| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| api-management | Api Management Howto Use Azure Monitor | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/api-management/api-management-howto-use-azure-monitor.md | In this tutorial, you learn how to: ## View metrics of your APIs -API Management emits [metrics](/azure/azure-monitor/essentials/data-platform-metrics) every minute, giving you near real-time visibility into the state and health of your APIs. The following are the most frequently used metrics. For a list of all available metrics, see [supported metrics](/azure/azure-monitor/essentials/metrics-supported#microsoftapimanagementservice). +API Management emits [metrics](/azure/azure-monitor/essentials/data-platform-metrics) every minute, giving you near real-time visibility into the state and health of your APIs. The following are the most frequently used metrics. For a list of all available metrics, see [supported metrics](/azure/azure-monitor/reference/supported-metrics/microsoft-apimanagement-service-metrics). * **Capacity** - helps you make decisions about upgrading/downgrading your API Management services. The metric is emitted per minute and reflects the estimated gateway capacity at the time of reporting. The metric ranges from 0-100 calculated based on gateway resources such as CPU and memory utilization and other factors. > [!TIP]- > In the [v2 service tiers](v2-service-tiers-overview.md), API Management replaced the capacity metric with separate CPU and memory utilization metrics. These metrics can also be used for scaling decisions and troubleshooting. [Learn more](api-management-capacity.md) + > In the [v2 service tiers](v2-service-tiers-overview.md), API Management has replaced the capacity metric with separate CPU and memory utilization metrics. These metrics can also be used for scaling decisions and troubleshooting. [Learn more](api-management-capacity.md) * **Requests** - helps you analyze API traffic going through your API Management services. The metric is emitted per minute and reports the number of gateway requests with dimensions. Filter requests by response codes, location, hostname, and errors. > [!IMPORTANT]-> The following metrics have been retired: Total Gateway Requests, Successful Gateway Requests, Unauthorized Gateway Requests, Failed Gateway Requests, Other Gateway Requests. Please migrate to the Requests metric which provides equivalent functionality. +> The following metrics have been retired: Total Gateway Requests, Successful Gateway Requests, Unauthorized Gateway Requests, Failed Gateway Requests, Other Gateway Requests. Please migrate to the Requests metric which provides closely similar functionality. :::image type="content" source="media/api-management-howto-use-azure-monitor/apim-monitor-metrics-1.png" alt-text="Screenshot of Metrics in API Management Overview"::: To access metrics: 1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance. On the **Overview** page, on the **Monitor** tab, review key metrics for your APIs.-1. To investigate metrics in detail, select **Metrics** from the left menu. +1. To investigate metrics in detail, select **Monitoring** > **Metrics** from the left menu. :::image type="content" source="media/api-management-howto-use-azure-monitor/api-management-metrics-blade.png" alt-text="Screenshot of Metrics item in Monitoring menu in the portal."::: You can receive [alerts](/azure/azure-monitor/alerts/alerts-metric-overview) bas To configure an example alert rule based on a request metric: 1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.-1. Select **Alerts** from the left menu. +1. Select **Monitoring** > **Alerts** from the left menu. :::image type="content" source="media/api-management-howto-use-azure-monitor/alert-menu-item.png" alt-text="Screenshot of Alerts option in Monitoring menu in the portal."::: 1. Select **+ Create** > **Alert rule**.-1. In the **Select a signal** window on the **Condition** tab: - 1. In **Signal type**, select **Metrics**. +1. On the **Condition** tab: 1. In **Signal name**, select **Requests**.- 1. In **Alert logic**, specify a **Threshold value**, which is the number of occurrences after which the alert should be triggered. + 1. In **Alert logic**, review or modify the default values for the alert. For example, update the static **Threshold**, which is the number of occurrences after which the alert should be triggered. 1. In **Split by dimensions**, in **Dimension name**, select **Gateway Response Code Category**. 1. In **Dimension values**, select **4xx**, for client errors such as unauthorized or invalid requests. If the dimension value doesn't appear, select **Add custom value** and enter **4xx**. 1. In **When to evaluate**, accept the default settings, or select other settings to configure how often the rule runs. Select **Next**. To configure an example alert rule based on a request metric: 1. On the **Details** tab of **Create an alert rule**, enter a name and description of the alert rule and select the severity level. 1. Optionally configure the remaining settings. Then, on the **Review + create** tab, select **Create**.-1. Now, test the alert rule by calling the Conference API without an API key. For example: +1. Optionally test the alert rule by using an HTTP client to simulate a request that triggers the alert. For example, run the following command in a terminal, substituting the API Management hostname with the hostname of your API Management instance: ```bash- curl GET https://apim-hello-world.azure-api.net/conference/speakers HTTP/1.1 + curl GET https://contoso.azure-api.net/non-existent-endpoint HTTP/1.1 ``` - An alert triggers based on the evaluation period, and it will send email to admin@contoso.com. + An alert triggers based on the evaluation period, and it will send email to admin@contoso.com. Alerts also appear on the **Alerts** page for the API Management instance. To configure an example alert rule based on a request metric: Activity logs provide insight into the operations on your API Management services. Using activity logs, you can determine the "what, who, and when" for any write operations (PUT, POST, DELETE) taken on your API Management services. > [!NOTE]-> Activity logs do not include read (GET) operations or operations performed in the Azure portal or using the original Management APIs. +> Activity logs do not include read (GET) operations or operations performed in the Azure portal. You can access activity logs in your API Management service, or access logs of all your Azure resources in Azure Monitor. Resource logs (Azure Monitor logs) provide rich information about API Management To configure resource logs: 1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.-2. Select **Diagnostic settings**. +2. Select **Monitoring** > **Diagnostic settings**. :::image type="content" source="media/api-management-howto-use-azure-monitor/api-management-diagnostic-logs-blade.png" alt-text="Screenshot of Diagnostic settings item in Monitoring menu in the portal."::: To configure resource logs: For more information, see [Create diagnostic settings to send platform logs and metrics to different destinations](/azure/azure-monitor/essentials/diagnostic-settings). -## View diagnostic data in Azure Monitor +## View logs and metrics in Azure Monitor If you enable collection of logs or metrics in a Log Analytics workspace, it can take a few minutes for data to appear in Azure Monitor. To view the data: For more information about using resource logs for API Management, see: -* [Log Analytics tutorial](/azure/azure-monitor/logs/log-analytics-tutorial), or try the [Log Analytics demo environment](https://ms.portal.azure.com/#view/Microsoft_OperationsManagementSuite_Workspace/LogsDemo.ReactView). +* [Log Analytics tutorial](/azure/azure-monitor/logs/log-analytics-tutorial). * [Overview of log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview). For details about the logging settings, see [Diagnostic logging settings referen To configure logging settings for all APIs: -1. In the left menu of your API Management instance, select **APIs** > **All APIs**. +1. In the left menu of your API Management instance, select **APIs** > **APIs** > **All APIs**. 1. Select the **Settings** tab from the top bar. 1. Scroll down to the **Diagnostic Logs** section, and select the **Azure Monitor** tab. 1. Review the settings and make changes if needed. Select **Save**. To configure logging settings for a specific API: -1. In the left menu of your API Management instance, select **APIs** and then the name of the API. +1. In the left menu of your API Management instance, select **APIs** > **APIs** and then the name of the API. 1. Select the **Settings** tab from the top bar. 1. Scroll down to the **Diagnostic Logs** section, and select the **Azure Monitor** tab. 1. Review the settings and make changes if needed. Select **Save**. |
| app-service | App Service Web Configure Tls Mutual Auth | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/app-service-web-configure-tls-mutual-auth.md | +> Your app code is responsible for validating the client certificate. App Service doesn't do anything with this client certificate other than forwarding it to your app. +> > If you access your site over HTTP and not HTTPS, you will not receive any client certificate. So if your application requires client certificates, you should not allow requests to your application over HTTP.-> [!INCLUDE [Prepare your web app](../../includes/app-service-ssl-prepare-app.md)] To set up your app to require client certificates: 1. From the left navigation of your app's management page, select **Configuration** > **General Settings**. -1. Set **Client certificate mode** to **Require**. Select **Save** at the top of the page. +1. Select **Client certificate mode** of choice. Select **Save** at the top of the page. ++|Client certificate modes|Description| +|-|-| +|Required|All requests require a client certificate.| +|Optional|Requests may or may not use a client certificate. Clients will be prompted for a certificate by default. For example, browser clients will show a prompt to select a certificate for authentication.| +|Optional Interactive User|Requests may or may not use a client certificate. Clients will not be prompted for a certificate by default. For example, browser clients will not show a prompt to select a certificate for authentication.| ### [Azure CLI](#tab/azurecli) To do the same with Azure CLI, run the following command in the [Cloud Shell](https://shell.azure.com): |
| app-service | Configure Ssl App Service Certificate | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/configure-ssl-app-service-certificate.md | Once your certificate is domain-verified, [you're ready to import it into an App By default, App Service certificates have a one-year validity period. Before the expiration date, you can automatically or manually renew App Service certificates in one-year increments. The renewal process effectively gives you a new App Service certificate with the expiration date extended to one year from the existing certificate's expiration date. > [!NOTE]-> Starting September 23 2021, if you haven't verified the domain in the last 395 days, App Service certificates require domain verification during a renew or rekey process. The new certificate order remains in "pending issuance" mode during the renew or rekey process until you complete the domain verification. +> Starting September 23 2021, if you haven't verified the domain in the last 395 days, App Service certificates require domain verification during a renew, auto-renew, or rekey process. The new certificate order remains in "pending issuance" mode during the renew, auto-renew, or rekey process until you complete the domain verification. > > Unlike the free App Service managed certificate, purchased App Service certificates don't have automated domain re-verification. Failure to verify domain ownership results in failed renewals. For more information about how to verify your App Service certificate, review [Confirm domain ownership](#confirm-domain-ownership). > Set-Content -Path appservicecertificate.pfx -Value $CertBytes -AsByteStream The downloaded PFX file is a raw PKCS12 file that contains both the public and private certificates and has an import password that's an empty string. You can locally install the file by leaving the password field empty. You can't [upload the file as-is into App Service](configure-ssl-certificate.md#upload-a-private-certificate) because the file isn't [password protected](configure-ssl-certificate.md#private-certificate-requirements). +## Use Azure Advisor for App Service certificate ++App Service certificate is integrated with [Azure Advisor](/azure/advisor/advisor-overview) to provide reliability recommendations for when your certificate requires domain verification. You must verify domain ownership for your certificate during renew, auto-renew, or rekey process if you haven't verified the domain in the last 395 days. To ensure you do not miss any certificate that requires verification or risk any certificate from expiring, you can utlize Azure Advisor to view and set up alerts for App Service certificate. ++### View Advisor recommendation ++To view Advisor recommendation for App Service certificate: ++1. Navigate to the [Azure Advisor page](https://portal.azure.com/#view/Microsoft_Azure_Expert/AdvisorMenuBlade/~/overview). ++1. From the left menu, select **Recommendations** > **Reliability** ++1. Select the filter option **Type equals** and search for **App Service Certificates** from the dropdown list. If the value does not exist on the dropdown menu, then that means no recommendation has been generated for your App Service certificate resources because none of them requires domain ownership verification. ++### Create Advisor Alerts ++You [create Azure Advisor alerts on new recommendations] using different configurations. To set up Advisor Alerts specifically for App Serivice certificate so you can get notifications when your certificate requires domain ownership validation: ++1. Navigate to the [Azure Advisor page](https://portal.azure.com/#view/Microsoft_Azure_Expert/AdvisorMenuBlade/~/overview). ++1. From the left menu, select **Monitoring** > **Alerts (Preview)** ++1. Click on **+ New Advisor Alert** on the action bar at the top. This will open a new blade called "Create Advisor Alerts". ++1. Under **Condition** select the following: ++ |Configured by| Recommendation Type| + |-|-| + |Recommendation Type|Domain verification required to issue your App Service Certificate| ++1. Fill out the rest of the required fields, then select the **Create alert** button at the bottom. + ## Delete an App Service certificate If you delete an App Service certificate, the delete operation is irreversible and final. The result is a revoked certificate, and any binding in App Service that uses the certificate becomes invalid. |
| avere-vfxt | Avere Vfxt Add Storage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/avere-vfxt/avere-vfxt-add-storage.md | Follow these steps to add a NAS core filer: 1. Click **Create**. -  - 1. Fill in the required information in the wizard: * Name your core filer. |
| avere-vfxt | Avere Vfxt Cluster Gui | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/avere-vfxt/avere-vfxt-cluster-gui.md | Depending on your browser, you might need to click **Advanced** and verify that Enter the username `admin` and the administrative password you provided when creating the cluster. - - Click **Login** or press enter on your keyboard. ## Next steps |
| avere-vfxt | Avere Vfxt Enable Support | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/avere-vfxt/avere-vfxt-enable-support.md | Follow these steps from the Avere Control Panel to activate support. (Read [Acce 1. Navigate to the **Settings** tab at the top. 1. Click the **Support** link on the left and accept the privacy policy.--  - 1. On the support configuration page, open the **Customer Info** section by clicking the triangle at the left. 1. Click the **Revalidate upload information** button. 1. Set the cluster's support name in **Unique Cluster Name**. Make sure this name uniquely identifies your cluster to support staff. |
| azure-resource-manager | Resources Without Resource Group Limit | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/management/resources-without-resource-group-limit.md | Some resources have a limit on the number instances per region. This limit is di ## Microsoft.Web * apiManagementAccounts/apis-* certificates * sites ## Next steps |
| azure-vmware | Configure Azure Vmware Solution Metrics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-vmware/configure-azure-vmware-solution-metrics.md | + + Title: Configure the latest iteration of Azure VMware Solution private cloud performance and health metrics +description: Learn how to take advantage of the latest improvements made to Azure VMware Solution private cloud performance and health metrics ++ Last updated : 10/09/2024+++#Customer intent: As an Azure service administrator, I want to collect key performance and reliability metrics from my Azure VMware Solution private cloud, so I can analyze for any diagnostic purposes. ++++# Configure the latest iteration of Azure VMware Solution private cloud performance and health metrics ++In this article, you learn how to take advantage of the latest iteration of metrics available to monitor your Azure VMware Solution private cloud. ++Azure VMware Solution provides users with an array of high-level health and performance metrics to provide visibility into the health and performance of an Azure VMware Solution private cloud. Since early 2024, another set of identical metrics labeled with the word "(new)" were introduced, where a series of enhancements to the stability, reliability, and performance of these metrics were made to provide users a better experience relative to the older set of metrics. + ++### View Azure VMware Solution metrics +From your Azure VMware Solution private cloud, select **Metrics** under the **Monitoring** section. Then under the **Metric** dropdown, choose a metric that contains the word "(new)". These newer metrics are powered by our improved metrics engine, providing utmost reliability and stability. The metrics monitor items like memory consumption, datastore usage, and CPU across your Azure VMware Solution private cloud. +++### Setting up a chart ++Select a metric you'd like to build a chart for, such as "Percentage CPU (new)" in this example. Upon doing so, you will see a chart like the one below showing a time series for the metric you've selected. +++You can toggle the time window you are interested in this metric for by simply selecting the time window button in the top-right corner. The default window for your selected metric will be **24 hours**. ++Once you are ready to save, click **Save to Dashboard** and select one of the options presented for where this metric will live. ++### Send metrics to other monitoring solutions using the new metrics ++Additionally, you can hover over each metric in the **Metric** dropdown to see the Metric ID. You can use this Metric ID in your third-party monitoring tools to monitor your Azure VMware Solution private cloud. + >[!IMPORTANT] + >We strongly encourage all users - first time and repeat - to migrate to the new metrics suffixed with **"(new)"**. ++For those who have used the metrics previously and have built monitoring in downstream tools and configurations that rely on the old metric IDs, the following table provides the corresponding newer metric IDs you can use for the same set of metrics to seamlessly transition to using the newer set of metrics: ++| Metric Name (as viewed in the portal) | Current Metric ID | New Metric ID | +| : | : | : | +| Datastore Disk Used | UsedLatest | DiskUsedLatest | +| Datastore Disk Total Capacity | CapacityLatest | CapacityLatest | +| Average Effective Memory | EffectiveMemAverage | ClusterSummaryEffectiveMemory | +| Average Total Memory | TotalMbAverage | ClusterSummaryTotalMemCapacityMB | +| Average Memory Overhead | OverheadAverage | MemOverheadAverage | +| Average Memory Usage | UsageAverage | MemUsageAverage | +| Percentage CPU | EffectiveCpuAverage | CpuUsageAverage | +| Percentage Datastore Disk Used | DiskUsedPercentage | DiskUsedPercentage | |
| bastion | Bastion Faq | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/bastion/bastion-faq.md | Yes. See [About VM connections and features](vm-about.md#audio). Azure Bastion offers support for file transfer between your target VM and local computer using Bastion and a native RDP or SSH client. At this time, you canΓÇÖt upload or download files using PowerShell or via the Azure portal. For more information, see [Upload and download files using the native client](vm-upload-download-native.md). -### <a name="aadj"></a>Does Bastion hardening work with AADJ VM extension-joined VMs? +### <a name="aadj"></a>Does Bastion work with Entra ID extension-joined VMs? -This feature doesn't work with AADJ VM extension-joined machines using Microsoft Entra users. For more information, see [Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID](../active-directory/devices/howto-vm-sign-in-azure-ad-windows.md#requirements). +Bastion does work with Entra ID extension-joined VMs for Microsoft Entra users with RDP and SSH on the native client, and SSH only on the portal. Entra ID for RDP on the portal is not yet supported. For more information, see [Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID](../active-directory/devices/howto-vm-sign-in-azure-ad-windows.md#requirements). ### <a name="rdscal-compatibility"></a>Is Bastion compatible with VMs set up as RDS session hosts? |
| communication-services | Service Limits | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/communication-services/concepts/service-limits.md | For more information, see the [identity concept overview](./authentication.md) p When sending or receiving a high volume of messages, you might receive a ```429``` error. This error indicates you're hitting the service limitations, and your messages are queued to be sent once the number of requests is below the threshold. -Rate Limits for SMS: +### Rate Limits for SMS |Operation|Number Type |Scope|Timeframe (s)| Limit (request #) | Message units per minute| |||--|-|-|-| For more information on the SMS SDK and service, see the [SMS SDK overview](./sm ## Email -You can send a limited number of email messages. If you exceed the following limits for your subscription, your requests are rejected. You can attempt these requests again, after the Retry-After time passes. Take action before reaching the limit by requesting to raise your sending volume limits if needed. +You can send a limited number of email messages. If you exceed the [email rate limits](#rate-limits-for-email) for your subscription, your requests are rejected. You can attempt these requests again, after the Retry-After time passes. Take action before reaching the limit by requesting to raise your sending volume limits if needed. -The Azure Communication Services email service is designed to support high throughput. However, the service imposes initial rate limits to help customers onboard smoothly and avoid some of the issues that can occur when switching to a new email service. We recommend gradually increasing your email volume using Azure Communication Services Email over a period of two to four weeks, while closely monitoring the delivery status of your emails. This gradual increase enables third-party email service providers to adapt to the change in IP for your domain's email traffic. The gradual change gives you time to protect your sender reputation and maintain the reliability of your email delivery. +The Azure Communication Services email service is designed to support high throughput. However, the service imposes initial rate limits to help customers onboard smoothly and avoid some of the issues that can occur when switching to a new email service. -We approve higher limits for customers based on use case requirements, domain reputation, traffic patterns, and failure rates. To request higher limits, follow the instructions at [Quota increase for email domains](./email/email-quota-increase.md). Higher quotas are only available for verified custom domains, not Azure-managed domains. +We recommend gradually increasing your email volume using Azure Communication Services Email over a period of two to four weeks, while closely monitoring the delivery status of your emails. This gradual increase enables third-party email service providers to adapt to the change in IP for your domain's email traffic. The gradual change gives you time to protect your sender reputation and maintain the reliability of your email delivery. -### Rate Limits +Azure Communication Services email service supports high volume up to 1-2 million messages per hour. High throughput can be enabled based on several factors, including: +- Customer peak traffic +- Business needs +- Ability to manage failure rates +- Domain reputation ++### Failure Rate Requirements ++To enable a high email quota, your email failure rate must be less than one percent (1%). If your failure rate is high, you must resolve the issues before requesting a quota increase. +Customers are expected to actively monitor their failure rates. ++If the failure rate increases after a quota increase, Azure Communication Services will contact the customer for immediate action and a resolution timeline. In extreme cases, if the failure rate isn't managed within the specified timeline, Azure Communication Services may reduce or suspend service until the issue is resolved. ++#### Related articles ++Azure Communication Services provides rich logs and analytics to help monitor and manage failure rates. For more information, see the following articles: ++- [Improve sender reputation in Azure Communication Services email](./email/sender-reputation-managed-suppression-list.md) +- [Email Insights](./analytics/insights/email-insights.md) +- [Enable logs via Diagnostic Settings in Azure Monitor](./analytics/enable-logging.md) +- [Quickstart: Handle Email events](../quickstarts/email/handle-email-events.md) +- [Quickstart: Manage domain suppression lists in Azure Communication Services using the management client libraries](../quickstarts/email/manage-suppression-list-management-sdks.md) ++> [!NOTE] +> To request higher limits, follow the instructions at [Quota increase for email domains](./email/email-quota-increase.md). Higher quotas are only available for verified custom domains, not Azure-managed domains. ++### Rate Limits for Email [Custom Domains](../quickstarts/email/add-custom-verified-domains.md) We approve higher limits for customers based on use case requirements, domain re |Get Email Status|Per Subscription|1|10| |Get Email Status|Per Subscription|60|20| -### Size Limits +### Size Limits for Email | **Name** | Limit | | | | To increase your email quota, follow the instructions at [Quota increase for ema ## Chat -### Size Limits +### Size Limits for Chat | **Name** | Limit | | | | To increase your email quota, follow the instructions at [Quota increase for ema |Message Size|28 KB | |Number of Azure Communication Services resources per Azure Bot|1000 | -### Rate Limits +### Rate Limits for Chat | **Operation** | **Scope** | **Limit per 10 seconds** | **Limit per minute** | | | | | | To increase your email quota, follow the instructions at [Quota increase for ema | Send typing indicator | per Chat thread | 10 | 30 | > [!NOTE] -> \* Read receipts and typing indicators are not supported on chat threads with more than 20 participants. +> \* Read receipts and typing indicators are not supported on chat threads with more than 20 participants. ### Chat storage For more information about the voice and video calling SDK and service, see the When sending or receiving a high volume of requests, you might receive a ```ThrottleLimitExceededException``` error. This error indicates you're hitting the service limitations, and your requests fail until the token of bucket to handle requests is replenished after a certain time. -Rate Limits for Job Router: +### Rate Limits for Job Router | Operation | Scope | Timeframe (seconds) | Limit (number of requests) | Timeout in seconds | | | | | | | If you need to send a volume of messages that exceeds the rate limits, email us ## Teams Interoperability and Microsoft Graph -Using a Teams interoperability scenario, you'll likely use some Microsoft Graph APIs to create [meetings](/graph/cloud-communications-online-meetings). +Using a Teams interoperability scenario, you often use Microsoft Graph APIs to create [meetings](/graph/cloud-communications-online-meetings). Each service offered through Microsoft Graph has different limitations; service-specific limits are [described here](/graph/throttling) in more detail. |
| communication-services | Control Mid Call Media Actions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/communication-services/how-tos/call-automation/control-mid-call-media-actions.md | Audio streaming allows you to subscribe to real-time audio streams from an ongoi ### Real-time transcription (public preview) Real-time transcription allows you to access live transcriptions for the audio of an ongoing call. For more detailed guidance on how to get started with real-time transcription and information about real-time transcription callback events, see [this page](real-time-transcription-tutorial.md).++## Media Action Compatibility Table +The following table illustrates the what media operations are allowed to run/queue if a previous operation is still running/queued. ++| Existing Operation | Call Leg | Allowed | Disallowed | +| -- | -- | -- | -- | +| PlayToAll | Main | PlayToAll, Recognize(Non-Group Call), PlayTo, Recognize(Group Call), SendDTMF, StartContinuousDtmfRecognition | None | +| Recognize(Non-Group Call) | Main | PlayToAll, Recognize(Non-Group Call), PlayTo, Recognize(Group Call), SendDTMF, StartContinuousDtmfRecognition | None | +| PlayTo | Sub | PlayToAll, Recognize(Non-Group Call) | PlayTo, Recognize(Group Call), SendDTMF, StartContinuousDtmfRecognition | +| Recognize(Group Call) | Sub | PlayToAll, Recognize(Non-Group Call) | PlayTo, Recognize(Group Call), SendDTMF, StartContinuousDtmfRecognition | +| SendDTMF | Sub | PlayToAll, Recognize(Non-Group Call) | PlayTo, Recognize(Group Call), SendDTMF, StartContinuousDtmfRecognition | +| StartContinuousDtmfRecognition | Sub | PlayToAll, Recognize(Non-Group Call),PlayTo, Recognize(Group Call), SendDTMF, StartContinuousDtmfRecognition | None | |
| communication-services | Enable User Engagement Tracking | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/communication-services/quickstarts/email/enable-user-engagement-tracking.md | -> By enabling this feature, you are acknowledging that you are enabling open/click tracking and giving consent to collect your customers' email activity. +> By enabling this feature, you acknowledge that you are enabling open/click tracking and giving consent to collect your customers' email activity. In this quick start, you learn how to enable user engagement tracking for a verified email domain in Azure Communication Services. ## Enable email engagement+ 1. Go the overview page of the Email Communications Service resource that you created in [Quickstart: Create and manage an Email Communication Service resource](./create-email-communication-resource.md).+ 2. In the left navigation panel, click **Provision Domains** to open a list of provisioned domains.+ 3. Click on the name of the custom domain that you would like to update. + :::image type="content" source="./media/email-domains-custom-provision-domains.png" alt-text="Screenshot that shows how to get to overview page for Domain from provisioned domains list."::: When you click the custom domain name, it opens the Domain Overview page. The first time you open this page, User interaction tracking is **Off** by default. 4. Click **Turn On** to enable engagement tracking. + :::image type="content" source="./media/email-domains-custom-overview.png" alt-text="Screenshot that shows the overview page of the domain." lightbox="media/email-domains-custom-overview-expanded.png"::: 5. A confirmation dialog box opens. Click **Turn On** to confirm that you want to enable engagement tracking. + :::image type="content" source="./media/email-domains-user-engagement.png" alt-text="Screenshot that shows the user engagement turn-on page of the domain." lightbox="media/email-domains-user-engagement-expanded.png"::: **Your email domain is now ready to send emails with user engagement tracking. Note that user engagement tracking applies to HTML content and does not function if you submit the payload in plaintext.** You can now subscribe to Email User Engagement operational logs, which provide information about **open** and **click** user engagement metrics for messages sent from the email service. > [!NOTE]-> User Engagement Tracking cannot be enabled for Azure Managed Domains or custom domains with default sending limits. For more information, see [Service limits for Azure Communication Services](../../concepts/service-limits.md#rate-limits). +> User Engagement Tracking cannot be enabled for Azure Managed Domains or custom domains with default sending limits. For more information, see [Service limits for Azure Communication Services](../../concepts/service-limits.md#rate-limits-for-email). > [!IMPORTANT] > If you plan to enable open/click tracking for your email links, ensure that you are correctly formatting the email content in HTML. Specifically, make sure that your tracking content is properly encapsulated within the payload, as follows:+ ```html <a href="https://www.contoso.com">Contoso Inc.</a> ```-+ ## Next steps - Access logs for [Email Communication Service](../../concepts/analytics/logs/email-logs.md). ## Related articles -- Familiarize yourself with the [Email client library](../../concepts/email/sdk-features.md)-- [Quickstart: How to connect Email Communication Service with an Azure Communication Services resource](../../quickstarts/email/connect-email-communication-resource.md)+- Familiarize yourself with the [Email client library](../../concepts/email/sdk-features.md). +- [Quickstart: How to connect Email Communication Service with an Azure Communication Services resource](../../quickstarts/email/connect-email-communication-resource.md). |
| container-apps | Log Streaming | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/container-apps/log-streaming.md | You can stream the system or console logs for your container app. To stream the #### View container app system log stream -This example uses the `--tail` argument to display the last 50 system log messages from the container app. Replace the \<placeholders\> with your container app's values. +This example uses the `--tail` argument to display the last 50 system log messages from the container app. Replace the `<PLACEHOLDERS>` with your container app's values. # [Bash](#tab/bash) ```azurecli az containerapp logs show \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ --type system \ --tail 50 ``` az containerapp logs show \ ```azurecli az containerapp logs show `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` --type system ` --tail 50 ``` -This example displays a continuous live stream of system log messages from the container app using the `--follow` argument. Replace the \<placeholders\> with your container app's values. +This example displays a continuous live stream of system log messages from the container app using the `--follow` argument. Replace the `<PLACEHOLDERS>` with your container app's values. # [Bash](#tab/bash) ```azurecli az containerapp logs show \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ --type system \ --follow ``` az containerapp logs show \ ```azurecli az containerapp logs show `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` --type system ` --follow ``` To connect to a container's console log stream in a container app with multiple | `--replica` | The replica name in the revision. | | `--container` | The container name to connect to. | -You can get the revision names with the `az containerapp revision list` command. Replace the \<placeholders\> with your container app's values. +You can get the revision names with the `az containerapp revision list` command. Replace the `<PLACEHOLDERS>` with your container app's values. # [Bash](#tab/bash) ```azurecli az containerapp revision list \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ --query "[].name" ``` az containerapp revision list \ ```azurecli az containerapp revision list `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` --query "[].name" ``` -Use the `az containerapp replica list` command to get the replica and container names. Replace the \<placeholders\> with your container app's values. +Use the `az containerapp replica list` command to get the replica and container names. Replace the `<PLACEHOLDERS>` with your container app's values. # [Bash](#tab/bash) ```azurecli az containerapp replica list \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ - --revision <RevisionName> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ + --revision <REVISION_NAME> \ --query "[].{Containers:properties.containers[].name, Name:name}" ``` az containerapp replica list \ ```azurecli az containerapp replica list `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` - --revision <RevisionName> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` + --revision <REVISION_NAME> ` --query "[].{Containers:properties.containers[].name, Name:name}" ``` -Live stream the container console using the `az container app show` command with the `--follow` argument. Replace the \<placeholders\> with your container app's values. +Live stream the container console using the `az container app show` command with the `--follow` argument. Replace the `<PLACEHOLDERS>` with your container app's values. # [Bash](#tab/bash) ```azurecli az containerapp logs show \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ - --revision <RevisionName> \ - --replica <ReplicaName> \ - --container <ContainerName> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ + --revision <REVISION_NAME> \ + --replica <REPLICA_NAME> \ + --container <CONTAINER_NAME> \ --type console \ --follow ``` az containerapp logs show \ ```azurecli az containerapp logs show `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` - --revision <RevisionName> ` - --replica <ReplicaName> ` - --container <ContainerName> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` + --revision <REVISION_NAME> ` + --replica <REPLICA_NAME> ` + --container <CONTAINER_NAME> ` --type console ` --follow ``` az containerapp logs show ` Use `Ctrl-C` or `Cmd-C` to stop the live stream. -View the last 50 console log messages using the `az containerapp logs show` command with the `--tail` argument. Replace the \<placeholders\> with your container app's values. +View the last 50 console log messages using the `az containerapp logs show` command with the `--tail` argument. Replace the `<PLACEHOLDERS>` with your container app's values. # [Bash](#tab/bash) ```azurecli az containerapp logs show \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ - --revision <RevisionName> \ - --replica <ReplicaName> \ - --container <ContainerName> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ + --revision <REVISION_NAME> \ + --replica <REPLICA_NAME> \ + --container <CONTAINER_NAME> \ --type console \ --tail 50 ``` az containerapp logs show \ ```azurecli az containerapp logs show `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` - --revision <RevisionName> ` - --replica <ReplicaName> ` - --container <ContainerName> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` + --revision <REVISION_NAME> ` + --replica <REPLICA_NAME> ` + --container <CONTAINER_NAME> ` --type console ` --tail 50 ``` az containerapp logs show ` ### View environment system log stream -Use the following command with the `--follow` argument to view the live system log stream from the Container Apps environment. Replace the \<placeholders\> with your environment values. +Use the following command with the `--follow` argument to view the live system log stream from the Container Apps environment. Replace the `<PLACEHOLDERS>` with your environment values. # [Bash](#tab/bash) ```azurecli az containerapp env logs show \- --name <ContainerAppEnvironmentName> \ - --resource-group <ResourceGroup> \ + --name <ENVIRONMENT_NAME> \ + --resource-group <RESOURCE_GROUP> \ --follow ``` az containerapp env logs show \ ```azurecli az containerapp env logs show `- --name <ContainerAppEnvironmentName> ` - --resource-group <ResourceGroup> ` + --name <ENVIRONMENT_NAME> ` + --resource-group <RESOURCE_GROUP> ` --follow ``` az containerapp env logs show ` Use `Ctrl-C` or `Cmd-C` to stop the live stream. -This example uses the `--tail` argument to display the last 50 environment system log messages. Replace the \<placeholders\> with your environment values. +This example uses the `--tail` argument to display the last 50 environment system log messages. Replace the `<PLACEHOLDERS>` with your environment values. # [Bash](#tab/bash) ```azurecli az containerapp env logs show \- --name <ContainerAppName> \ - --resource-group <ResourceGroup> \ + --name <CONTAINER_APP_NAME> \ + --resource-group <RESOURCE_GROUP> \ --tail 50 ``` az containerapp env logs show \ ```azurecli az containerapp env logs show `- --name <ContainerAppName> ` - --resource-group <ResourceGroup> ` + --name <CONTAINER_APP_NAME> ` + --resource-group <RESOURCE_GROUP> ` --tail 50 ``` |
| container-apps | Opentelemetry Agents | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/container-apps/opentelemetry-agents.md | description: Learn to record and query data collected using OpenTelemetry in Azu Previously updated : 03/08/2024 Last updated : 11/01/2024 The following example shows how to use an OTLP endpoint named `customDashboard`. } } }+``` ## Example OpenTelemetry configuration |
| cost-management-billing | Quick Acm Cost Analysis | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/costs/quick-acm-cost-analysis.md | Title: Quickstart - Start using Cost analysis description: This quickstart helps you use cost analysis to explore and analyze your Azure organizational costs. Previously updated : 08/24/2024 Last updated : 11/01/2024 -+ Regardless of whether you start on smart or customizable views, if you need more ## Forecasting costs in Cost Analysis -Forecast costs are available from both smart and custom views. In either case, the forecast is calculated the same way based on your historical usage patterns for up to a year in the future.  +Forecast costs are available in both smart and custom views when you select either an area or column stacked chart type. In either case, the forecast is calculated the same way based on your historical usage patterns for up to a year in the future.  Your forecast is a projection of your estimated costs for the selected period. Your forecast changes depending on what data is available for the period, how long of a period you select, and what filters you apply. If you notice an unexpected spike or drop in your forecast, expand the date range, and use grouping to identify large increases or decreases in historical cost. You can filter them out to normalize the forecast. A few key considerations:  |
| data-factory | Tutorial Managed Virtual Network On Premise Sql Server | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-managed-virtual-network-on-premise-sql-server.md | data factory from the resources list. > [!NOTE] > When deploying your SQL Server on a virtual machine within a virtual network, it is essential to enhance your FQDN by appending **privatelink**. Otherwise, it will be conflicted with other records in the DNS setting. For example, you can simply modify the SQL Server's FQDN from **sqlserver.westus.cloudapp.azure.net** to **sqlserver.privatelink.westus.cloudapp.azure.net**. + > [!NOTE] + > Currently ApplicationIntent and MultiSubnetFailover are not supported in SQL connection properties. + 8. Create private endpoint. ## Create a linked service and test the connection |
| frontdoor | Front Door Cdn Comparison | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/frontdoor/front-door-cdn-comparison.md | The following table provides a comparison between Azure Front Door and Azure CDN ## Services on retirement path The following table lists services that are on retirement path, frequently asked questions regarding retirement, and migration guidance. -| Details | Front Door (classic) | CDN Standard from Microsoft (classic) | CDN Standard from Akamai | -| | | | | -| Retirement Date | March 31, 2027 | September 30, 2027 | December 31, 2023 | -| Date till new resources can be created | March 31, 2025 | September 30, 2025 | Service is already retired | -| Documentation | [Azure update](https://azure.microsoft.com/updates/azure-front-door-classic-will-be-retired-on-31-march-2027/), [FAQ](classic-retirement-faq.md) | [Azure update](https://azure.microsoft.com/updates/v2/Azure-CDN-Standard-from-Microsoft-classic-will-be-retired-on-30-September-2027), [FAQ](../cdn/classic-cdn-retirement-faq.md) | [FAQ](../cdn/akamai-retirement-faq.md)| -| Migration | [Considerations](tier-migration.md), [Step-by-step instructions](migrate-tier.md) | [Considerations](../cdn/tier-migration.md), [Step-by-step instructions](../cdn/migrate-tier.md) | Service is already retired | +| Details | Front Door (classic) | CDN Standard from Microsoft (classic) | CDN Standard from Akamai | CDN Standard/Premium from Edgio +| | | | | | +| Retirement Date | March 31, 2027 | September 30, 2027 | December 31, 2023 | November 4, 2025 +| Date till new resources can be created | March 31, 2025 | September 30, 2025 | Service is already retired | January 15, 2025 +| Documentation | [Azure update](https://azure.microsoft.com/updates/azure-front-door-classic-will-be-retired-on-31-march-2027/), [FAQ](classic-retirement-faq.md) | [Azure update](https://azure.microsoft.com/updates/v2/Azure-CDN-Standard-from-Microsoft-classic-will-be-retired-on-30-September-2027), [FAQ](../cdn/classic-cdn-retirement-faq.md) | [FAQ](../cdn/akamai-retirement-faq.md)|[FAQ](../cdn/edgio-retirement-faq.md) +| Migration | [Considerations](tier-migration.md), [Step-by-step instructions](migrate-tier.md) | [Considerations](../cdn/tier-migration.md), [Step-by-step instructions](../cdn/migrate-tier.md) | Service is already retired | [Step-by-step instructions](migrate-cdn-to-front-door.md) |
| healthcare-apis | Known Issues | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/healthcare-apis/known-issues.md | Refer to the table for details about resolution dates or possible workarounds. |Issue | Date discovered | Workaround | Date resolved | | :- | : | :- | :- |+|Customers can't access FHIR, DICOM, or Medtech through the portal. | October 31, 2024 1:00 pm PST | ARM calls are still operational, and there's no disruption to existing services. | -- | |For FHIR instances created after August 19,2024, diagnostic logs aren't available in log analytics workspace. |September 19,2024 9:00 am PST| -- | October 17,2024 9:00 am PST | |For FHIR instances created after August 19,2024, in metrics blade - Total requests, Total latency, and Total errors metrics are not being populated. |September 19,2024 9:00 am PST| -- | October 28,2024 9:00 am PST | |For FHIR instances created after August 19,2024, changes in private link configuration at the workspace level causes FHIR service to be stuck in 'Updating' state. |September 24,2024 9:00 am PST| Accounts deployed prior to September 27,2024 and facing this issue can follow the steps: <br> 1. Remove private endpoint from the Azure Health Data Services workspace having this issue. On Azure blade, go to Workspace and then click on Networking blade. In networking blade, select existing private link connection and click on 'Remove' <br> 2. Create new private connection to link to the workspace.| September 27,2024 9:00 am PST | |
| iot-hub-device-update | Import Update | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-hub-device-update/import-update.md | Learn how to obtain a new update and import it into Device Update for IoT Hub. I ## Prerequisites * Access to [an IoT Hub with Device Update for IoT Hub enabled](create-device-update-account.md).+* An Azure Storage container *without* Private Endpoint enabled. ++ - If you're not sure if Private Endpoint is enabled, go to [Private Link Center](https://portal.azure.com/#blade/Microsoft_Azure_Network/PrivateLinkCenterBlade/overview), select "Private endpoints" on the left, then look for your Azure Storage account name in the "Resources" column. + * An IoT device (or simulator) [provisioned for Device Update](device-update-agent-provisioning.md) within IoT Hub. * Follow the steps in [Prepare an update to import into Device Update for IoT Hub](create-update.md) to create the import manifest for your update files. |
| iot-operations | Howto Configure Dataflow Endpoint | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/connect-to-cloud/howto-configure-dataflow-endpoint.md | Use the following table to choose the endpoint type to configure: | [Microsoft Fabric OneLake](howto-configure-fabric-endpoint.md) | For uploading data to Microsoft Fabric OneLake lakehouses. | No | Yes | | [Local storage](howto-configure-local-storage-endpoint.md) | For sending data to a locally available persistent volume, through which you can upload data via Azure Container Storage enabled by Azure Arc edge volumes. | No | Yes | +## Dataflows must use local MQTT broker endpoint ++When you create a dataflow, you specify the source and destination endpoints. The dataflow moves data from the source endpoint to the destination endpoint. You can use the same endpoint for multiple dataflows, and you can use the same endpoint as both the source and destination in a dataflow. ++However, using custom endpoints as both the source and destination in a dataflow isn't supported. This restriction means the built-in MQTT broker in Azure IoT Operations must be either the source or destination for every dataflow. To avoid dataflow deployment failures, use the [default MQTT dataflow endpoint](./howto-configure-mqtt-endpoint.md#default-endpoint) as either the source or destination for every dataflow. ++The specific requirement is each dataflow must have either the source or destination configured with an MQTT endpoint that has the host `aio-broker`. So it's not strictly required to use the default endpoint, and you can create additional dataflow endpoints pointing to the local MQTT broker as long as the host is `aio-broker`. However, to avoid confusion and manageability issues, the default endpoint is the recommended approach. ++The following table shows the supported scenarios: ++| Scenario | Supported | +|-|--| +| Default endpoint as source | Yes | +| Default endpoint as destination | Yes | +| Custom endpoint as source | Yes, if destination is default endpoint or an MQTT endpoint with host `aio-broker` | +| Custom endpoint as destination | Yes, if source is default endpoint or an MQTT endpoint with host `aio-broker` | +| Custom endpoint as source and destination | No, unless one of them is an MQTT endpoints with host `aio-broker` | + ## Reuse endpoints Think of each dataflow endpoint as a bundle of configuration settings that contains where the data should come from or go to (the `host` value), how to authenticate with the endpoint, and other settings like TLS configuration or batching preference. So you just need to create it once and then you can reuse it in multiple dataflows where these settings would be the same. |
| iot-operations | Howto Configure Mqtt Endpoint | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/connect-to-cloud/howto-configure-mqtt-endpoint.md | MQTT dataflow endpoints are used for MQTT sources and destinations. You can conf ## Azure IoT Operations local MQTT broker +Azure IoT Operations provides a [built-in local MQTT broker](../manage-mqtt-broker/overview-iot-mq.md) that you can use with dataflows. You can use the MQTT broker as a source to receive messages from other systems or as a destination to send messages to other systems. + ### Default endpoint -Azure IoT Operations provides a built-in MQTT broker that you can use with dataflows. When you deploy Azure IoT Operations, an MQTT broker dataflow endpoint named "default" is created with default settings. You can use this endpoint as a source or destination for dataflows. The default endpoint uses the following settings: +When you deploy Azure IoT Operations, an MQTT broker dataflow endpoint named "default" is created with default settings. You can use this endpoint as a source or destination for dataflows. ++> [!IMPORTANT] +> The default endpoint **must always be used as either the source or destination in every dataflow**. To learn more about, see [Dataflows must use local MQTT broker endpoint](./howto-configure-dataflow-endpoint.md#dataflows-must-use-local-mqtt-broker-endpoint). ++The default endpoint uses the following settings: - Host: `aio-broker:18883` through the [default MQTT broker listener](../manage-mqtt-broker/howto-configure-brokerlistener.md#default-brokerlistener) - Authentication: service account token (SAT) through the [default BrokerAuthentication resource](../manage-mqtt-broker/howto-configure-authentication.md#default-brokerauthentication-resource) - TLS: Enabled - Trusted CA certificate: The default CA certificate `azure-iot-operations-aio-ca-trust-bundle` from the [default root CA](../deploy-iot-ops/concept-default-root-ca.md) -> [!IMPORTANT] -> If any of these default MQTT broker settings change, the dataflow endpoint must be updated to reflect the new settings. For example, if the default MQTT broker listener changes to use a different service name `my-mqtt-broker` and port 8885, you must update the endpoint to use the new host `host: my-mqtt-broker:8885`. Same applies to other settings like authentication and TLS. +> [!CAUTION] +> Don't delete the default endpoint. If you delete the default endpoint, you must recreate it with the same settings. To view or edit the default MQTT broker endpoint settings: kubectl get dataflowendpoint default -n azure-iot-operations -o yaml ### Create new endpoint -You can also create new local MQTT broker endpoints with custom settings. For example, you can create a new MQTT broker endpoint using a different port, authentication, or other settings. +You can also create new local MQTT broker endpoints with custom settings. For example, you can create a new MQTT broker endpoint using a different port, authentication, or authorization settings. However, you must still always use the default endpoint as either the source or destination in every dataflow, even if you create new endpoints. # [Portal](#tab/portal) Then, follow the steps in [X.509 certificate](#x509-certificate) to configure th ### Event Grid shared subscription limitation -Azure Event Grid MQTT broker doesn't support shared subscriptions, which means that you can't set the `instanceCount` to more than `1` in the dataflow profile if Event Grid is used as a source (where the dataflow subscribes to messages) for a dataflow. In this case, if you set `instanceCount` greater than `1`, the dataflow fails to start. +Azure Event Grid MQTT broker [doesn't support shared subscriptions](../../event-grid/mqtt-support.md#mqttv5-current-limitations), which means that you can't set the `instanceCount` to more than `1` in the dataflow profile if Event Grid is used as a source (where the dataflow subscribes to messages) for a dataflow. In this case, if you set `instanceCount` greater than `1`, the dataflow fails to start. ## Custom MQTT brokers |
| iot-operations | Howto Create Dataflow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/connect-to-cloud/howto-create-dataflow.md | flowchart LR :::image type="content" source="media/howto-create-dataflow/dataflow.svg" alt-text="Diagram of a dataflow showing flow from source to transform then destination."::: -To define the source and destination, you need to configure the dataflow endpoints. The transformation is optional and can include operations like enriching the data, filtering the data, and mapping the data to another field. +To define the source and destination, you need to configure the dataflow endpoints. The transformation is optional and can include operations like enriching the data, filtering the data, and mapping the data to another field. ++> [!IMPORTANT] +> Each dataflow must have the Azure IoT Operations local MQTT broker default endpoint [as *either* the source or destination](#proper-dataflow-configuration). You can use the operations experience in Azure IoT Operations to create a dataflow. The operations experience provides a visual interface to configure the dataflow. You can also use Bicep to create a dataflow using a Bicep template file, or use Kubernetes to create a dataflow using a YAML file. Review the following sections to learn how to configure the operation types of t To configure a source for the dataflow, specify the endpoint reference and a list of data sources for the endpoint. -### Use Asset as source +### Use asset as source # [Portal](#tab/portal) Configuring an asset as a source is only available in the operations experience. +When using an asset as the source, the asset definition is used to infer the schema for the dataflow. The asset definition includes the schema for the asset's datapoints. To learn more, see [Manage asset configurations remotely](../discover-manage-assets/howto-manage-assets-remotely.md). ++Once configured, the data from the asset reached the dataflow via the local MQTT broker. So, when using an asset as the source, the dataflow uses the local MQTT broker default endpoint as the source in actuality. + ### Use default MQTT endpoint as source # [Portal](#tab/portal) sourceSettings: { } ``` -Here, `dataSources` allow you to specify multiple MQTT or Kafka topics without needing to modify the endpoint configuration. This means the same endpoint can be reused across multiple dataflows, even if the topics vary. To learn more, see [Configure data sources](#configure-data-sources-mqtt-or-kafka-topics). +Here, `dataSources` allow you to specify multiple MQTT or Kafka topics without needing to modify the endpoint configuration. This flexibility means the same endpoint can be reused across multiple dataflows, even if the topics vary. To learn more, see [Configure data sources](#configure-data-sources-mqtt-or-kafka-topics). # [Kubernetes](#tab/kubernetes) Because `dataSources` allows you to specify MQTT or Kafka topics without modifyi -For more information about the default MQTT endpoint and creating an MQTT endpoint as a dataflow source, see [MQTT Endpoint](howto-configure-mqtt-endpoint.md). +If the default endpoint isn't used as the source, it must be used as the [destination](#destination). To learn more about, see [Dataflows must use local MQTT broker endpoint](./howto-configure-dataflow-endpoint.md#dataflows-must-use-local-mqtt-broker-endpoint). ### Use custom MQTT or Kafka dataflow endpoint as source sourceSettings: ### Configure data sources (MQTT or Kafka topics) -You can specify multiple MQTT or Kafka topics in a source without needing to modify the dataflow endpoint configuration. This means the same endpoint can be reused across multiple dataflows, even if the topics vary. For more information, see [Reuse dataflow endpoints](./howto-configure-dataflow-endpoint.md#reuse-endpoints). +You can specify multiple MQTT or Kafka topics in a source without needing to modify the dataflow endpoint configuration. This flexibility means the same endpoint can be reused across multiple dataflows, even if the topics vary. For more information, see [Reuse dataflow endpoints](./howto-configure-dataflow-endpoint.md#reuse-endpoints). #### MQTT topics sourceSettings: -> [!NOTE] -> If the instance count in the [dataflow profile](howto-configure-dataflow-profile.md) is greater than 1, shared subscription must be enabled for all MQTT topic filters by adding topic prefix `$shared/<GROUP_NAME>` to each topic filter. -<!-- TODO: Details --> +If the instance count in the [dataflow profile](howto-configure-dataflow-profile.md) is greater than 1, shared subscription is automatically enabled for all dataflows that use MQTT source. In this case, the `$shared` prefix is added and the shared subscription group name automatically generated. For example, if you have a dataflow profile with an instance count of 3, and your dataflow uses an MQTT endpoint as source configured with topics `topic1` and `topic2`, they are automatically converted to shared subscriptions as `$shared/<GENERATED_GROUP_NAME>/topic1` and `$shared/<GENERATED_GROUP_NAME>/topic2`. If you want to use a different shared subscription group ID, you can override it in the topic, like `$shared/mygroup/topic1`. ++> [!IMPORTANT] +> Dataflows requireing shared subscription when instance count is greater than 1 is important when using Event Grid MQTT broker as a source since it [doesn't support shared subscriptions](../../event-grid/mqtt-support.md#mqttv5-current-limitations). To avoid missing messages, set the dataflow profile instance count to 1 when using Event Grid MQTT broker as the source. That is when the dataflow is the subscriber and receiving messages from the cloud. #### Kafka topics For more information about schema registry, see [Understand message schemas](con To configure a destination for the dataflow, specify the endpoint reference and data destination. You can specify a list of data destinations for the endpoint. -To send data to a destination other than the local MQTT broker, create a dataflow endpoint. To learn how, see [Configure dataflow endpoints](howto-configure-dataflow-endpoint.md). +To send data to a destination other than the local MQTT broker, create a dataflow endpoint. To learn how, see [Configure dataflow endpoints](howto-configure-dataflow-endpoint.md). If the destination isn't the local MQTT broker, it must be used as a source. To learn more about, see [Dataflows must use local MQTT broker endpoint](./howto-configure-dataflow-endpoint.md#dataflows-must-use-local-mqtt-broker-endpoint). > [!IMPORTANT] > Storage endpoints require a schema reference. If you've created storage destination endpoints for Microsoft Fabric OneLake, ADLS Gen 2, Azure Data Explorer and Local Storage, you must specify schema reference. destinationSettings: ## Example -The following example is a dataflow configuration that uses the MQTT endpoint for the source and destination. The source filters the data from the MQTT topics `thermostats/+/telemetry/temperature/#` and `humidifiers/+/telemetry/humidity/#`. The transformation converts the temperature to Fahrenheit and filters the data where the temperature is less than 100000. The destination sends the data to the MQTT topic `factory`. +The following example is a dataflow configuration that uses the MQTT endpoint for the source and destination. The source filters the data from the MQTT topic `azure-iot-operations/data/thermostat`. The transformation converts the temperature to Fahrenheit and filters the data where the temperature multiplied by the humiditiy is less than 100000. The destination sends the data to the MQTT topic `factory`. ++# [Portal](#tab/portal) ++See Bicep or Kubernetes tabs for the configuration example. ++# [Bicep](#tab/bicep) ++```bicep +param aioInstanceName string = '<AIO_INSTANCE_NAME>' +param customLocationName string = '<CUSTOM_LOCATION_NAME>' +param dataflowName string = '<DATAFLOW_NAME>' ++resource aioInstance 'Microsoft.IoTOperations/instances@2024-09-15-preview' existing = { + name: aioInstanceName +} ++resource customLocation 'Microsoft.ExtendedLocation/customLocations@2021-08-31-preview' existing = { + name: customLocationName +} ++// Pointer to the default dataflow endpoint +resource defaultDataflowEndpoint 'Microsoft.IoTOperations/instances/dataflowEndpoints@2024-09-15-preview' existing = { + parent: aioInstance + name: 'default' +} ++// Pointer to the default dataflow profile +resource defaultDataflowProfile 'Microsoft.IoTOperations/instances/dataflowProfiles@2024-09-15-preview' existing = { + parent: aioInstance + name: 'default' +} ++resource dataflow 'Microsoft.IoTOperations/instances/dataflowProfiles/dataflows@2024-09-15-preview' = { + // Reference to the parent dataflow profile, the default profile in this case + // Same usage as profileRef in Kubernetes YAML + parent: defaultDataflowProfile + name: dataflowName + extendedLocation: { + name: customLocation.id + type: 'CustomLocation' + } + properties: { + mode: 'Enabled' + operations: [ + { + operationType: 'Source' + sourceSettings: { + // Use the default MQTT endpoint as the source + endpointRef: defaultDataflowEndpoint.name + // Filter the data from the MQTT topic azure-iot-operations/data/thermostat + dataSources: [ + 'azure-iot-operations/data/thermostat' + ] + } + } + // Transformation optional + { + operationType: 'BuiltInTransformation' + builtInTransformationSettings: { + // Filter the data where temperature * "Tag 10" < 100000 + filter: [ + { + inputs: [ + 'temperature.Value' + '"Tag 10".Value' + ] + expression: '$1 * $2 < 100000' + } + ] + map: [ + // Passthrough all values by default + { + inputs: [ + '*' + ] + output: '*' + } + // Convert temperature to Fahrenheit and output it to TemperatureF + { + inputs: [ + 'temperature.Value' + ] + output: 'TemperatureF' + expression: 'cToF($1)' + } + // Extract the "Tag 10" value and output it to Humidity + { + inputs: [ + '"Tag 10".Value' + ] + output: 'Humidity' + } + ] + } + } + { + operationType: 'Destination' + destinationSettings: { + // Use the default MQTT endpoint as the destination + endpointRef: defaultDataflowEndpoint.name + // Send the data to the MQTT topic factory + dataDestination: 'factory' + } + } + ] + } +} +``` ++# [Kubernetes](#tab/kubernetes) ```yaml apiVersion: connectivity.iotoperations.azure.com/v1beta1 metadata: name: my-dataflow namespace: azure-iot-operations spec:+ # Reference to the default dataflow profile profileRef: default mode: Enabled operations: - operationType: Source sourceSettings:+ # Use the default MQTT endpoint as the source endpointRef: default+ # Filter the data from the MQTT topic azure-iot-operations/data/thermostat dataSources:- - thermostats/+/telemetry/temperature/# - - humidifiers/+/telemetry/humidity/# + - azure-iot-operations/data/thermostat + # Transformation optional - operationType: builtInTransformation builtInTransformationSettings:+ # Filter the data where temperature * "Tag 10" < 100000 filter: - inputs: - 'temperature.Value' - '"Tag 10".Value'- expression: "$1*$2<100000" + expression: '$1 * $2 < 100000' map:+ # Passthrough all values by default - inputs: - '*' output: '*'+ # Convert temperature to Fahrenheit and output it to TemperatureF - inputs: - temperature.Value output: TemperatureF expression: cToF($1)+ # Extract the "Tag 10" value and output it to Humidity - inputs: - '"Tag 10".Value'- output: 'Tag 10' + output: 'Humidity' - operationType: Destination destinationSettings:+ # Use the default MQTT endpoint as the destination endpointRef: default+ # Send the data to the MQTT topic factory dataDestination: factory ``` -<!-- TODO: add links to examples in the reference docs --> - +To see more examples of dataflow configurations, see [Azure REST API - Dataflow](/rest/api/iotoperations/dataflow/create-or-update#examples) and the [quickstart Bicep](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/quickstarts/quickstart.bicep). + ## Verify a dataflow is working Follow [Tutorial: Bi-directional MQTT bridge to Azure Event Grid](tutorial-mqtt-bridge.md) to verify the dataflow is working. kubectl get dataflow my-dataflow -o yaml > my-dataflow.yaml +## Proper dataflow configuration ++To ensure the dataflow is working as expected, verify the following: ++- The default MQTT dataflow endpoint [must be used as either the source or destination](./howto-configure-dataflow-endpoint.md#dataflows-must-use-local-mqtt-broker-endpoint). +- The [dataflow profile](./howto-configure-dataflow-profile.md) exists and is referenced in the dataflow configuration. +- Source is either an MQTT endpoint, Kafka endpoint, or an asset. [Storage type endpoints can't be used as a source](./howto-configure-dataflow-endpoint.md). +- When using Event Grid as the source, the [dataflow profile instance count](./howto-configure-dataflow-profile.md#scaling) is set to 1 because Event Grid MQTT broker doesn't support shared subscriptions. +- When using Event Hubs as the source, each event hub in the namespace is a separate Kafka topic and must be specified as the data source. +- Transformation, if used, is configured with proper syntax, including proper [escaping of special characters](./concept-dataflow-mapping.md#escaping). +- When using storage type endpoints as destination, a [schema is specified](#serialize-data-according-to-a-schema). + ## Next steps - [Map data by using dataflows](concept-dataflow-mapping.md) |
| iot-operations | Quickstart Configure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/get-started-end-to-end-sample/quickstart-configure.md | The data that OPC UA servers expose can have a complex structure and can be diff This quickstart uses the OPC PLC simulator to generate sample data. To deploy the OPC PLC simulator, run the following command: -<!-- TODO: Change branch to main in two places below before merging the release branch. Don't delete the samples release-m3 branch until the updates are done in the docs repo. --> - ```console-kubectl apply -f https://raw.githubusercontent.com/Azure-Samples/explore-iot-operations/release-m3/samples/quickstarts/opc-plc-deployment.yaml +kubectl apply -f https://raw.githubusercontent.com/Azure-Samples/explore-iot-operations/main/samples/quickstarts/opc-plc-deployment.yaml ``` The following snippet shows the YAML file that you applied: > [!CAUTION] > This configuration uses a self-signed application instance certificate. Don't use this configuration in a production environment. To learn more, see [Configure OPC UA certificates infrastructure for the connector for OPC UA](../discover-manage-assets/howto-configure-opcua-certificates-infrastructure.md). Run the following commands to download and run the Bicep file that configures yo # [Bash](#tab/bash) ```bash-wget https://raw.githubusercontent.com/Azure-Samples/explore-iot-operations/release-m3/samples/quickstarts/quickstart.bicep -O quickstart.bicep +wget https://raw.githubusercontent.com/Azure-Samples/explore-iot-operations/main/samples/quickstarts/quickstart.bicep -O quickstart.bicep AIO_EXTENSION_NAME=$(az k8s-extension list -g $RESOURCE_GROUP --cluster-name $CLUSTER_NAME --cluster-type connectedClusters --query "[?extensionType == 'microsoft.iotoperations'].id" -o tsv | awk -F'/' '{print $NF}') AIO_INSTANCE_NAME=$(az iot ops list -g $RESOURCE_GROUP --query "[0].name" -o tsv) az deployment group create --subscription $SUBSCRIPTION_ID --resource-group $RES # [PowerShell](#tab/powershell) ```powershell-Invoke-WebRequest -Uri https://raw.githubusercontent.com/Azure-Samples/explore-iot-operations/release-m3/samples/quickstarts/quickstart.bicep -OutFile quickstart.bicep +Invoke-WebRequest -Uri https://raw.githubusercontent.com/Azure-Samples/explore-iot-operations/main/samples/quickstarts/quickstart.bicep -OutFile quickstart.bicep $AIO_EXTENSION_NAME = (az k8s-extension list -g $RESOURCE_GROUP --cluster-name $CLUSTER_NAME --cluster-type connectedClusters --query "[?extensionType == 'microsoft.iotoperations'].id" -o tsv) -split '/' | Select-Object -Last 1 $AIO_INSTANCE_NAME = $(az iot ops list -g $RESOURCE_GROUP --query "[0].name" -o tsv) |
| iot-operations | Concept Default Root Ca | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/secure-iot-ops/concept-default-root-ca.md | To help you get started, Azure IoT Operations Preview is deployed with a default status: "True" type: Ready ```+## Bring your own issuer ++For production deployments, we recommend that you set up Azure IoT Operations with an enterprise PKI to manage certificates and that you bring your own issuer which works with your enterprise PKI instead of using the default self-signed issuer to issue TLS certificates for internal communication. +To set up Azure IoT Operations with your own issuer, use the following steps before deploying an instance to your cluster: ++1. Follow the steps in [Prepare your cluster](../deploy-iot-ops/howto-prepare-cluster.md) to set up your cluster. + +1. Install [cert-manager](https://cert-manager.io/docs/installation/). + Cert-manager manages TLS certificates. ++1. Install [trust-manager](https://cert-manager.io/docs/trust/trust-manager/installation/). + While installing trust manager, set the `trust namespace` to cert-manager. For example: ++ ```bash + helm upgrade trust-manager jetstack/trust-manager --install --namespace cert-manager --set app.trust.namespace=cert-manager --wait + ``` + + Trust-manager is used to distribute a trust bundle to components. + +1. Create the Azure IoT Operations namespace. + + ```bash + kubectl create namespace azure-iot-operations + ``` ++1. Deploy an issuer that works with cert-manager. For a list of all supported issuers, see [cert-manager issuers](https://cert-manager.io/docs/configuration/issuers/). ++ The issuer can be of type `ClusterIssuer` or `Issuer`. If using `Issuer`, the issuer resource must be created in the Azure IoT Operations namespace. ++1. Set up trust bundle in the Azure IoT Operations namespace. ++ 1. To set up trust bundle, create a ConfigMap in the Azure IoT Operations namespace. Place the public key portion of your CA certificate into the config map with a key name of your choice. + 1. Get the public key portion of your CA certificate. The steps to acquire the public key depend on the issuer you have chosen. + 1. Create the ConfigMap. For example: ++ ```bash + kubectl create configmap -n azure-iot-operations <YOUR_CONFIGMAP_NAME> --from-file=<CA_CERTIFICATE_FILENAME_PEM_OR_DER> + ``` ++1. Follow steps in [Deploy Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md) to deploy, *with a few changes*. + 1. Add the `--user-trust` parameter while preparing cluster. For example: ++ ```bash + az iot ops init --subscription <SUBSCRIPTION_ID> --cluster <CLUSTER_NAME> -g <RESOURCE_GROUP> --user-trust + ``` + + 2. Add the `--trust-settings` parameter with the necessary information while deploying Azure IoT Operations. For example: ++ ```bash + az iot ops create --subscription <SUBSCRIPTION_ID> -g <RESOURCE_GROUP> --cluster <CLUSTER_NAME> --custom-location <CUSTOME_LOCATION> -n <iNSTANCE_NAME> --sr-resource-id <SCHEMAREGISTRY_RESOURCE_ID> --trust-settings configMapName=<CONFIGMAP_NAME> configMapKey=<CONFIGMAP_KEY_WITH_PUBLICKEY_VALUE> issuerKind=<CLUSTERISSUER_OR_ISSUER> issuerName=<ISSUER_NAME> + ``` |
