Configure the Azure LAM

The Azure LAM is an endpoint for webhook notifications from Microsoft Azure Monitor alerts. The LAM parses the JSON events from Azure into Moogsoft Onprem events.

You can install a basic Azure Monitor integration in the UI. See Azure for integration steps. Configure the Azure Monitor LAM if you want to configure custom properties, set up high availability or configure advanced options that are not available in the UI integration.

Before You Begin

The Azure integration has been validated with Microsoft Azure Monitor v. 2018. Before you configure the Azure Monitor LAM, ensure you have met the following requirements:

You have an active Microsoft Azure account.
You know how to configure alerts in Microsoft Azure Monitor, including how to define a webhook notification.
Your Azure resource can make requests to external endpoints over port 443.

If you are configuring a distributed deployment refer to High Availability Overview first. You will need the details of the server configuration you are going to use for HA.

Configure the LAM

Edit the configuration file to control the behavior of the Azure LAM. You can find the file at $MOOGSOFT_HOME/config/azure_lam.conf.

The Azure LAM is a REST-based LAM as it provides an HTTP endpoint for data ingestion. Note that only the generic REST LAM properties in azure_lam.conf apply to the Azure LAM; see the LAM and Integration Reference for a full description of all properties.

Some properties in the file are commented out by default. Uncomment properties to enable them.

Configure the properties for the REST connection:
- port: Port on the Moogsoft Onprem server that listens for Azure Monitor messages. Defaults to 48020.
- address: Address on the Moogsoft Onprem server that listens for REST messages. Defaults to all interfaces.
Configure the SSL properties if you want to encrypt communications between the LAM and the REST connection:
- use_ssl: Whether to use SSL certification.
- path_to_ssl_files: Path to the directory that contains the SSL certificates.
- ssl_key_filename: The SSL server key file.
- ssl_cert_filename: The SSL root CA file.
- ssl_protocols: Sets the allowed SSL protocols.
Configure the LAM behavior:
- num_threads: Number of worker threads to use when processing events.
- rest_response_mode: When to send a REST response. See the LAM and Integration Reference for the options.
- rpc_response_timeout: Number of seconds to wait for a REST response.
- event_ack_mode: When Moogfarmd acknowledges events from the REST LAM during the event processing pipeline.
- accept_all_json: Allows the LAM to read and process all forms of JSON.
- lists_contain_multiple_events: Whether Moogsoft Onprem interprets a JSON list as multiple events.
Optionally configure the LAM identification and capture logging details:
- name: Maps to $Laminstancename, so that the agent field indicates events Moogsoft Onprem ingests from this LAM.
- capture_log: Name and location of the LAM's capture log file, which it writes to for debugging purposes.
Optionally configure severity conversions. See Severity Reference for further information and "Conversion Rules" in Tokenize Source Event Data for details on conversions in general.
Optionally configure the process logging details:
- configuration_file: Name and location of the LAM's process log configuration file. See Configure Logging for more information.Configure Logging

Unsupported Properties

Windows Azure Monitor alerts do not support client authentication. Do not uncomment or change the following properties:

use_client_certificates
client_ca_filename
auth_token or encrypted_auth_token
header_auth_token or encrypted_header_auth_token
authentication_type
authentication_cache

Example

The following example demonstrates an Azure LAM configuration.

monitor:
{
    name                          : "Azure LAM",
    class                         : "CRestMonitor",
    port                          : 48018,
    address                       : "0.0.0.0",
    use_ssl                       : false,
    #path_to_ssl_files            : "config",
    #ssl_key_filename             : "server.key",
    #ssl_cert_filename            : "server.pem",
    #use_client_certificates      : false,
    #client_ca_filename           : "ca.crt",
    #auth_token                   : "my_secret",
    #encrypted_auth_token         : "dfJtTQMGiFHfiq7sCmxguBt6Jv+eytkoiKCquSB/7iWxpgGsG2aez3z2j7SuBtKj",
    #header_auth_token            : "my_secret",
    #encrypted_header_auth_token  : "dfJtTQMGiFHfiq7sCmxguBt6Jv+eytkoiKCquSB/7iWxpgGsG2aez3z2j7SuBtKj",
    #ssl_protocols                : "TLSv1.2"
    authentication_type           : "none",
    authentication_cache          : true,
    accept_all_json               : true,
    lists_contain_multiple_events : true,
    num_threads                   : 5,
    rest_response_mode            : "on_receipt",
    rpc_response_timeout          : 20,
    event_ack_mode                : "queued_for_processing"
},
agent:
{
    name                          : "Azure",
    capture_log                   : "$MOOGSOFT_HOME/log/data-capture/azure_lam.log"
},
log_config:
{
    configuration_file            : "$MOOGSOFT_HOME/config/logging/azure_lam_log.json"
},

Configure for High Availability

Configure the Azure Monitor LAM for high availability if required. See High Availability Overviewfor details.High Availability Overview

Configure LAMbot Processing

The Azure LAMbot processes and filters events before sending them to the Message Bus. You can customize or bypass this processing if required. You can also load JavaScript files into the LAMbot and execute them.

See LAMbot Configuration for more information. An example Azure LAM filter configuration is shown below:

filter:
{       
    presend: "AzureLam.js",
    modules: [ "CommonUtils.js" ]
}

Map LAM Properties

By default the following Azure Monitor event properties map to the following Moogsoft Onprem Azure Monitor LAM properties. You can configure custom mappings in the Azure Monitor LAMbot.

Azure Monitor Event Property	Azure Monitor LAM Event Property
`context.resourceGroupName::context.resourceType:` `:context.resourceName::context.name`	`signature`
`context.resourceId`	`source_id`
`context.id`	`external_id`
`context.resourceGroupName`	`manager`
`context.resourceName`	`source`
`context.resourceType`	`class`
`Azure LAM`	`agent`
`context.conditionType`	`type`
`2`	`severity`
`context.name - context.description`	`description`
`context.timestamp`	`agent_time`

The overflow properties are mapped to "custom info" and appear under Overflow in Moogsoft Onprem alerts:

Azure Monitor Event Property	Azure Monitor LAM Monitor Property
data	`eventDetails.data`
`schemaid`	`eventDetails.schemaid`

Start and Stop the LAM

Restart the Azure Monitor LAM to activate any changes you make to the configuration file or LAMbot.

The LAM service name is azurelamd.

See Control Moogsoft Onprem Processes for the commands to start, stop and restart the LAM.

You can use a GET request to check the status of the Azure Monitor LAM. See "Check the LAM Status" in Configure the REST LAM for further information and examples.

Configure Azure

After you have the Azure Monitor LAM running and listening for incoming requests, you can configure a webhook in Azure. See "Configure Azure" in Azure.

In this section: