32.403+00:00

Hi @Alistair Ross

Thanks for helping with the issue. I tried implementing the code that you mentioned but I get the following error.

Do let me know if there's a workaround to this. Thanks in advance.

Alistair Ross 7,101 Reputation points Microsoft Employee

2022-05-09T09:14:30.42+00:00

@Simran Kaur Deol . You haven't used my example KQL, but have used another table instead, which has a different schema. You can find the different schemas for most managed tables in Log Analytics here https://learn.microsoft.com/en-gb/azure/azure-monitor/reference/

Furthermore, if you are having issues with troubleshooting a KQL query, may I suggest Rod Trents Must Learn KQL

kind regards

Alistair

Simran Kaur Deol 41 Reputation points

2022-05-09T10:26:05.76+00:00

Thanks @Alistair Ross , this really helped.
Sign in to comment

2 additional answers

Faisal Khalid 1 Reputation point

2022-07-20T12:14:57.573+00:00

How do I monitor if inbound port on nsg is set to allow it could be rdp 3389 etc.
Please sign in to rate this answer.
Alistair Ross 7,101 Reputation points Microsoft Employee

2022-07-20T12:17:11.923+00:00

@Faisal Khalid , please raise this as a separate question
Sign in to comment
Maxim Sergeev 6,566 Reputation points Microsoft Employee

2022-07-20T17:44:44.9+00:00

Actually, Azure Monitor with Network Watcher Connection Monitor could monitor ports and URLs by using Azure Network Extension on Azure VM machines. Including external addresses\ports and internal (based on VNET) endpoints. See the doc https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview
Please sign in to rate this answer.
Pavel yannara Mirochnitchenko 11,626 Reputation points

2024-02-27T06:51:25.37+00:00

@Maxim Sergeev is Azure Monitor really required for Network Watcher, or can NW be deployed without Azure Monitor? Reading articles I get an idea those are different objects doing different things? Keen to hear your answer, thanks :)

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2024-02-27T07:13:01.4633333+00:00

@Pavel yannara Mirochnitchenko Log Analytics (part of Azure Monitor) is required for storing connection monitor telemetry https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview?WT.mc_id=Portal-Microsoft_Azure_FlowLog#data-collection-analysis-and-alerts

Maxim Sergeev 6,566 Reputation points Microsoft Employee

2024-02-27T07:13:57.6+00:00

Log Analytics (part of Azure Monitior) is required for storing connection monitor telemetry. https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview?WT.mc_id=Portal-Microsoft_Azure_FlowLog#data-collection-analysis-and-alerts
Sign in to comment