| iot-operations | Howto Validate Images | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/secure-iot-ops/howto-validate-images.md | description: Validate that Azure IoT Operations docker and helm images are legit Previously updated : 09/24/2024 Last updated : 11/01/2024 #CustomerIntent: As an IT professional, I want to ensure that the images I download for Azure IoT Operations are legitimate. Azure IoT Operations signs its docker and helm images to allow users to verify t 1. Use notation to verify your downloaded images against the trustpolicy. + Replace the version placeholder with the version number of the image that you want to check. For an existing instance of Azure IoT Operations, you can find the version number on the instance overview page in the Azure portal or by running [az iot ops show](/cli/azure/iot/ops#az-iot-ops-show). For a full list of available versions, see [azure-iot-operations releases](https://github.com/Azure/azure-iot-operations/releases). + ```sh notation policy import <TRUSTPOLICY_FILE>.json export NOTATION_EXPERIMENTAL=1- notation verify --allow-referrers-api mcr.microsoft.com/azureiotoperations/aio-operator:0.8.16 + notation verify --allow-referrers-api mcr.microsoft.com/azureiotoperations/aio-operator:<AZURE_IOT_OPERATIONS_VERSION> ``` The output of the command looks like the following example: |
| iot-operations | Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-operations/troubleshoot/troubleshoot.md | For general deployment and configuration troubleshooting, you can use the Azure - Use [az iot ops support create-bundle](/cli/azure/iot/ops/support#az-iot-ops-support-create-bundle) to collect logs and traces to help you diagnose problems. The *support create-bundle* command creates a standard support bundle zip archive you can review or provide to Microsoft Support. +## Secret management ++If you see the following error message related to secret management, you need to update your Azure Key Vault contents: ++```output +rpc error: code = Unknown desc = failed to mount objects, error: failed to get objectType:secret, +objectName:nbc-eventhub-secret, objectVersion:: GET https://aio-kv-888f27b078.vault.azure.net/secrets/nbc-eventhub-secret/-- +RESPONSE 404: 404 Not FoundERROR CODE: SecretNotFound--{ "error": { "code": "SecretNotFound", "message": "A secret with (name/id) nbc-eventhub-secret was not found in this key vault. +If you recently deleted this secret you may be able to recover it using the correct recovery command. +For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125182" } +``` ++This error occurs when Azure IoT Operations tries to synchronize a secret from Azure Key Vault that doesn't exist. To resolve this issue, you need to add the secret in Azure Key Vault before you create resources such as a secret provider class. ++## Connector for OPC UA ++An OPC UA server connection fails with a `BadSecurityModeRejected` error if the connector tries to connect to a server that only exposes endpoints with no security. There are two options to resolve this issue: ++- Overrule the restriction by explicitly setting the following values in the additional configuration for the asset endpoint profile: ++ | Property | Value | + |-|-| + | `securityMode` | `none` | + | `securityPolicy` | `http://opcfoundation.org/UA/SecurityPolicy#None` | ++- Add a secure endpoint to the OPC UA server and set up the certificate mutual trust to establish the connection. ++ ## Azure IoT Layered Network Management Preview troubleshooting The troubleshooting guidance in this section is specific to Azure IoT Operations when using the Layered Network Management component. For more information, see [How does Azure IoT Operations Preview work in layered network?](../manage-layered-network/concept-iot-operations-in-layered-network.md). |
| network-watcher | Connection Troubleshoot Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/connection-troubleshoot-cli.md | If the virtual machines aren't in the same resource group, use their resource ID ```azurecli-interactive # Test connectivity between two virtual machines that are in two different resource groups over port 3389.-az network watcher test-connectivity --source-resource '/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup1/providers/Microsoft.Compute/virtualMachines/VM1' --dest-resource '/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup2/providers/Microsoft.Compute/virtualMachines/VM2' --protocol 'TCP' --dest-port '3389' +az network watcher test-connectivity --source-resource '/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup1/providers/Microsoft.Compute/virtualMachines/VM1' --dest-resource '/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup2/providers/Microsoft.Compute/virtualMachines/VM2' --protocol 'TCP' --dest-port '3389' ``` - If the two virtual machines are communicating with no issues, you see the following results: az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [], "links": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "", "roundTripTimeAvg": 2, "roundTripTimeMax": 2, az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.0.0.5",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [], "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", "type": "VirtualMachine" } ], az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [], "links": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "" } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.0.0.5",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [ { "context": [ { "key": "RuleName",- "value": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM2-nsg/SecurityRules/Deny3389Inbound" + "value": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM2-nsg/SecurityRules/Deny3389Inbound" } ], "origin": "Inbound", az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", "type": "VirtualMachine" } ], az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [ { "context": [ { "key": "RuleName",- "value": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM1-nsg/SecurityRules/Deny3389Outbound" + "value": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM1-nsg/SecurityRules/Deny3389Outbound" } ], "origin": "Outbound", az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "" } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.0.0.5",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [ { "context": [], az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", "type": "VirtualMachine" } ], az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [], "links": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "" } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.0.0.5",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [ { "context": [], az network watcher test-connectivity --source-resource '/subscriptions/abcdef01- "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM2", "type": "VirtualMachine" } ], az network watcher test-connectivity --resource-group 'myResourceGroup' --source "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [], "links": [ { "context": {}, "issues": [], "linkType": "Internet",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "", "roundTripTimeAvg": 9, "roundTripTimeMax": 9, az network watcher test-connectivity --resource-group 'myResourceGroup' --source } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "104.117.244.81",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [], "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "Internet",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ], az network watcher test-connectivity --resource-group 'myResourceGroup' --source "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [ { "context": [ { "key": "RuleName",- "value": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM1-nsg/SecurityRules/DenyInternetOutbound" + "value": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/VM1-nsg/SecurityRules/DenyInternetOutbound" } ], "origin": "Outbound", az network watcher test-connectivity --resource-group 'myResourceGroup' --source "context": {}, "issues": [], "linkType": "Internet",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "" } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "23.198.7.184",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [], "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "Internet",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ], az network watcher test-connectivity --resource-group 'myResourceGroup' --source "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [], "links": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "", "roundTripTimeAvg": 2, "roundTripTimeMax": 2, az network watcher test-connectivity --resource-group 'myResourceGroup' --source } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.10.10.10",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [], "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/vm2375/ipConfigurations/ipconfig1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/vm2375/ipConfigurations/ipconfig1", "type": "VirtualNetwork" } ], az network watcher test-connectivity --resource-group 'myResourceGroup' --source "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [], "links": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "" } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.10.10.10",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [], "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/vm2375/ipConfigurations/ipconfig1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/vm2375/ipConfigurations/ipconfig1", "type": "VirtualNetwork" } ], az network watcher test-connectivity --resource-group 'myResourceGroup' --source "hops": [ { "address": "10.0.0.4",- "id": "00000000-0000-0000-0000-000000000000", + "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "issues": [ { "context": [], az network watcher test-connectivity --resource-group 'myResourceGroup' --source "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "11111111-1111-1111-1111-111111111111", + "nextHopId": "bbbbbbbb-1111-2222-3333-cccccccccccc", "resourceId": "" } ], "nextHopIds": [- "11111111-1111-1111-1111-111111111111" + "bbbbbbbb-1111-2222-3333-cccccccccccc" ], "previousHopIds": [], "previousLinks": [],- "resourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", + "resourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/VM1", "type": "Source" }, { "address": "10.10.10.10",- "id": "11111111-1111-1111-1111-111111111111", + "id": "bbbbbbbb-1111-2222-3333-cccccccccccc", "issues": [], "links": [], "nextHopIds": [], "previousHopIds": [- "00000000-0000-0000-0000-000000000000" + "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" ], "previousLinks": [ { "context": {}, "issues": [], "linkType": "VirtualNetwork",- "nextHopId": "00000000-0000-0000-0000-000000000000", + "nextHopId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb", "resourceId": "" } ], |
| network-watcher | Connection Troubleshoot Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/connection-troubleshoot-powershell.md | Hops : [ "Type": "Source", "Id": "c5222ea0-3213-4f85-a642-cee63217c2f3", "Address": "10.1.1.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGrou + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGrou ps/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurat ions/ipconfig1", "NextHopIds": [ Hops : [ "Type": "VirtualAppliance", "Id": "9283a9f0-cc5e-4239-8f5e-ae0f3c19fbaa", "Address": "10.1.2.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGrou + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGrou ps/ContosoRG/providers/Microsoft.Network/networkInterfaces/fwNic/ipConfiguratio ns/ipconfig1", "NextHopIds": [ Hops : [ "Type": "VirtualAppliance", "Id": "0f1500cd-c512-4d43-b431-7267e4e67017", "Address": "10.1.3.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGrou + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGrou ps/ContosoRG/providers/Microsoft.Network/networkInterfaces/auNic/ipConfiguratio ns/ipconfig1", "NextHopIds": [ Hops : [ "Type": "VnetLocal", "Id": "a88940f8-5fbe-40da-8d99-1dee89240f64", "Address": "10.1.4.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGrou + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGrou ps/ContosoRG/providers/Microsoft.Network/networkInterfaces/dbNic0/ipConfigurati ons/ipconfig1", "NextHopIds": [], Hops : [ "Type": "Source", "Id": "b4f7bceb-07a3-44ca-8bae-adec6628225f", "Address": "10.1.1.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1", + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1", "NextHopIds": [ "3fee8adf-692f-4523-b742-f6fdf6da6584" ], Hops : [ "Type": "Source", "Id": "1f0e3415-27b0-4bf7-a59d-3e19fb854e3e", "Address": "10.1.1.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1", + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1", "NextHopIds": [ "f99f2bd1-42e8-4bbf-85b6-5d21d00c84e0" ], Hops : [ "Type": "Source", "Id": "9e7f61d9-fb45-41db-83e2-c815a919b8ed", "Address": "10.1.1.4",- "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1", + "ResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/ContosoRG/providers/Microsoft.Network/networkInterfaces/appNic0/ipConfigurations/ipconfig1", "NextHopIds": [ "1e6d4b3c-7964-4afd-b959-aaa746ee0f15" ], |
| network-watcher | Diagnose Network Security Rules | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/diagnose-network-security-rules.md | ResultsText : [ "SecurityRuleAccessResult": "Deny", "EvaluatedNetworkSecurityGroups": [ {- "NetworkSecurityGroupId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", + "NetworkSecurityGroupId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", "MatchedRule": { "RuleName": "VirtualNetwork", "Action": "Allow" ResultsText : [ ] }, {- "NetworkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", + "NetworkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", "MatchedRule": { "RuleName": "DefaultRule_AllowVnetInBound", "Action": "Allow" ResultsText : [ ] }, {- "NetworkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", + "NetworkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", "MatchedRule": { "RuleName": "UserRule_DenyVnetInBound", "Action": "Deny" Output similar to the following example output is returned: "networkSecurityGroupResult": { "evaluatedNetworkSecurityGroups": [ {- "appliedTo": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", + "appliedTo": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", "matchedRule": { "action": "Allow", "ruleName": "VirtualNetwork" },- "networkSecurityGroupId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", + "networkSecurityGroupId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", "rulesEvaluationResult": [ { "destinationMatched": true, Output similar to the following example output is returned: ] }, {- "appliedTo": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet", + "appliedTo": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet", "matchedRule": { "action": "Allow", "ruleName": "DefaultRule_AllowVnetInBound" },- "networkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", + "networkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", "rulesEvaluationResult": [ { "destinationMatched": true, Output similar to the following example output is returned: ] }, {- "appliedTo": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myvm36", + "appliedTo": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myvm36", "matchedRule": { "action": "Deny", "ruleName": "UserRule_DenyVnetInBound" },- "networkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", + "networkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", "rulesEvaluationResult": [ { "destinationMatched": true, You can add the security rule to the network security group from the Network Wat "SecurityRuleAccessResult": "Allow", "EvaluatedNetworkSecurityGroups": [ {- "NetworkSecurityGroupId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", + "NetworkSecurityGroupId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", "MatchedRule": { "RuleName": "VirtualNetwork", "Action": "Allow" You can add the security rule to the network security group from the Network Wat ] }, {- "NetworkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", + "NetworkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", "MatchedRule": { "RuleName": "DefaultRule_AllowVnetInBound", "Action": "Allow" You can add the security rule to the network security group from the Network Wat ] }, {- "NetworkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", + "NetworkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", "MatchedRule": { "RuleName": "UserRule_AllowBastionConnections", "Action": "Allow" You can add the security rule to the network security group from the Network Wat "networkSecurityGroupResult": { "evaluatedNetworkSecurityGroups": [ {- "appliedTo": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", + "appliedTo": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", "matchedRule": { "action": "Allow", "ruleName": "VirtualNetwork" },- "networkSecurityGroupId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", + "networkSecurityGroupId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkAdmin/providers/Microsoft.Network/networkManagers/GlobalRules", "rulesEvaluationResult": [ { "destinationMatched": true, You can add the security rule to the network security group from the Network Wat ] }, {- "appliedTo": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet", + "appliedTo": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet", "matchedRule": { "action": "Allow", "ruleName": "DefaultRule_AllowVnetInBound" },- "networkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", + "networkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/mySubnet-nsg", "rulesEvaluationResult": [ { "destinationMatched": true, You can add the security rule to the network security group from the Network Wat ] }, {- "appliedTo": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myvm36", + "appliedTo": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myvm36", "matchedRule": { "action": "Allow", "ruleName": "UserRule_AllowBastionConnections" },- "networkSecurityGroupId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", + "networkSecurityGroupId": "/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myVM-nsg", "rulesEvaluationResult": [ { "destinationMatched": true, |
| network-watcher | Flow Logs Read | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/flow-logs-read.md | The results of this value are shown in the following example: "time": "2017-06-16T20:59:43.7340000Z", "systemId": "abcdef01-2345-6789-0abc-def012345678", "category": "NetworkSecurityGroupFlowEvent",- "resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/MYRESOURCEGROUP/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/MYNSG", + "resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/MYRESOURCEGROUP/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/MYNSG", "operationName": "NetworkSecurityGroupFlowEvents", "properties": { "Version": 1, The results of this value are shown in the following example: "flowLogGUID": "abcdef01-2345-6789-0abc-def012345678", "macAddress": "0022485D8CF8", "category": "FlowLogFlowEvent",- "flowLogResourceID": "/SUBSCRIPTIONS/00000000-0000-0000-0000-000000000000/RESOURCEGROUPS/NETWORKWATCHERRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKWATCHERS/NETWORKWATCHER_EASTUS/FLOWLOGS/MYVNET-MYRESOURCEGROUP-FLOWLOG", - "targetResourceID": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", + "flowLogResourceID": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/NETWORKWATCHERRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKWATCHERS/NETWORKWATCHER_EASTUS/FLOWLOGS/MYVNET-MYRESOURCEGROUP-FLOWLOG", + "targetResourceID": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet", "operationName": "FlowLogFlowEvent", "flowRecords": { "flows": [ |
| network-watcher | Network Watcher Nsg Auditing Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/network-watcher-nsg-auditing-powershell.md | The first step in this example is to work with an existing baseline. The followi "ProvisioningState": "Succeeded", "Name": "default-allow-rdp", "Etag": "W/\"d8859256-1c4c-4b93-ba7d-73d9bf67c4f1\"",- "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/default-allow-rdp" + "Id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/default-allow-rdp" }, { "Description": null, The first step in this example is to work with an existing baseline. The followi "ProvisioningState": "Succeeded", "Name": "MyRuleDoNotDelete", "Etag": "W/\"d8859256-1c4c-4b93-ba7d-73d9bf67c4f1\"",- "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/MyRuleDoNotDelete" + "Id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/MyRuleDoNotDelete" }, { "Description": null, The first step in this example is to work with an existing baseline. The followi "ProvisioningState": "Succeeded", "Name": "My2ndRuleDoNotDelete", "Etag": "W/\"d8859256-1c4c-4b93-ba7d-73d9bf67c4f1\"",- "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/My2ndRuleDoNotDelete" + "Id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/My2ndRuleDoNotDelete" }, { "Description": null, The first step in this example is to work with an existing baseline. The followi "ProvisioningState": "Succeeded", "Name": "ThisRuleNeedsToStay", "Etag": "W/\"d8859256-1c4c-4b93-ba7d-73d9bf67c4f1\"",- "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/ThisRuleNeedsToStay" + "Id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/testrg/providers/Microsoft.Network/networkSecurityGroups/testvm1-nsg/securityRules/ThisRuleNeedsToStay" } ] ``` |
| network-watcher | Network Watcher Packet Capture Manage Powershell Vmss | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/network-watcher-packet-capture-manage-powershell-vmss.md | Get-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -PacketCapture The following example is the output from the `Get-AzNetworkWatcherPacketCapture` cmdlet. The following example is after the capture is complete. The PacketCaptureStatus value is Stopped, with a StopReason of TimeExceeded. This value shows that the packet capture was successful and ran its time. ``` Name : PacketCaptureTest-Id : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatcher +Id : /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatcher s/NetworkWatcher_westcentralus/packetCaptures/PacketCaptureTest Etag : W/"4b9a81ed-dc63-472e-869e-96d7166ccb9b" ProvisioningState : Succeeded-Target : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testrg/providers/Microsoft.Compute/virtualMachines/testvm1 +Target : /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/testrg/providers/Microsoft.Compute/virtualMachines/testvm1 BytesToCapturePerPacket : 0 TotalBytesPerSession : 1073741824 TimeLimitInSeconds : 60 StorageLocation : {- "StorageId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testrg/providers/Microsoft.Storage/storageA + "StorageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/testrg/providers/Microsoft.Storage/storageA ccounts/examplestorage", "StoragePath": "https://examplestorage.blob.core.windows.net/network-watcher-logs/subscriptions/00000000-0000-0000-0000-00000 0000000/resourcegroups/testrg/providers/microsoft.compute/virtualmachines/testvm1/2017/02/01/packetcapture_22_42_48_238.cap" |
| network-watcher | Nsg Flow Logs Azure Resource Manager | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/nsg-flow-logs-azure-resource-manager.md | Example 1 uses the simplest version of the ARM template with minimum parameters "location": "eastus", "apiVersion": "2022-11-01", "properties": {- "targetResourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG", - "storageId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/myStorageAccount", + "targetResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG", + "storageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/myStorageAccount", "enabled": true, "flowAnalyticsConfiguration": {}, "retentionPolicy": {}, Example 2 uses the following template to enable NSG flow logs (version 2) with r "location": "eastus", "apiVersion": "2022-11-01", "properties": {- "targetResourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG", - "storageId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/myStorageAccount", + "targetResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG", + "storageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/myStorageAccount", "enabled": true, "flowAnalyticsConfiguration": { "networkWatcherFlowAnalyticsConfiguration": { "enabled": true,- "workspaceResourceId": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/defaultresourcegroup-eus/providers/Microsoft.OperationalInsights/workspaces/DefaultWorkspace-abcdef01-2345-6789-0abc-def012345678-EUS", + "workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/defaultresourcegroup-eus/providers/Microsoft.OperationalInsights/workspaces/DefaultWorkspace-aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e-EUS", "trafficAnalyticsInterval": 10 } }, |
| network-watcher | Nsg Flow Logs Rest | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/nsg-flow-logs-rest.md | armclient login *Microsoft.Insights* provider must be registered to successfully log traffic flowing through a network security group. If you aren't sure if the *Microsoft.Insights* provider is registered, use [Providers - Register](/rest/api/resources/providers/register) REST API to register it. ```powershell-$subscriptionId = "00000000-0000-0000-0000-000000000000" +$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e" armclient post "https://management.azure.com//subscriptions/${subscriptionId}/providers/Microsoft.Insights/register?api-version=2021-04-01" ``` armclient post "https://management.azure.com//subscriptions/${subscriptionId}/pr The command to enable flow logs version 2 is shown in the following example. For version 1, replace the 'version' field with '1': ```powershell-$subscriptionId = "00000000-0000-0000-0000-000000000000" -$targetUri = "" # example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName/providers/Microsoft.Network/networkSecurityGroups/{nsgName}" -$storageId = "/subscriptions/00000000-0000-0000-0000-000000000000/{resourceGroupName/providers/Microsoft.Storage/storageAccounts/{saName}" +$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e" +$targetUri = "" # example /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName/providers/Microsoft.Network/networkSecurityGroups/{nsgName}" +$storageId = "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/{resourceGroupName/providers/Microsoft.Storage/storageAccounts/{saName}" $resourceGroupName = "NetworkWatcherRG" $networkWatcherName = "NetworkWatcher_westcentralus" $requestBody = @" The response returned from the preceding example is as follows: ```json {- "targetResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}", + "targetResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}", "properties": {- "storageId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{saName}", + "storageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{saName}", "enabled": true, "retentionPolicy": { "days": 5, The response returned from the preceding example is as follows: Use the following example to disable flow logs. The call is the same as enabling flow logs, except **false** is set for the enabled property. ```powershell-$subscriptionId = "00000000-0000-0000-0000-000000000000" -$targetUri = "" # example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName/providers/Microsoft.Network/networkSecurityGroups/{nsgName}" -$storageId = "/subscriptions/00000000-0000-0000-0000-000000000000/{resourceGroupName/providers/Microsoft.Storage/storageAccounts/{saName}" +$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e" +$targetUri = "" # example /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName/providers/Microsoft.Network/networkSecurityGroups/{nsgName}" +$storageId = "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/{resourceGroupName/providers/Microsoft.Storage/storageAccounts/{saName}" $resourceGroupName = "NetworkWatcherRG" $networkWatcherName = "NetworkWatcher_westcentralus" $requestBody = @" The response returned from the preceding example is as follows: ```json {- "targetResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}", + "targetResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}", "properties": {- "storageId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{saName}", + "storageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{saName}", "enabled": false, "retentionPolicy": { "days": 5, The response returned from the preceding example is as follows: The following REST call queries the status of flow logs on a network security group. ```powershell-$subscriptionId = "00000000-0000-0000-0000-000000000000" -$targetUri = "" # example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName/providers/Microsoft.Network/networkSecurityGroups/{nsgName}" +$subscriptionId = "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e" +$targetUri = "" # example /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName/providers/Microsoft.Network/networkSecurityGroups/{nsgName}" $resourceGroupName = "NetworkWatcherRG" $networkWatcherName = "NetworkWatcher_westcentralus" $requestBody = @" The following example shows the response returned: ```json {- "targetResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}", + "targetResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}", "properties": {- "storageId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{saName}", + "storageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{saName}", "enabled": true, "retentionPolicy": { "days": 5, |
| network-watcher | Nsg Flow Logs Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/nsg-flow-logs-tutorial.md | Open the downloaded `PT1H.json` file using a text editor of your choice. The fol "systemId": "00000000-0000-0000-0000-000000000000", "macAddress": "112233445566", "category": "NetworkSecurityGroupFlowEvent",- "resourceId": "/SUBSCRIPTIONS/abcdef01-2345-6789-0abc-def012345678/RESOURCEGROUPS/MYRESOURCEGROUP/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/MYVM-NSG", + "resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/MYRESOURCEGROUP/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/MYVM-NSG", "operationName": "NetworkSecurityGroupFlowEvents", "properties": { "Version": 2, |
| network-watcher | Packet Capture Vm Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/packet-capture-vm-cli.md | The following sample is an example of the response from running `az vm extension { "autoUpgradeMinorVersion": true, "forceUpdateTag": null,- "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}/extensions/NetworkWatcherAgentWindows", + "id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}/extensions/NetworkWatcherAgentWindows", "instanceView": null, "location": "westcentralus", "name": "NetworkWatcherAgentWindows", The following example is the expected output from running the `az network watche "remotePort": "" } ],- "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westcentralus/pa -cketCaptures/packetCaptureName", + "id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westcentralus/packetCaptures/packetCaptureName", "name": "packetCaptureName", "provisioningState": "Succeeded", "resourceGroup": "NetworkWatcherRG", "storageLocation": { "filePath": null,- "storageId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/gwteststorage123abc", - "storagePath": "https://gwteststorage123abc.blob.core.windows.net/network-watcher-logs/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/{resourceGroupName}/p -roviders/microsoft.compute/virtualmachines/{vmName}/2017/05/25/packetcapture_16_22_34_630.cap" + "storageId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/gwteststorage123abc", + "storagePath": "https://gwteststorage123abc.blob.core.windows.net/network-watcher-logs/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/{resourceGroupName}/providers/microsoft.compute/virtualmachines/{vmName}/2017/05/25/packetcapture_16_22_34_630.cap" },- "target": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}", + "target": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}", "timeLimitInSeconds": 18000, "totalBytesPerSession": 1073741824 } The following example is the output from the `az network watcher packet-capture "status": "Succeeded" }, "captureStartTime": "2016-12-06T17:20:01.5671279Z",- "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westcentralus/packetCaptures/packetCaptureName", + "id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westcentralus/packetCaptures/packetCaptureName", "name": "packetCaptureName", "packetCaptureError": [], "packetCaptureStatus": "Stopped", |
| network-watcher | Packet Capture Vm Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/packet-capture-vm-powershell.md | The following output is an example of the output from the `Get-AzNetworkWatcherP ```output ProvisioningState Name Target BytesToCapturePerPacket TotalBytesPerSession TimeLimitInSeconds -- - -- -- -Succeeded myVM_1 /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM 0 1073741824 18000 +Succeeded myVM_1 /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM 0 1073741824 18000 ``` > [!NOTE] To download a packet capture file saved to Azure storage, use [Get-AzStorageBlob ```azurepowershell-interactive # Download the packet capture file from Azure storage container.-Get-AzStorageBlobContent -Container 'network-watcher-logs' -Blob 'subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myresourcegroup/providers/microsoft.compute/virtualmachines/myvm/2024/01/25/packetcapture_22_44_54_342.cap' -Destination 'C:\Capture\myVM_1.cap' +Get-AzStorageBlobContent -Container 'network-watcher-logs' -Blob 'subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myresourcegroup/providers/microsoft.compute/virtualmachines/myvm/2024/01/25/packetcapture_22_44_54_342.cap' -Destination 'C:\Capture\myVM_1.cap' ``` > [!NOTE] |
| network-watcher | Traffic Analytics Policy Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/network-watcher/traffic-analytics-policy-portal.md | To assign any of the *deployIfNotExists* two policies, follow these steps: ## Troubleshooting -Remediation task fails with `PolicyAuthorizationFailed` error code: sample error example *The policy assignment `/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourceGroups/DummyRG/providers/Microsoft.Authorization/policyAssignments/b67334e8770a4afc92e7a929/` resource identity doesn't have the necessary permissions to create deployment.* +Remediation task fails with `PolicyAuthorizationFailed` error code: sample error example *The policy assignment `/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/DummyRG/providers/Microsoft.Authorization/policyAssignments/b67334e8770a4afc92e7a929/` resource identity doesn't have the necessary permissions to create deployment.* In such scenario, the managed identity must be manually granted access. Go to the appropriate subscription/resource group (containing the resources provided in the policy parameters) and grant contributor access to the managed identity created by the policy. |
| operator-nexus | Concepts Compute | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/concepts-compute.md | Azure Operator Nexus offers a group of on-premises cloud solutions that cater to ### Operator Nexus Network Cloud SKUs -For Stock Keeping Unit (SKU) information please see [Operator Nexus Network Cloud SKUs](./reference-operator-nexus-network-cloud-skus-us.md). +For Stock Keeping Unit (SKU) information please see [Operator Nexus Network Cloud SKUs](./reference-operator-nexus-skus.md). |
| operator-nexus | How To Credential Manager Key Vault | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/how-to-credential-manager-key-vault.md | User-assigned identity example: }, ``` -## Using App IDs for Key Vault Access --> [!IMPORTANT] -> Use of App IDs for Customer Key Vault access is deprecated and support will be removed in a future version. It is recommended to use managed identity principals. --Instead of managed identities, the following application IDs grant access to the Key Vault. --- Ensure that the *Microsoft.NetworkCloud* resource provider is registered with the customer subscription.--```console -az provider register --namespace 'Microsoft.NetworkCloud' --subscription <Subscription ID> -``` --- When assigned role access to the key vault, use the following App IDs as principal IDs.--| Environment | App Name | App ID | -|:|:-|:-| -| Production | AFOI-NC-RP-PME-PROD | 05cf5e27-931d-47ad-826d-cb9028d8bd7a | -| Production | AFOI-NC-MGMT-PME-PROD | 3365d4ea-bb16-4bc9-86dd-f2c8cf6f1f56 | - ## Writing Credential Updates to a Customer Key Vault on Nexus Cluster - Assign the *Operator Nexus Key Vault Writer Service Role*. Ensure that *Azure role-based access control* is selected as the permission model for the key vault on the *Access configuration* view. Then from the *Access Control* view, select to add a role assignment. az networkcloud cluster update --ids /subscriptions/<subscription ID>/resourceGr az networkcloud cluster show --ids /subscriptions/<subscription ID>/resourceGroups/<Resource Group Name>/providers/Microsoft.NetworkCloud/clusters/<Nexus Cluster Name> --query secretArchive ``` +For more help: ++```console +az networkcloud cluster update --secret-archive ?? --help +``` + ## Add a permission to User-assigned identity When using a User-assigned identity, add the following role assignment to the UAI resource: When using a User-assigned identity, add the following role assignment to the UA 4. Assign access to: **User, group, or service principal**. 5. Select **Member**: AFOI-NC-MGMT-PME-PROD application. 6. Review and assign.---For more help: --```console -az networkcloud cluster update --secret-archive ?? --help -``` |
| operator-nexus | Howto Configure Cluster | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/howto-configure-cluster.md | az networkcloud cluster create --name "$CLUSTER_NAME" --location "$LOCATION" \ | LAW_ID | Log Analytics Workspace ID for the Cluster | | CLUSTER_LOCATION | The local name of the Cluster | | AGGR_RACK_RESOURCE_ID | RackID for Aggregator Rack |-| AGGR_RACK_SKU | Rack SKU for Aggregator Rack *See [Operator Nexus Network Cloud SKUs](./reference-operator-nexus-network-cloud-skus-us.md) | +| AGGR_RACK_SKU | Rack SKU for Aggregator Rack *See [Operator Nexus Network Cloud SKUs](./reference-operator-nexus-skus.md) | | AGGR_RACK_SN | Rack Serial Number for Aggregator Rack | | AGGR_RACK_LOCATION | Rack physical location for Aggregator Rack | | AGGR_RACK_BMM | Used for single rack deployment only, empty for multi-rack | az networkcloud cluster create --name "$CLUSTER_NAME" --location "$LOCATION" \ | SA_USER | Storage Appliance admin user | | SA_SN | Storage Appliance Serial Number | | COMPX_RACK_RESOURCE_ID | RackID for CompX Rack; repeat for each rack in compute-rack-definitions |-| COMPX_RACK_SKU | Rack SKU for CompX Rack; repeat for each rack in compute-rack-definitions *See [Operator Nexus Network Cloud SKUs](./reference-operator-nexus-network-cloud-skus-us.md) | +| COMPX_RACK_SKU | Rack SKU for CompX Rack; repeat for each rack in compute-rack-definitions *See [Operator Nexus Network Cloud SKUs](./reference-operator-nexus-skus.md) | | COMPX_RACK_SN | Rack Serial Number for CompX Rack; repeat for each rack in compute-rack-definitions | | COMPX_RACK_LOCATION | Rack physical location for CompX Rack; repeat for each rack in compute-rack-definitions | | COMPX_SVRY_BMC_PASS | CompX Rack ServerY Baseboard Management Controller (BMC) password; repeat for each rack in compute-rack-definitions and for each server in rack | |
| operator-nexus | Howto Monitor Naks Cluster | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/howto-monitor-naks-cluster.md | Documentation for starting with [Azure CLI](/cli/azure/get-started-with-azure-cl Install latest version of the [necessary CLI extensions](./howto-install-cli-extensions.md). -## Monitor Nexus Kubernetes cluster – VM layer +## Monitor Nexus Kubernetes cluster -This how-to guide provides steps and utility scripts to [Arc connect](/azure/azure-arc/servers/overview) the Nexus Kubernetes cluster Virtual Machines to Azure and enable monitoring agents for the collection of System logs from these VMs using [Azure Monitoring Agent](/azure/azure-monitor/agents/agents-overview). +This how-to guide provides steps to enable monitoring agents for the collection of System logs from these VMs using [Azure Monitoring Agent](/azure/azure-monitor/agents/agents-overview). The instructions further capture details on how to set up log data collection into a Log Analytics workspace. -The following resources provide you with support: --- `arc-connect.env`: use this template file to create environment variables needed by included scripts-- `dcr.sh`: use this script to create a Data Collection Rule (DCR) to configure syslog collection-- `assign.sh`: use the script to create a policy to associate the DCR with all Arc-enabled servers in a resource group-- `install.sh`: Install Azure Monitoring Agent on each VM to collect monitoring data from Azure Virtual Machines. --### Prerequisites-VM +### Prerequisites - Cluster administrator access to the Nexus Kubernetes cluster. Assign the service principal to the Azure resource group that has the machines t | [User Access Administrator](../role-based-access-control/built-in-roles.md#user-access-administrator), and [Resource Policy Contributor](../role-based-access-control/built-in-roles.md#resource-policy-contributor) or [Contributor](../role-based-access-control/built-in-roles.md#contributor) | Needed if you want to use Azure policy assignment(s) to ensure that a DCR is associated with [Arc-enabled machines](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fd5c37ce1-5f52-4523-b949-f19bf945b73a) | | [Kubernetes Extension Contributor](../role-based-access-control/built-in-roles.md#kubernetes-extension-contributor) | Needed to deploy the K8s extension for Container Insights | -### Environment setup --Copy and run the included scripts. You can run them from an -[Azure Cloud Shell](../cloud-shell/overview.md), in the Azure portal. Or you can run them from a Linux command -prompt where the Kubernetes command line tool (kubectl) and Azure CLI are installed. --Prior to running the included scripts, define the following environment variables: --| Environment Variable | Description | -||| -| SUBSCRIPTION_ID | The ID of the Azure subscription that contains the resource group | -| RESOURCE_GROUP | The resource group name where Arc-enabled server and associated resources are created | -| LOCATION | The Azure Region where the Arc-enabled servers and associated resources are created | -| SERVICE_PRINCIPAL_ID | The appId of the Azure service principal with appropriate role assignment(s) | -| SERVICE_PRINCIPAL_SECRET | The authentication password for the Azure service principal | -| TENANT_ID | The ID of the tenant directory where the service principal exists | -| PROXY_URL | The proxy URL to use for connecting to Azure services | -| NAMESPACE | The namespace where the Kubernetes artifacts are created | --For convenience, you can modify the template file, `arc-connect.env`, to set the environment variable values. --```bash -# Apply the modified values to the environment - ./arc-connect.env -``` --### Add a data collection rule (DCR) --Associate the Arc-enabled servers with a DCR to enable the collection of log data into a Log Analytics workspace. -You can create the DCR via the Azure portal or CLI. -Information on creating a DCR to collect data from the VMs is available [here](/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent). --The included **`dcr.sh`** script creates a DCR, in the specified resource group, that will configure log collection. --1. Ensure proper [environment setup](#environment-setup) and role [prerequisites](#prerequisites-vm) for the service principal. The DCR is created in the specified resource group. --2. Create or identify a Log Analytics workspace for log data ingestion as per the DCR. Set an environment variable, LAW_RESOURCE_ID to its resource ID. Retrieve the resource ID for a known Log Analytics workspace name: -- ```bash - export LAW_RESOURCE_ID=$(az monitor log-analytics workspace show -g "${RESOURCE_GROUP}" -n <law name> --query id -o tsv) - ``` --3. Run the dcr.sh script. It creates a DCR in the specified resource group with name ${RESOURCE_GROUP}-syslog-dcr --```bash -./dcr.sh -``` --View/manage the DCR from the Azure portal or [CLI](/cli/azure/monitor/data-collection/rule). -By default, the Linux Syslog log level is set to "INFO". You can change the log level as needed. --> [!NOTE] -> Manually, or via a policy, associate servers created prior to the DCR's creation. -See [remediation task](../governance/policy/how-to/remediate-resources.md#create-a-remediation-task). --### Associate Arc-enabled server resources to DCR --Associate the Arc-enabled server resources to the created DCR for logs to flow to the Log Analytics workspace. -There are options for associating servers with DCRs. --#### Use Azure portal or CLI to associate selected Arc-enabled servers to DCR --In Azure portal, add Arc-enabled server resource to the DCR using its Resources section. +### Monitor Nexus Kubernetes cluster -Use this [link](/cli/azure/monitor/data-collection/rule/association#az-monitor-data-collection-rule-association-create) -for information about associating the resources via the Azure CLI. --### Use Azure policy to manage DCR associations --Assign a policy to the resource group to enforce the association. -There's a built-in policy definition, to associate [Linux Arc Machines with a DCR](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fd5c37ce1-5f52-4523-b949-f19bf945b73a). Assign the policy to the resource group with DCR as a parameter. -It ensures association of all Arc-enabled servers, within the resource group, with the same DCR. --In the Azure portal, select the `Assign` button from the [policy definition](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fd5c37ce1-5f52-4523-b949-f19bf945b73a) page. --For convenience, the provided **`assign.sh`** script assigns the built-in policy to the specified resource group and DCR created with the **`dcr.sh`** script. --1. Ensure proper [environment setup](#environment-setup) and role [prerequisites](#prerequisites-vm) for the service principal to do policy and role assignments. -2. Create the DCR, in the resource group, using **`dcr.sh`** script as described in [Adding a Data Collection Rule](/azure/azure-monitor/essentials/data-collection-endpoint-overview?tabs=portal#create-a-data-collection-endpoint) section. -3. Run the **`assign.sh`** script. It creates the policy assignment and necessary role assignments. --```bash -./assign.sh -``` --#### Install Azure monitoring agent --Use the included **`install.sh`** which creates a Kubernetes daemonSet on the Nexus Kubernetes cluster. -It deploys a pod to each cluster node and installs the Azure Monitoring Agent (AMA). -The `daemonSet` also includes a liveness probe that monitors the server connection and AMA processes. -> [!NOTE] -> To install Azure Monitoring Agent, you must first Arc connect the Nexus Kubernetes cluster VMs. This process is automated if you are using the latest version bundle. However, if the version bundle you use does not support cluster VM Arc enrollment by default, you will need to upgrade your cluster to the latest version bundle. For more information about the version bundle, please refer [Nexus Kubernetes cluster supported versions](reference-nexus-kubernetes-cluster-supported-versions.md) --1. Set the environment as specified in [Environment Setup](#environment-setup). Set the current `kubeconfig` context for the Nexus Kubernetes cluster VMs. -2. Permit `Kubectl` access to the Nexus Kubernetes cluster. - [!INCLUDE [cluster-connect](./includes/kubernetes-cluster/cluster-connect.md)] -3. Run the **`install.sh`** script from the command prompt with kubectl access to the Nexus Kubernetes cluster. --The script deploys the `daemonSet` to the cluster. Monitor the progress as follows: --```bash -# Run the install script and observe results -./install.sh -kubectl get pod --selector='name=naks-vm-telemetry' -kubectl logs <podname> -``` --On completion, the system logs the message "Server monitoring configured successfully". --> [!NOTE] -> Associate these connected servers to the [DCR](#associate-arc-enabled-server-resources-to-dcr). -After you configure a policy, there may be some delay to observe the logs in Azure Log Analytics Workspace --### Monitor Nexus Kubernetes cluster – K8s layer --#### Prerequisites-Kubernetes +#### Prerequisites There are certain prerequisites the operator should ensure to configure the monitoring tools on Nexus Kubernetes Clusters. Container Insights stores its data in a [Log Analytics workspace](/azure/azure-monitor/logs/log-analytics-workspace-overview).-Log data flows into the workspace whose Resource ID you provided during the initial scripts covered in the ["Add a data collection rule (DCR)"](#add-a-data-collection-rule-dcr) section. +Log data flows into the workspace whose Resource ID you provided during the installation of the Container Insights extension. Else, data funnels into a default workspace in the Resource group associated with your subscription (based on Azure location). An example for East US may look like follows: Look for a Provisioning State of "Succeeded" for the extension. The "k8s-extensi #### Customize logs & metrics collection -Container Insights provides end-users functionality to fine-tune the collection of logs and metrics from Nexus Kubernetes Clusters--[Configure Container insights agent data collection](/azure/azure-monitor/containers/container-insights-data-collection-configmap). +Container Insights provides end-users functionality to fine-tune the collection of logs and metrics from Nexus Kubernetes Clusters. See the instructions for [Configure Container insights agent data collection](/azure/azure-monitor/containers/container-insights-data-collection-configure) for more information. +++> [!NOTE] +> Container Insights does not collect logs from the `kube-system` namespace by default. To collect logs from the `kube-system` namespace, you must configure the agent to collect logs from the `kube-system` namespace. +> This can be done by removing the `kube-system` namespace from the `excludedNamespaces` field in the ConfigMap following the [`configMap` configuraiton](/azure/azure-monitor/containers/container-insights-data-collection-configure?tabs=portal#configure-data-collection-using-configmap) approach. +> ``` +> [log_collection_settings] +> [log_collection_settings.stdout] +> # In the absense of this configmap, default value for enabled is true +> enabled = true +> # exclude_namespaces setting holds good only if enabled is set to true +> # kube-system,gatekeeper-system log collection are disabled by default in the absence of 'log_collection_settings.stdout' setting. If you want to enable kube-system,gatekeeper-system, remove them from the following setting. +> # If you want to continue to disable kube-system,gatekeeper-system log collection keep the namespaces in the following setting and add any other namespace you want to disable log collection to the array. +> # In the absense of this configmap, default value for exclude_namespaces = ["kube-system","gatekeeper-system"] +> exclude_namespaces = ["gatekeeper-system"] +> # If you want to collect logs from only selective pods inside system namespaces add them to the following setting. Provide namepace:controllerName of the system pod. NOTE: this setting is only for pods in system namespaces +> # Valid values for system namespaces are: kube-system, azure-arc, gatekeeper-system, kube-public, kube-node-lease, calico-system. The system namespace used should not be present in exclude_namespaces +> # collect_system_pod_logs = ["kube-system:coredns"] +> +> [log_collection_settings.stderr] +> # Default value for enabled is true +> enabled = true +> # exclude_namespaces setting holds good only if enabled is set to true +> # kube-system,gatekeeper-system log collection are disabled by default in the absence of 'log_collection_settings.stderr' setting. If you want to enable kube-system,gatekeeper-system, remove them from the following setting. +> # If you want to continue to disable kube-system,gatekeeper-system log collection keep the namespaces in the following setting and add any other namespace you want to disable log collection to the array. +> # In the absense of this configmap, default value for exclude_namespaces = ["kube-system","gatekeeper-system"] +> exclude_namespaces = ["gatekeeper-system"] +> # If you want to collect logs from only selective pods inside system namespaces add them to the following setting. Provide namepace:controllerName of the system pod. NOTE: this setting is only for pods in system namespaces +> # Valid values for system namespaces are: kube-system, azure-arc, gatekeeper-system, kube-public, kube-node-lease, calico-system. The system namespace used should not be present in exclude_namespaces +> # collect_system_pod_logs = ["kube-system:coredns"] +>``` + ## Extra resources |
| operator-nexus | Reference Near Edge Storage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/reference-near-edge-storage.md | Within each Azure Operator Nexus storage appliance, multiple storage devices are This table lists the available SKUs for the storage appliance in the near-edge Azure Operator Nexus offering. -| SKU | Description | -| -- | - | -| Pure x70r3-91 | Storage appliance model x70r3-91 provided by Pure Storage | +### Pure FlashArray ++| SKU | Total raw storage capacity | Usable raw storage capacity | +| -- | -- | | +| Pure FlashArray X70R4-45TB | 45 TB | 25.74 TB | +| Pure FlashArray X70R4-91TB | 91 TB | 54.75 TB | +| Pure FlashArray X70R4-183TB | 183 TB | 114.66 TB | +| Pure FlashArray X70R4-366TB | 366 TB | 272.36 TB | +| Pure FlashArray X70R4-622TB | 622 TB | 457.23 TB | ++### Raw vs effective storage capacity ++The Pure FlashArray contains a variety of data reduction features. The effective capacity of the storage appliance, which gives the amount of data that can be stored from the workload's perspective, is typically larger than the raw capacity. The effective capacity depends strongly on the data being stored. For example, pre-compressed or application-encrypted data achieves lower data reduction ratios on the storage appliance than data with high levels of duplication. Pure storage can model likely achievable data reduction ratios and effective capacity for a wide variety of workloads to help you choose a SKU with a suitable amount of storage capacity. ## Storage connectivity This table lists the characteristics of the storage appliance. | Property | Specification/Description | | -- | -|-| Raw storage capacity | 91 TB | -| Usable capacity | 50 TB | -| Number of maximum I/O operations supported per second <br>(with 80/20 read/write ratio) | 250K+ (4K) <br>150K+ (16K) | -| Number of I/O operations supported per volume per second | 50K+ | +| Raw storage capacity | Determined by SKU - see [Available SKUs](#available-skus) | +| Usable capacity | Determined by SKU - see [Available SKUs](#available-skus) | +| Number of maximum I/O operations supported per second <br>(with 80/20 read/write ratio) | 250 K+ (4K) <br>150 K+ (16K) | +| Number of I/O operations supported per volume per second | 50 K+ | | Maximum I/O latency supported | 10 ms | | Nominal failover time supported | 10 s | |
| operator-nexus | Reference Operator Nexus Fabric Skus | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/reference-operator-nexus-fabric-skus.md | - Title: Azure Operator Nexus Fabric SKUs -description: SKU options for Azure Operator Nexus Network Fabric - Previously updated : 04/18/2024------# Azure Operator Nexus Fabric SKUs --Operator Nexus Fabric SKUs for Azure Operator Nexus are meticulously designed to streamline the procurement and deployment processes, offering standardized bill of materials (BOM), topologies, wiring, and workflows. Microsoft crafts and prevalidates each SKU in collaboration with OEM vendors, ensuring seamless integration and optimal performance for operators. --Operator Nexus Fabric SKUs offer a comprehensive range of options, allowing operators to tailor their deployments according to their specific requirements. With prevalidated configurations and standardized BOMs, the procurement and deployment processes are streamlined, ensuring efficiency and performance across the board. --The following table outlines the various configurations of Operator Nexus Fabric SKUs, catering to different use-cases and functionalities required by operators. --| S.No | Use-Case | Network Fabric SKU ID | Description | BOM Components | -||--|--||| -| 1 | Multi Rack Near-Edge | M4-A400-A100-C16-ab | - Support 400-Gbps link between Nexus fabric CEs and Provider Edge PEs.<br> - Support up to four compute rack deployment and aggregator rack.<br> - Each compute rack can have racks of up to 16 compute servers.<br> - One Network Packet Broker. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Top the rack switches per rack deployed.<br> - One Management switch per compute rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Cable and optics. | -| 2 | Multi Rack Near-Edge | M8-A400-A100-C16-ab | - Support 400-Gbps link between Nexus fabric CEs and Provider Edge PEs.<br> - Supports up to eight compute rack deployment and aggregator rack.<br> - Each compute rack can have racks of up to 16 compute servers.<br> - For deployments with 1 to 4 compute racks, one Network Packet Broker is required. <br> - For deployments with 5 to 8 compute racks, two Network Packet Brokers are needed. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Network packet broker device(s).<br> - Terminal Server.<br> - Cable and optics. | -| 3 | Multi Rack Near-Edge | M8-A100-A25-C16-aa | - Support 100-Gbps link between Nexus fabric CEs and Provider Edge PEs.<br>Supports up to eight compute rack deployment and aggregator rack.<br> - Each compute rack can have racks of up to 16 compute servers.<br> - For deployments with 1 to 4 compute racks, one Network Packet Broker is required. <br> - For deployments with 5 to 8 compute racks, two Network Packet Brokers are needed. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Top the rack switches per rack deployed.<br> - One Management switch per compute rack deployed.<br> - Network packet broker device(s).<br> - Terminal Server.<br> - Cable and optics | -| 4 | Single Rack Near-Edge | S-A100-A25-C12-aa | - Supports 100-Gbps link between Nexus fabric CEs and PEs<br>Single rack with shared aggregator and compute rack<br> - Each compute rack can have racks of up to 12 compute servers<br>One Network Packet Broker. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Management switches.<br> - Network packet broker device.<br> - Terminal Server.<br> - Cable and optics | --**Notes:** --- Bill of materials (BOM) adheres to nexus network fabric specifications.-- All subscribed customers have the privilege to request BOM details. |
| operator-nexus | Reference Operator Nexus Network Cloud Skus Us | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/reference-operator-nexus-network-cloud-skus-us.md | - Title: Azure Operator Nexus Network Cloud SKUs -description: SKU options for Azure Operator Nexus Network Cloud - Previously updated : 10/24/2024------# Azure Operator Nexus Network Cloud Stock Keeping Units (SKUs) --Operator Nexus Network Cloud SKUs for Azure Operator Nexus are meticulously designed to streamline the procurement and deployment processes, offering standardized bill of materials (BOM), topologies, wiring, and workflows. Microsoft crafts and prevalidates each SKU in collaboration with OEM vendors, ensuring seamless integration and optimal performance for operators. --Operator Nexus Network Cloud SKUs offer a comprehensive range of options, allowing operators to tailor their deployments according to their specific requirements. With prevalidated configurations and standardized BOMs, the procurement and deployment processes are streamlined, ensuring efficiency and performance across the board. --The following table outlines the various configurations of Operator Nexus Network Cloud SKUs, catering to different use-cases and functionalities required by operators. --| Version | Use-Case | Network Cloud SKU ID | Description | BOM Components | -||--|--||| -| 1.7.3 | Multi Rack Near-Edge Aggregation (Agg) Rack | VNearEdge1_Aggregator_x70r3_9 | Aggregation Rack with Pure x70r3 | - Pair of Customer Edge Devices required for SKU.<br> - Two Management switch per rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Pure storage array.<br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_4C2M | Support up to eight Compute Racks where each rack can support four compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to four Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_8C2M | Support up to eight Compute Racks where each rack can support eight compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to eight Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_12C2M | Support up to eight Compute Racks where each rack can support 12 compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to 12 Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_16C2M | Support up to eight Compute Racks where each rack can support 16 compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to 16 Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_4C2M | 100G Fabric support up to eight Compute Racks where each rack can support four compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to four Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_8C2M | 100G Fabric support up to eight Compute Racks where each rack can support eight compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to eight Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_12C2M | 100G Fabric support up to eight Compute Racks where each rack can support 12 compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to 12 Compute servers per compute rack deployed. <br> - Cable and optics. | -| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_16C2M | 100G Fabric support up to eight Compute Racks where each rack can support 16 compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to 16 Compute servers per compute rack deployed. <br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_4C2M | Support up to eight Compute Racks where each rack can support four compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to four Compute servers per compute rack deployed. <br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_8C2M | Support up to eight Compute Racks where each rack can support eight compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to eight Compute servers per compute rack deployed. <br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_12C2M | Support up to eight Compute Racks where each rack can support 12 compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to 12 Compute servers per compute rack deployed. <br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_16C2M | Support up to eight Compute Racks where each rack can support 16 compute servers. | - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Two Management server per compute rack deployed. <br> - Up to 16 Compute servers per compute rack deployed. <br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Agg | VNearEdge4_Aggregator_x70r4 | Aggregation Rack with Pure x70r4. | - Pair of Customer Edge Devices required for SKU.<br> - Two Management switch per rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Pure storage array.<br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Agg | VNearEdge4_Aggregator_x70r3 | Aggregation Rack with Pure x70r3. | - Pair of Customer Edge Devices required for SKU.<br> - Two Management switch per rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Pure storage array.<br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Agg | VNearEdge4_Aggregator_x20r4 | Aggregation Rack with Pure x70r4. | - Pair of Customer Edge Devices required for SKU.<br> - Two Management switch per rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Pure storage array.<br> - Cable and optics. | -| 2.0.0 | Multi Rack Near-Edge Agg | VNearEdge4_Aggregator_x20r3 | Aggregation Rack with Pure x70r3. | - Pair of Customer Edge Devices required for SKU.<br> - Two Management switch per rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Pure storage array.<br> - Cable and optics. | --**Notes:** -- Bill of materials (BOM) adheres to Nexus Network Cloud specifications.-- All subscribed customers have the privilege to request BOM details. |
| operator-nexus | Reference Operator Nexus Skus | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-nexus/reference-operator-nexus-skus.md | + + Title: Azure Operator Nexus SKUs +description: SKU options for Azure Operator Nexus + Last updated : 10/31/2024++++++# Azure Operator Nexus SKUs ++Operator Nexus SKUs for Azure Operator Nexus are meticulously designed to streamline the procurement and deployment processes, offering standardized bill of materials (BOM), topologies, wiring, and workflows. Microsoft crafts and pre-validates each SKU in collaboration with OEM vendors, ensuring seamless integration and optimal performance for operators. ++Operator Nexus offer a comprehensive range of options, allowing operators to tailor their deployments according to their specific requirements. With pre-validated configurations and standardized BOMs, the procurement and deployment processes are streamlined, ensuring efficiency and performance across the board. ++## Fabric SKUs ++The following table outlines the various configurations of Operator Nexus Fabric SKUs, catering to different use-cases and functionalities required by operators. ++| S.No | Use-Case | Network Fabric SKU ID | Description | BOM Components | +||--|--||| +| 1 | Multi Rack Near-Edge | M4-A400-A100-C16-ab | - Support 400-Gbps link between Nexus fabric CEs and Provider Edge PEs.<br> - Support up to four compute rack deployment and aggregator rack.<br> - Each compute rack can have racks of up to 16 compute servers.<br> - One Network Packet Broker. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Top the rack switches per rack deployed.<br> - One Management switch per compute rack deployed.<br> - Network packet broker device.<br> - Terminal Server.<br> - Cable and optics. | +| 2 | Multi Rack Near-Edge | M8-A400-A100-C16-ab | - Support 400-Gbps link between Nexus fabric CEs and Provider Edge PEs.<br> - Supports up to eight compute rack deployment and aggregator rack.<br> - Each compute rack can have racks of up to 16 compute servers.<br> - For deployments with 1 to 4 compute racks, one Network Packet Broker is required. <br> - For deployments with 5 to 8 compute racks, two Network Packet Brokers are needed. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Top the rack switches per rack deployed. <br> - One Management switch per compute rack deployed.<br> - Network packet broker device(s).<br> - Terminal Server.<br> - Cable and optics. | +| 3 | Multi Rack Near-Edge | M8-A100-A25-C16-aa | - Support 100-Gbps link between Nexus fabric CEs and Provider Edge PEs.<br>Supports up to eight compute rack deployment and aggregator rack.<br> - Each compute rack can have racks of up to 16 compute servers.<br> - For deployments with 1 to 4 compute racks, one Network Packet Broker is required. <br> - For deployments with 5 to 8 compute racks, two Network Packet Brokers are needed. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Top the rack switches per rack deployed.<br> - One Management switch per compute rack deployed.<br> - Network packet broker device(s).<br> - Terminal Server.<br> - Cable and optics | +| 4 | Single Rack Near-Edge | S-A100-A25-C12-aa | - Supports 100-Gbps link between Nexus fabric CEs and PEs<br>Single rack with shared aggregator and compute rack<br> - Each compute rack can have racks of up to 12 compute servers<br>One Network Packet Broker. | - Pair of Customer Edge Devices required for SKU.<br> - Pair of Management switches.<br> - Network packet broker device.<br> - Terminal Server.<br> - Cable and optics | ++## Compute SKUs ++The following table outlines the various configurations of Operator Nexus Network Cloud SKUs, catering to different use-cases and functionalities required by operators. ++| Version | Use-Case | Network Cloud SKU ID | Description | +|||--|-| +| 1.7.3 | Multi Rack Near-Edge Aggregator | VNearEdge1_Aggregator_x70r3_9 | Aggregation Rack with Pure x70r3 | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_4C2M | 400G Fabric support up to eight Compute Racks where each rack can support four compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_8C2M | 400G Fabric support up to eight Compute Racks where each rack can support eight compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_12C2M | 400G Fabric support up to eight Compute Racks where each rack can support 12 compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge1_Compute_DellR750_16C2M | 400G Fabric support up to eight Compute Racks where each rack can support 16 compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_4C2M | 100G Fabric support up to eight Compute Racks where each rack can support four compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_8C2M | 100G Fabric support up to eight Compute Racks where each rack can support eight compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_12C2M | 100G Fabric support up to eight Compute Racks where each rack can support 12 compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge2_Compute_DellR650_16C2M | 100G Fabric support up to eight Compute Racks where each rack can support 16 compute servers. | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge3_Compute_DellR750_7C3M | 400G Fabric support up to eight Compute Racks where each rack can support seven Dell750 computes, one Dell750 high-iops controller, and two Dell650 controllers | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEVNearEdge3_Compute_DellR750_11C3M | 400G Fabric support up to eight Compute Racks where each rack can support 11 Dell750 computes, one Dell750 high-iops controller, and two Dell650 controllers | +| 1.7.3 | Multi Rack Near-Edge Compute | VNearEdge3_Compute_DellR750_15C3M | 400G Fabric support up to eight Compute Racks where each rack can support 15 Dell750 computes, one Dell750 high-iops controller, and two Dell650 controllers | +| 2.0.0 | Multi Rack Near-Edge Aggregator | VNearEdge4_Aggregator_x70r4 | Aggregation Rack with Pure x70r4. | +| 2.0.0 | Multi Rack Near-Edge Aggregator | VNearEdge4_Aggregator_x70r3 | Aggregation Rack with Pure x70r3. | +| 2.0.0 | Multi Rack Near-Edge Aggregator | VNearEdge4_Aggregator_x20r4 | Aggregation Rack with Pure x70r4. | +| 2.0.0 | Multi Rack Near-Edge Aggregator | VNearEdge4_Aggregator_x20r3 | Aggregation Rack with Pure x70r3. | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_4C2M | 400G Fabric support up to eight Compute Racks where each rack can support four compute servers. | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_8C2M | 400G Fabric support up to eight Compute Racks where each rack can support eight compute servers. | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_12C2M | 400G Fabric support up to eight Compute Racks where each rack can support 12 compute servers. | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_16C2M | 400G Fabric support up to eight Compute Racks where each rack can support 16 compute servers. | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_7C3M | 400G Fabric support up to eight Compute Racks where each rack can support seven Dell750 computes, 1 Dell750 high-iops controller, and 2 Dell650 controllers | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEVNearEdge4_Compute_DellR760_11C3M | 400G Fabric support up to eight Compute Racks where each rack can support 11 Dell750 computes, one Dell750 high-iops controller, and two Dell650 controllers | +| 2.0.0 | Multi Rack Near-Edge Compute | VNearEdge4_Compute_DellR760_15C3M | 400G Fabric support up to eight Compute Racks where each rack can support 15 Dell750 computes, one Dell750 high-iops controller, and two Dell650 controllers | +++**Notes:** ++- Bill of materials (BOM) adheres to nexus network fabric specifications. +- All subscribed customers have the privilege to request BOM details. |
| operator-service-manager | Get Started With Cluster Registry | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-service-manager/get-started-with-cluster-registry.md | Improve resiliency for cloud native network functions with Azure Operator Servic * First version, with HA for NF kubernetes extension: 2.0.2810-144 ## Introduction-Azure Operator Service Manager (AOSM) cluster registry (CR) enables a local copy of container images in the Nexus K8s cluster. When the containerized network function (CNF) is installed with cluster registry enabled, the container images are pulled from the remote AOSM artifact store and saved to a local registry. With cluster register, CNF access to container images survives loss of connectivity to the remote artifact store. +Azure Operator Service Manager (AOSM) cluster registry (CR) enables a local copy of container images in the Nexus K8s cluster. When the containerized network function (CNF) is installed with cluster registry enabled, the container images are pulled from the remote AOSM artifact store and saved to this local cluster registry. Using a mutating webhook, cluster registry automatically intercepts image requests and substitutes the local registry path, to avoid publisher packaging changes. With cluster register, CNF access to container images survives loss of connectivity to the remote artifact store. -### Key use cases +### Key use cases and benefits Cloud native network functions (CNF) need access to container images, not only during the initial deployment using AOSM artifact store, but also to keep the network function operational. Some of these scenarios include: * Pod restarts: Stopping and starting a pod can result in a cluster node pulling container images from the registry. * Kubernetes scheduler operations: During pod to node assignments, according to scheduler profile rules, if the new node does not have the container images locally cached, the node pulls container images from the registry. -In the above scenarios, if there's a temporary issue with accessing the AOSM artifact store, the cluster registry provides the necessary container images to prevent disruption to the running CNF. Also, the AOSM cluster registry feature decreases the number of image pull requests on AOSM artifact store since each Nexus K8s node pulls container images from the cluster registry instead of the AOSM artifact store. +Benefits of using AOSM cluster registry: +* Provides the necessary local images to prevent CNF disruption where connectivity to AOSM artifact store is lost. +* Decreases the number of image pulls on AOSM artifact store, since each cluster node now pulls images only from the local registry. +* Overcomes issues with malformed registry URLs, by using a mutating webhook to substitute the proper local registry URL path. ## How cluster registry works-AOSM cluster registry is enabled using the Network Function Operator Arc K8s extension. The following CLI shows how cluster registry is enabled on a Nexus K8s cluster. +AOSM cluster registry is enabled using the Network Function Operator (NFO) Arc K8s extension. The following CLI shows how cluster registry is enabled on a Nexus K8s cluster. ```bash az k8s-extension create --cluster-name --cluster-type {connectedClusters} When the cluster registry feature is enabled in the Network Function Operator Ar > [!NOTE] > If the user doesn't provide any input, a default persistent volume of 100 GB is used. +### Cluster registry components +The cluster registry feature deploys helper pods on the target edge cluster to assist the NFO extension. ++#### Component reconciler +* This main pod takes care of reconciling component Custom Resource Objects (CROs) created by K8sBridge with the help of the Microsoft.Kubernetes resource provider (RP), Hybrid Relay, and Arc agent running on the cluster. ++#### Pod mutating webhook +* These pods implement Kubernetes mutating admission webhooks, serving an instance of the mutate API. The mutate API does two things: + * It modifies the image registry path to the local registry IP, substituting out the AOSM artifact store Azure container registry (ACR). + * It creates an Artifact CR on the edge cluster. ++#### Artifact reconciler +* This pod reconciles artifact CROs created by the mutating webhook. ++#### Registry +* This pod stores and retrieves container images for CNF. + ## High availability and resiliency considerations The AOSM NF extension relies uses a mutating webhook and edge registry to support key features. * Onboarding helm charts without requiring customization of image path. With HA, cluster registry and webhook pods now support a replicaset with a minim #### DeploymentStrategy * A rollingUpdate strategy is used to help achieve zero downtime upgrades and support gradual rollout of applications. Default maxUnavailable configuration allows only one pod to be taken down at a time, until enough pods are created to satisfying redundancy policy. #### Pod Disruption Budget-* A policy distruption budget (PDB) protects pods from voluntary disruption and is deployed alongside Deployment, ReplicaSet, or StatefulSet objects. For AOSM operator pods, a PDB with minAvailable parameter of 2 is used. +* A policy disruption budget (PDB) protects pods from voluntary disruption and is deployed alongside Deployment, ReplicaSet, or StatefulSet objects. For AOSM operator pods, a PDB with minAvailable parameter of 2 is used. #### Pod anti-affinity * Pod anti-affinity controls distribution of application pods across multiple nodes in your cluster. With HA, AOSM pod anti-affinity using the following parameters: * A scheduling mode is used to define how strictly the rule is enforced. With HA, cluster registry and webhook pods now support a replicaset with a minim #### Horizontal scaling * In Kubernetes, a HorizontalPodAutoscaler (HPA) automatically updates a workload resource with the aim of automatically scaling the workload to match demand. AOSM operator pods have the following HPA policy parameters configured;- * A minimum replicas of three. - * A maximum replicas of five. + * A minimum replica of three. + * A maximum replica of five. * A targetAverageUtilization for cpu and memory of 80%. #### Resource limits All AOSM operator containers are configured with appropriate request, limit for #### Known HA Limitations * Nexus AKS (NAKS) clusters with single active node in system agent pool are not suitable for highly available. Nexus production topology must use at least three active nodes in system agent pool.-* The nexus-shared storage class is a network file system (NFS) storage service. This NFS storage service is available per Cloud Service Network (CSN). Any Nexus Kubernetes cluster attached to the CSN can provision persistent volume from this shared storage pool. The storage pool is currently limited to a maximum size of 1TiB as of Network Cloud (NC) 3.10 where-as NC 3.12 has a 16-TiB option. +* The nexus-shared storage class is a network file system (NFS) storage service. This NFS storage service is available per Cloud Service Network (CSN). Any Nexus Kubernetes cluster attached to the CSN can provision persistent volume from this shared storage pool. The storage pool is currently limited to a maximum size of 1 TiB as of Network Cloud (NC) 3.10 where-as NC 3.12 has a 16-TiB option. * Pod Anti affinity only deals with the initial placement of pods, subsequent pod scaling, and repair, follows standard K8s scheduling logic. ## Frequently Asked Questions |
| reliability | Glossary | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/glossary.md | - Title: Azure resiliency terminology -description: Understanding terms ---- Previously updated : 10/01/2021-----# Reliability terminology --To better understand regions and availability zones in Azure, it helps to understand key terms or concepts. ----| Term | Definition | -|-|-| -| Region | A geographic perimeter that contains a set of datacenters. | -| Datacenter | A facility that contains servers, networking equipment, and other hardware to support Azure resources and workloads. | -| Availability zone | [A separated group of datacenters within a region](./availability-zones-overview.md). Each availability zone is independent of the others, with its own power, cooling, and networking infrastructure. [Many regions support availability zones](./availability-zones-service-support.md) | -| Paired regions |A relationship between two Azure regions. [Some Azure regions](./cross-region-replication-azure.md#azure-paired-regions) are connected to another defined region to enable specific types of multi-region solutions. [Newer Azure regions aren't paired](./cross-region-replication-azure.md#regions-with-availability-zones-and-no-region-pair) | -| Region architecture | The specific configuration of the Azure region, including the number of availability zones and whether the region is paired with another region. | -| Locally redundant deployment | A deployment model in which a resource is deployed into a single region without reference to an availability zone. In a region that supports availability zones, the resource might be deployed in any of the region's availability zones. | -| Zonal (pinned) deployment | A deployment model in which a resource is deployed into a specific availability zone. | -| Zone-redundant deployment | A deployment model in which a resource is deployed across multiple availability zones. Microsoft manages data synchronization, traffic distribution, and failover if a zone experiences an outage. | -| Multi-region deployment| A deployment model in which resources are deployed into multiple Azure regions. | -| Asynchronous replication | A data replication approach in which data is written and committed to one location. At a later time, the changes are replicated to another location. | -| Synchronous replication | A data replication approach in which data is written and committed to multiple locations. Each location must acknowledge completion of the write operation before the overall write operation is considered complete. | -| Active-active | An architecture in which multiple instances of a solution actively process requests at the same time. | -| Active-passive | An architecture in which one instance of a solution is designated as the *primary* and processes traffic, and one or more *secondary* instances are deployed to serve traffic if the primary is unavailable. | - |
| reliability | Overview Reliability Guidance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/overview-reliability-guidance.md | Title: Reliability guidance overview for Microsoft Azure products and services -description: Reliability guidance overview for Microsoft Azure products and services. View Azure service specific reliability guides and Azure Service Manager Retirement guides. + Title: Azure service reliability guides +description: Reliability guides for Microsoft Azure products and services. View Azure service specific reliability guides. Previously updated : 03/31/2023 Last updated : 11/01/2024 -# Reliability guidance overview --Azure reliability guidance contains the following: --- **Service-specific reliability guides**. Each guide can cover both intra-regional resiliency with [availability zones](availability-zones-overview.md) and information on [cross-region resiliency with disaster recovery](cross-region-replication-azure.md). -For a more detailed overview of reliability principles in Azure, see [Reliability in Microsoft Azure Well-Architected Framework](/azure/architecture/framework/resiliency/). --- **Azure Service Manager (ASM) Retirement guides**. ASM is the old control plane of Azure responsible for creating, managing, deleting VMs and performing other control plane operations, and has been in use since 2011. ASM is retiring in August 2024, and customers can now migrate to [Azure Resource Manager (ARM)](/azure/azure-resource-manager/management/overview). ARM provides a management layer that enables you to create, update, and delete resources in your Azure account. You can use management features like access control, locks, and tags to secure and organize your resources after deployment.--## Azure services reliability guides --###  Foundational services --| Product| Availability zone guide | Disaster recovery guide | -|-|-|-| -|Azure Cosmos DB for NoSQL|[Reliability in Cosmos DB for NoSQL](reliability-cosmos-db-nosql.md)| [Reliability in Cosmos DB for NoSQL](reliability-cosmos-db-nosql.md) | -|Azure Event Hubs| [Reliability in Event Hubs](./reliability-event-hubs.md)| [Reliability in Event Hubs](./reliability-event-hubs.md) | -|Azure ExpressRoute| [Designing for high availability with ExpressRoute](../expressroute/designing-for-high-availability-with-expressroute.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|[Designing for disaster recovery with ExpressRoute private peering](../expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| -|Azure Key Vault|[Azure Key Vault failover within a region](/azure/key-vault/general/disaster-recovery-guidance?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#failover-within-a-region)| [Azure Key Vault](/azure/key-vault/general/disaster-recovery-guidance?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#failover-across-regions) | -|Azure Load Balancer|[Reliability in Load Balancer](./reliability-load-balancer.md)| [Reliability in Load Balancer](./reliability-load-balancer.md)| -|Azure Public IP|[Azure Public IP - Availability zones](../virtual-network/ip-services/public-ip-addresses.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#availability-zone)| [Azure Public IP: Cross-region overview](../load-balancer/cross-region-overview.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Service Bus|[Azure Service Bus - Availability zones](../service-bus-messaging/service-bus-outages-disasters.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#availability-zones)| [Azure Service Bus Geo-Disaster Recovery](../service-bus-messaging/service-bus-geo-dr.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) / [Azure Service Bus Geo-Replication](../service-bus-messaging/service-bus-geo-replication.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Service Fabric| [Deploy an Azure Service Fabric cluster across Availability Zones](/azure/service-fabric/service-fabric-cross-availability-zones?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [Disaster recovery in Azure Service Fabric](/azure/service-fabric/service-fabric-disaster-recovery?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Site Recovery|| [Set up disaster recovery for Azure VMs](../site-recovery/azure-to-azure-tutorial-enable-replication.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure SQL|[Azure SQL - High availability](/azure/azure-sql/database/high-availability-sla?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [Disaster recovery guidance - Azure SQL Database](/azure/azure-sql/database/disaster-recovery-guidance) | -|Azure SQL-Managed Instance|| [Azure SQL-Managed Instance](/azure/azure-sql/managed-instance/failover-group-sql-mi?view=azuresql&preserve-view=true) | -|Azure Storage-Disk Storage| [Best practices for achieving high availability with Azure virtual machines and managed disks](/azure/virtual-machines/disks-high-availability) | [Create an incremental snapshot for managed disks](/azure/virtual-machines/disks-incremental-snapshots?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Storage Mover| [Reliability in Azure Storage Mover](reliability-azure-storage-mover.md)|[Reliability in Azure Storage Mover](reliability-azure-storage-mover.md)| -|Azure Virtual Machine Scale Sets|[Azure Virtual Machine Scale Sets](reliability-virtual-machine-scale-sets.md)|| -|Azure Virtual Machines|[Reliability in Virtual Machines](reliability-virtual-machines.md)|[Reliability in Virtual Machines](reliability-virtual-machines.md)| -|Azure Virtual Machines Image Builder| [Reliability in Azure Image Builder (AIB)](reliability-image-builder.md)| [Reliability in Azure Image Builder (AIB)](reliability-image-builder.md)| -|Azure Virtual Network| [Virtual networks and availability zones](../virtual-network/virtual-networks-overview.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#virtual-networks-and-availability-zones)| [Virtual Network – Business Continuity](../virtual-network/virtual-network-disaster-recovery-guidance.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#business-continuity) | -|Azure VPN Gateway| [About zone-redundant virtual network gateway in Azure availability zones](../vpn-gateway/about-zone-redundant-vnet-gateways.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|[Highly Available cross-premises and VNet-to-VNet connectivity](../vpn-gateway/vpn-gateway-highlyavailable.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | ----###  Mainstream services --| Product| Availability zone guide | Disaster recovery guide | -|-|-|-| -|Azure AI Search|[Azure AI Search](/azure/search/search-reliability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|[Azure AI Search](/azure/search/search-reliability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| -|Azure API Management|[Ensure API Management availability and reliability](../api-management/high-availability.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [How to implement disaster recovery using service backup and restore](../api-management/api-management-howto-disaster-recovery-backup-restore.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure App Configuration|[How does App Configuration ensure high data availability?](../azure-app-configuration/faq.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-does-app-configuration-ensure-high-data-availability)| [Resiliency and disaster recovery](../azure-app-configuration/concept-disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json&tabs=core2x)| -|Azure App Service|[Azure App Service](./reliability-app-service.md)| [Azure App Service](reliability-app-service.md#cross-region-disaster-recovery-and-business-continuity)| -|Azure Application Gateway (V2)|[Autoscaling and High Availability](../application-gateway/application-gateway-autoscaling-zone-redundant.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|| -|Azure Backup|[Reliability in Azure Backup](reliability-backup.md)| [Reliability in Azure Backup](reliability-backup.md) | -|Azure Bastion|[Reliability in Azure Bastion](reliability-bastion.md) |[Reliability in Azure Bastion](reliability-bastion.md) | -|Azure Batch|[Reliability in Azure Batch](reliability-batch.md)| [Reliability in Azure Batch](reliability-batch.md#cross-region-disaster-recovery-and-business-continuity) | -|Azure Cache for Redis|[Enable zone redundancy for Azure Cache for Redis](../azure-cache-for-redis/cache-how-to-zone-redundancy.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|[Configure passive geo-replication for Premium Azure Cache for Redis instances](../azure-cache-for-redis/cache-how-to-geo-replication.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Communications Gateway|[Reliability in Azure Communications Gateway](../communications-gateway/reliability-communications-gateway.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|[Reliability in Azure Communications Gateway](../communications-gateway/reliability-communications-gateway.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| -|Azure Container Apps|[Reliability in Azure Container Apps](reliability-azure-container-apps.md)|[Reliability in Azure Container Apps](reliability-azure-container-apps.md)| -|Azure Container Instances|[Reliability in Azure Container Instances](reliability-containers.md)| [Reliability in Azure Container Instances](reliability-containers.md#disaster-recovery) | -|Azure Container Registry|[Enable zone redundancy in Azure Container Registry for resiliency and high availability](/azure/container-registry/zone-redundancy?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | [Geo-replication in Azure Container Registry](/azure/container-registry/container-registry-geo-replication) | -|Azure Data Explorer|| [Azure Data Explorer - Business continuity](/azure/data-explorer/business-continuity-overview) | -|Azure Data Factory|[Azure Data Factory data redundancy](../data-factory/concepts-data-redundancy.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [BCDR for Azure Data Factory and Azure Synapse Analytics pipelines](/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery) | -|Azure Database for MySQL|| [Azure Database for MySQL- Business continuity](/azure/mysql/single-server/concepts-business-continuity?#recover-from-an-azure-regional-data-center-outage) | -|Azure Database for MySQL - Flexible Server|[Azure Database for MySQL Flexible Server High availability](/azure/mysql/flexible-server/concepts-high-availability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [Azure Database for MySQL Flexible Server - Restore to latest restore point](/azure/mysql/flexible-server/how-to-restore-server-portal?#geo-restore-to-latest-restore-point) | -|Azure Database for PostgreSQL - Flexible Server|[Azure Database for PostgreSQL - Flexible Server](./reliability-postgresql-flexible-server.md)|[Azure Database for PostgreSQL - Flexible Server](reliability-postgre-flexible.md#cross-region-disaster-recovery-and-business-continuity) | -|Azure DDoS Protection|[Reliability in DDoS Protection](reliability-ddos.md)|[Reliability in DDoS Protection](reliability-ddos.md) | -|Azure Disk Encryption|[Redundancy options for managed disks](/azure/virtual-machines/disks-redundancy?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|| -|Azure DNS|[Reliability in Azure DNS](reliability-dns.md)|[Reliability in Azure DNS](reliability-dns.md)| -|Microsoft Entra Domain Services|| [Create replica set](../active-directory-domain-services/tutorial-create-replica-set.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Event Grid|[Reliability in Azure Event Grid](./reliability-event-grid.md)| [Reliability in Azure Event Grid](./reliability-event-grid.md) | -|Azure Firewall|[Deploy an Azure Firewall with Availability Zones using Azure PowerShell](../firewall/deploy-availability-zone-powershell.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|| -|Azure Functions|[Azure Functions](reliability-functions.md)| [Azure Functions](reliability-functions.md#cross-region-disaster-recovery-and-business-continuity) | -|Azure Guest Configuration| |[Azure Guest Configuration Availability](../governance/machine-configuration/overview.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json?#availability) | -|Azure HDInsight|[Reliability in Azure HDInsight](reliability-hdinsight.md)| [Reliability in Azure HDInsight](reliability-hdinsight.md#cross-region-disaster-recovery-and-business-continuity) | -|Azure Image Builder|[Reliability in Azure Image Builder](reliability-image-builder.md)|[Reliability inAzure Image Builder](reliability-image-builder.md)| -|Azure Kubernetes Service (AKS)|[Create an Azure Kubernetes Service (AKS) cluster that uses availability zones](/azure/aks/availability-zones?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [Best practices for business continuity and disaster recovery in Azure Kubernetes Service (AKS)](/azure/aks/operator-best-practices-multi-region?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Logic Apps|[Protect logic apps from region failures with zone redundancy and availability zones](../logic-apps/set-up-zone-redundancy-availability-zones.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [Business continuity and disaster recovery for Azure Logic Apps](../logic-apps/business-continuity-disaster-recovery-guidance.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Media Services||[High Availability with Media Services and Video on Demand (VOD)](/azure/media-services/latest/architecture-high-availability-encoding-concept) | -|Azure Migrate|| [Does Azure Migrate offer Backup and Disaster Recovery?](../migrate/resources-faq.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#does-azure-migrate-offer-backup-and-disaster-recovery) | -|Azure Monitor-Log Analytics |[Enhance data and service resilience in Azure Monitor Logs with availability zones](/azure/azure-monitor/logs/availability-zones)| [Log Analytics workspace replication](/azure/azure-monitor/logs/workspace-replication) | -|Azure Network Watcher|[Service availability and redundancy](../network-watcher/frequently-asked-questions.yml?bc=%2fazure%2freliability%2fbreadcrumb%2ftoc.json&toc=%2fazure%2freliability%2ftoc.json#service-availability-and-redundancy)|| -|Azure Notification Hubs|[Reliability Azure Notification Hubs](reliability-notification-hubs.md)|[Reliability Azure Notification Hubs](reliability-notification-hubs.md)| -|Azure Operator Nexus|[Reliability in Azure Operator Nexus](reliability-operator-nexus.md)|[Reliability in Azure Operator Nexus](reliability-operator-nexus.md)| -|Azure Private Link|[Azure Private Link availability](../private-link/availability.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|| -|Azure Route Server|[Azure Route Server FAQ](../route-server/route-server-faq.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| -|Azure Storage - Blob Storage|[Choose the right redundancy option](../storage/common/storage-disaster-recovery-guidance.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#choose-the-right-redundancy-option)|[Azure storage disaster recovery planning and failover](../storage/common/storage-disaster-recovery-guidance.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) / [Azure Blob backup](/azure/backup/blob-backup-overview)| -|Azure Stream Analytics|| [Achieve geo-redundancy for Azure Stream Analytics jobs](../stream-analytics/geo-redundancy.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Virtual WAN|[How are Availability Zones and resiliency handled in Virtual WAN?](../virtual-wan/virtual-wan-faq.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-are-availability-zones-and-resiliency-handled-in-virtual-wan)| [Disaster recovery design](/azure/virtual-wan/disaster-recovery-design) | - -###  Strategic services --| Product| Availability zone guide | Disaster recovery guide | -|-|-|-| -|Azure API Center | [Reliability in Azure API Center](reliability-api-center.md) | [Reliability in Azure API Center](reliability-api-center.md)| -|Azure API for FHIR|| [Disaster recovery for Azure API for FHIR](../healthcare-apis/azure-api-for-fhir/disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Application Gateway for Containers | [Reliability in Azure Application Gateway for Containers](reliability-app-gateway-containers.md) | [Reliability in Azure Application Gateway for Containers](reliability-app-gateway-containers.md)| -|Azure Chaos Studio | [Reliability in Azure Chaos Studio](reliability-chaos-studio.md)| [Reliability in Azure Chaos Studio](reliability-chaos-studio.md)| -|Azure Community Training|[Reliability in Community Training](reliability-community-training.md) |[Reliability in Community Training](reliability-community-training.md) | -|Azure Cosmos DB for MongoDB vCore|[Reliability in Azure Cosmos DB for MongoDB vCore](./reliability-cosmos-mongodb.md)|[Reliability in Azure Cosmos DB for MongoDB vCore](./reliability-cosmos-mongodb.md) | -|Azure Databox| |[Microsoft Azure Data Box Disk FAQ](../databox/data-box-disk-faq.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-can-i-recover-my-data-if-an-entire-region-fails-) | -|Azure Data Manager for Energy| [Reliability in Azure Data Manager for Energy](./reliability-energy-data-services.md) |[Reliability in Azure Data Manager for Energy](./reliability-energy-data-services.md) | -|Azure Data Share| |[Disaster recovery for Azure Data Share](../data-share/disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| -|Azure Deployment Environments| [Reliability in Azure Deployment Environments](reliability-deployment-environments.md)|[Reliability in Azure Deployment Environments](reliability-deployment-environments.md)| -|Azure DevOps|| [Azure DevOps Data protection - data availability](/azure/devops/organizations/security/data-protection?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json&preserve-view=true&#data-availability)| -|Azure Elastic SAN|[Availability zone support](reliability-elastic-san.md#availability-zone-support)|[Disaster recovery and business continuity](reliability-elastic-san.md#disaster-recovery-and-business-continuity)| -|Azure HDInsight on AKS |[Reliability in HDInsight on AKS](reliability-hdinsight-on-aks.md) | [Reliability in HDInsight on AKS](reliability-hdinsight-on-aks.md) | -|Azure Health Data Services (FHIR, DICOM, MedTech) | | [Disaster recovery for Azure Health Data Services](../healthcare-apis/business-continuity-disaster-recovery.md) | -|Azure Health Data Services de-identification service || [Disaster recovery for Azure Health Data Services de-identification service](reliability-health-data-services-deidentification.md) | -|Azure Health Insights|[Reliability in Azure Health Insights](reliability-health-insights.md)|[Reliability in Azure Health Insights](reliability-health-insights.md)| -|Azure IoT Hub| [IoT Hub high availability and disaster recovery](../iot-hub/iot-hub-ha-dr.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| [IoT Hub high availability and disaster recovery](../iot-hub/iot-hub-ha-dr.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Machine Learning Service|| [Failover for business continuity and disaster recovery](/azure/machine-learning/how-to-high-availability-machine-learning?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure NetApp Files|| [Manage disaster recovery using cross-region replication](../azure-netapp-files/cross-region-replication-manage-disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) / [Azure NetApp Files backup](/azure/azure-netapp-files/backup-introduction) | -|Azure Private 5G Core|[Reliability for Azure Private 5G Core](../private-5g-core/reliability-private-5g-core.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)|[Reliability for Azure Private 5G Core](../private-5g-core/reliability-private-5g-core.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| -|Azure SignalR Service|| [Resiliency and disaster recovery in Azure SignalR Service](../azure-signalr/signalr-concept-disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Azure Spring Apps|[Reliability in Azure Spring Apps](reliability-spring-apps.md) |[Reliability in Azure Spring Apps](reliability-spring-apps.md)| -|Azure Storage Actions|[Reliability in Azure Storage Actions](reliability-storage-actions.md)|[Reliability in Azure Storage Actions](reliability-storage-actions.md)| -|Azure Storage Mover|[Reliability in Azure Storage Mover](./reliability-azure-storage-mover.md)|[Reliability in Azure Storage Mover](./reliability-azure-storage-mover.md)| -|Azure VMware Solution|| [Azure VMware disaster recovery for virtual machines](../azure-vmware/disaster-recovery-for-virtual-machines.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | -|Microsoft Defender for Cloud DevOps security|[Reliability in Microsoft Defender for Cloud DevOps security](./reliability-defender-devops.md)|[Reliability in Microsoft Defender for Cloud DevOps security](./reliability-defender-devops.md)| -|Microsoft Fabric|[Microsoft Fabric](reliability-fabric.md) |[Microsoft Fabric](reliability-fabric.md)| -|Microsoft Purview|[Reliability for Microsoft Purview](reliability-fabric.md) |[Disaster recovery for Microsoft Purview](/purview/concept-best-practices-migration#implementation-steps)| ---###  Non-regional services (always-available services) --| Product| Availability zone guide | Disaster recovery guide | -|-|-|-| -|Azure Bot Service|[Reliability in Azure Bot Service](reliability-bot.md)|[Reliability in Azure Bot Service](reliability-bot.md)| -|Azure Traffic Manager|[Reliability in Azure Traffic Manager](reliability-traffic-manager.md)|[Reliability in Azure Traffic Manager](reliability-traffic-manager.md)| ---## Azure Service Manager Retirement --Azure Service Manager (ASM) is the old control plane of Azure responsible for creating, managing, deleting VMs and performing other control plane operations, and has been in use since 2011. ASM is retiring in August 2024, and customers can now migrate to [Azure Resource Manager (ARM)](/azure/azure-resource-manager/management/overview). --For more information on specific retirement dates and migration documentation, see [Azure Service Manager Retirement](./asm-retirement.md). --## Next steps ---> [!div class="nextstepaction"] -> [Azure services and regions with availability zones](availability-zones-service-support.md) --> [!div class="nextstepaction"] -> [Availability of service by category](availability-service-by-category.md) --> [!div class="nextstepaction"] -> [Microsoft commitment to expand Azure availability zones to more regions](https://azure.microsoft.com/blog/our-commitment-to-expand-azure-availability-zones-to-more-regions/) --> [!div class="nextstepaction"] -> [Build solutions for high availability using availability zones](/azure/architecture/high-availability/building-solutions-for-high-availability) +# Azure service reliability guides ++Below is a list of Azure service reliability guides, organized by service category. ++>[!NOTE] +>Some service documents are in the process of, or are not yet updated into a single reliability guide format. These may contain more than one document that references reliability guidance. ++## AI and machine learning ++| Product| Guidance | +|-|| +|Azure AI Health Insights| [Reliability in Azure AI Health Insights](reliability-health-insights.md)| +|Azure AI Search| [Reliability in Azure AI Search](/azure/search/search-reliability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Bot Service | [Reliability in Azure Bot Service ](reliability-bot.md)| +|Azure Machine Learning Service| [Failover for business continuity and disaster recovery](/azure/machine-learning/how-to-high-availability-machine-learning?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| + +## Analytics ++| Product| Guidance | +|-|| +|Azure HDInsight| [Reliability in Azure HDInsight](reliability-hdinsight.md)| +|Azure HDInsight on AKS| [Reliability in Azure HDInsight on AKS](reliability-hdinsight-on-aks.md)| +|Azure Machine Learning Service| [Failover for business continuity and disaster recovery](/azure/machine-learning/how-to-high-availability-machine-learning?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Stream Analytics| [Achieve geo-redundancy for Azure Stream Analytics jobs](../stream-analytics/geo-redundancy.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Event Hubs| [Reliability in Azure Event Hubs](reliability-event-hubs.md)| +|Azure Data Explorer| [Business continuity and disaster recovery overview](/azure/data-explorer/business-continuity-overview?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Data Share| [Disaster recovery for Azure Data Share](../data-share/disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Chaos Studio| [Reliability in Azure Chaos Studio](reliability-chaos-studio.md)| +|Microsoft Fabric| [Reliability in Microsoft Fabric](reliability-fabric.md)| +|Microsoft Purview| [Reliability in Microsoft Purview](reliability-microsoft-purview.md)| ++## Compute ++| Product| Guidance | +|-|| +|Azure App Service| [Reliability in Azure App Service](reliability-app-service.md)| +|Azure Batch| [Reliability in Azure Batch](reliability-batch.md)| +|Azure Container Apps| [Reliability in Azure Container Apps](reliability-azure-container-apps.md)| +|Azure Container Instances| [Reliability in Azure Container Instances](reliability-containers.md)| +|Azure Functions| [Reliability in Azure Functions ](reliability-functions.md)| +|Azure Kubernetes Service (AKS)| [Create an Azure Kubernetes Service (AKS) cluster that uses availability zones](/azure/aks/availability-zones?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [High availability and disaster recovery overview for Azure Kubernetes Service (AKS)](/azure/aks/ha-dr-overview?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Service Fabric| [Deploy an Azure Service Fabric cluster across Availability Zones](/azure/service-fabric/service-fabric-cross-availability-zones?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [Disaster recovery in Azure Service Fabric](/azure/service-fabric/service-fabric-disaster-recovery?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Spring Apps| [Reliability in Azure Spring Apps](reliability-spring-apps.md)| +|Azure Virtual Machines| [Reliability in Azure Virtual Machines](reliability-virtual-machines.md)| +|Azure Virtual Machine Image Builder| [Reliability in Azure Virtual Machine Image Builder](reliability-image-builder.md)| +|Azure Virtual Machine Scale Sets| [Reliability in Azure Virtual Machine Scale Sets](reliability-virtual-machine-scale-sets.md)| +|Azure VMware Solution| [Deploy disaster recovery using VMware HCX](../azure-vmware/deploy-disaster-recovery-using-vmware-hcx.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| + ++## Containers ++| Product| Guidance | +|-|| +|Azure App Configuration|[How does App Configuration ensure high data availability?](../azure-app-configuration/faq.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-does-app-configuration-ensure-high-data-availability) </p> [Resiliency and disaster recovery](../azure-app-configuration/concept-disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json&tabs=core2x)| +|Azure Container Apps| [Reliability in Azure Container Apps](reliability-azure-container-apps.md)| +|Azure Container Instances| [Reliability in Azure Container Instances](reliability-containers.md)| +|Azure Container Registry|[Enable zone redundancy in Azure Container Registry for resiliency and high availability](/azure/container-registry/zone-redundancy?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [Geo-replication in Azure Container Registry](/azure/container-registry/container-registry-geo-replication) | +|Azure Kubernetes Service (AKS)| [Create an Azure Kubernetes Service (AKS) cluster that uses availability zones](/azure/aks/availability-zones?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [High availability and disaster recovery overview for Azure Kubernetes Service (AKS)](/azure/aks/ha-dr-overview?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Service Fabric| [Deploy an Azure Service Fabric cluster across Availability Zones](/azure/service-fabric/service-fabric-cross-availability-zones?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [Disaster recovery in Azure Service Fabric](/azure/service-fabric/service-fabric-disaster-recovery?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | ++## Databases ++ +| Product| Guidance | +|-|| +|Azure SQL|[Azure SQL - High availability](/azure/azure-sql/database/high-availability-sla?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [Disaster recovery guidance - Azure SQL Database](/azure/azure-sql/database/disaster-recovery-guidance) | +|Azure SQL-Managed Instance| [Failover groups overview & best practices - Azure SQL Managed Instance](/azure/azure-sql/managed-instance/failover-group-sql-mi?view=azuresql&preserve-view=true) | +|Azure Database for MySQL| [Overview of business continuity with Azure Database for MySQL - Single Server](/azure/mysql/single-server/concepts-business-continuity?#recover-from-an-azure-regional-data-center-outage) | +|Azure Database for MySQL - Flexible Server|[Azure Database for MySQL Flexible Server High availability](/azure/mysql/flexible-server/concepts-high-availability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p>[Azure Database for MySQL Flexible Server - Restore to latest restore point](/azure/mysql/flexible-server/how-to-restore-server-portal?#geo-restore-to-latest-restore-point) | +|Azure Database for PostgreSQL - Flexible Server| [Reliability in Azure Database for PostgreSQL - Flexible Server](reliability-postgresql-flexible-server.md)| +|Azure Cosmos DB for NoSQL| [Reliability in Azure Cosmos DB for NoSQL](reliability-cosmos-db-nosql.md) | +|Azure Cosmos DB for MongoDB vCore| [Reliability in Azure Cosmos DB for MongoDB vCore](reliability-cosmos-mongodb.md)| +|Azure Cache for Redis|[Enable zone redundancy for Azure Cache for Redis](../azure-cache-for-redis/cache-how-to-zone-redundancy.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [Configure passive geo-replication for Premium Azure Cache for Redis instances](../azure-cache-for-redis/cache-how-to-geo-replication.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | ++## Developer tools ++| Product| Guidance | +|-|| +|Azure API Center| [Reliability in Azure API Center](reliability-api-center.md) | +++## DevOps ++| Product| Guidance | +|-|| +|Azure Deployment Environments| [Reliability in Azure Deployment Environments](reliability-deployment-environments.md)| +|Azure DevOps| [Data availability](/azure/devops/organizations/security/data-protection?view=azure-devops&branch=main&preserve-view=true#data-availability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Monitor-Log Analytics |[Enhance data and service resilience in Azure Monitor Logs with availability zones](/azure/azure-monitor/logs/availability-zones) </p> [Log Analytics workspace replication](/azure/azure-monitor/logs/workspace-replication) | ++## Hybrid + multicloud ++| Product| Guidance | +|-|| +|Azure Operator Nexus| [Reliability in Azure Operator Nexus](reliability-operator-nexus.md)| ++## Industry solutions ++| Product| Guidance | +|-|| +|Microsoft Community Training| [Reliability in Microsoft Community Training](reliability-community-training.md) | +++## Integration ++| Product| Guidance | +|-|| +|Azure API for FHIR®|[Disaster recovery for Azure API for FHIR](../healthcare-apis/azure-api-for-fhir/disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure API Management|[Ensure API Management availability and reliability](../api-management/high-availability.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p>[How to implement disaster recovery using service backup and restore](../api-management/api-management-howto-disaster-recovery-backup-restore.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Data Manager for Energy| [Reliability in Azure Data Manager for Energy](reliability-energy-data-services.md)| +| Azure Data Factory| [Azure Data Factory data redundancy](../data-factory/concepts-data-redundancy.md?bc=%2fazure%2freliability%2fbreadcrumb%2ftoc.json&toc=%2fazure%2freliability%2ftoc.json) | +|Azure Event Grid| [Reliability in Azure Event Grid](./reliability-event-grid.md)| +|Azure Functions| [Reliability in Azure Functions ](reliability-functions.md)| +|Azure Health Data +| Azure Health Data +|Azure Logic Apps|[Protect logic apps from region failures with zone redundancy and availability zones](../logic-apps/set-up-zone-redundancy-availability-zones.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)</p> [Business continuity and disaster recovery for Azure Logic Apps](../logic-apps/business-continuity-disaster-recovery-guidance.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Service Bus| [Best practices for insulating applications against Service Bus outages and disasters](../service-bus-messaging/service-bus-outages-disasters.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +++## Internet of Things ++| Product| Guidance | +|-|| +|Azure Device Registry |[Reliability in Azure Device Registry](reliability-device-registry.md)| +|Azure IoT Hub| [IoT Hub high availability and disaster recovery](../iot-hub/iot-hub-ha-dr.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#disable-disaster-recovery) | +|Azure Notification Hubs| [Reliability in Azure Notification Hubs](reliability-notification-hubs.md)| +++## Media +++| Product| Guidance | +|-|| +Azure Media Services| [High Availability with Media Services and Video on Demand (VOD)](/azure/media-services/latest/architecture-high-availability-encoding-concept?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +++## Management and governance ++| Product| Guidance | +|-|| +|Azure Backup| [Reliability in Azure Backup](reliability-backup.md)| +|Azure Guest Configuration|[Azure Guest Configuration Availability](../governance/machine-configuration/overview.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#availability) | +|Azure Monitor-Log Analytics |[Enhance data and service resilience in Azure Monitor Logs with availability zones](/azure/azure-monitor/logs/availability-zones) </p> [Log Analytics workspace replication](/azure/azure-monitor/logs/workspace-replication) | +|Azure Site Recovery| [Set up disaster recovery for Azure VMs](../site-recovery/azure-to-azure-tutorial-enable-replication.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +++## Migration ++| Product| Guidance | +|-|| +|Azure Migrate | [Does Azure Migrate offer Backup and Disaster Recovery?](../migrate/resources-faq.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#does-azure-migrate-offer-backup-and-disaster-recovery)| +|Azure Site Recovery|[Set up disaster recovery for Azure VMs](../site-recovery/azure-to-azure-tutorial-enable-replication.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | ++## Networking ++| Product| Guidance | +|-|| +|Azure Application Gateway (V2)|[Autoscaling and High Availability](../application-gateway/application-gateway-autoscaling-zone-redundant.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Application Gateway for Containers| [Reliability in Azure Application Gateway for Containers](reliability-app-gateway-containers.md ) | +|Azure Bastion| [Reliability in Azure Bastion](reliability-bastion.md)| +|Azure Communications Gateway| [Reliability in Azure Communications Gateway](../communications-gateway/reliability-communications-gateway.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure DNS| [Reliability in Azure DNS ](reliability-dns.md)| +|Azure DDoS Protection| [Reliability in Azure DDoS Protection](reliability-ddos.md)| +|Azure ExpressRoute| [Designing for high availability with ExpressRoute](../expressroute/designing-for-high-availability-with-expressroute.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p>[Designing for disaster recovery with ExpressRoute private peering](../expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Firewall| [Deploy an Azure Firewall with Availability Zones using Azure PowerShell](../firewall/deploy-availability-zone-powershell.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Load Balancer| [Reliability in Azure Load Balancer](reliability-load-balancer.md )| +|Azure Network Watcher| [Azure Network Watcher service availability and redundancy](../network-watcher/frequently-asked-questions.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#service-availability-and-redundancy)| +|Azure Private Link| [Azure Private Link availability](../private-link/availability.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Public IP| [Azure Public IP Availability Zone](../virtual-network/ip-services/public-ip-addresses.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#availability-zone) | +|Azure Route Server| [Azure Route Server frequently asked questions (FAQ)](../route-server/route-server-faq.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Traffic Manager| [Reliability in Azure Traffic Manager](reliability-traffic-manager.md)| +|Azure Virtual Network| [Virtual networks and availability zones](../virtual-network/virtual-networks-overview.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#virtual-networks-and-availability-zones)</p> [Virtual Network – Business Continuity](../virtual-network/virtual-network-disaster-recovery-guidance.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#business-continuity) | +|Azure Virtual WAN|[How are Availability Zones and resiliency handled in Virtual WAN?](../virtual-wan/virtual-wan-faq.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-are-availability-zones-and-resiliency-handled-in-virtual-wan)</p> [Disaster recovery design](/azure/virtual-wan/disaster-recovery-design) | +|Azure VPN Gateway| [About zone-redundant virtual network gateway in Azure availability zones](../vpn-gateway/about-zone-redundant-vnet-gateways.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)</p>[Highly Available cross-premises and VNet-to-VNet connectivity](../vpn-gateway/vpn-gateway-highlyavailable.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Private 5G Core|[Reliability in Azure Private 5G Core](../private-5g-core/reliability-private-5g-core.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Web Application Firewall | [Deploy an Azure Firewall with Availability Zones using Azure PowerShell](../firewall/deploy-availability-zone-powershell.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [How do I achieve a disaster recovery scenario across datacenters by using Application Gateway?](../application-gateway/application-gateway-faq.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-do-i-achieve-a-disaster-recovery-scenario-across-datacenters-by-using-application-gateway)| +++## Security ++| Product| Guidance | +|-|| +|Azure Disk Encryption| [Redundancy options for managed disks](/azure/virtual-machines/disks-redundancy?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Firewall| [Deploy an Azure Firewall with Availability Zones using Azure PowerShell](../firewall/deploy-availability-zone-powershell.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Key Vault| [Azure Key Vault availability and redundancy](/azure/key-vault/general/disaster-recovery-guidance?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure Web Application Firewall | [Deploy an Azure Firewall with Availability Zones using Azure PowerShell](../firewall/deploy-availability-zone-powershell.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [How do I achieve a disaster recovery scenario across datacenters by using Application Gateway?](../application-gateway/application-gateway-faq.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-do-i-achieve-a-disaster-recovery-scenario-across-datacenters-by-using-application-gateway)| +++## Storage ++| Product| Guidance | +|-|| +|Azure Backup| [Reliability in Azure Backup](reliability-backup.md)| +|Azure Blob Storage|[Choose the right redundancy option](/azure/storage/common/storage-disaster-recovery-guidance?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#choose-the-right-redundancy-option)</p>[Azure storage disaster recovery planning and failover](/azure/storage/common/storage-disaster-recovery-guidance?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Databox| [How can I recover my data if an entire region fails?](../databox/data-box-disk-faq.yml?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json#how-can-i-recover-my-data-if-an-entire-region-fails-)| +|Azure Elastic SAN| [Reliability in Azure Elastic SAN](reliability-elastic-san.md)| +|Azure NetApp Files| [Manage disaster recovery using Azure NetApp Files](../azure-netapp-files/cross-region-replication-manage-disaster-recovery.md?toc=/azure.reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Storage Actions|[Reliability in Azure Storage Actions](reliability-storage-actions.md)| +|Azure Storage-Disk Storage| [Best practices for achieving high availability with Azure virtual machines and managed disks](/azure/virtual-machines/disks-high-availability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure Storage Mover| [Reliability in Azure Storage Mover](reliability-azure-storage-mover.md)| +++## Web ++| Product| Guidance | +|-|| +|Azure AI Search| [Reliability in Azure AI Search](/azure/search/search-reliability?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +|Azure API Management|[Ensure API Management availability and reliability](../api-management/high-availability.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) </p> [How to implement disaster recovery using service backup and restore](../api-management/api-management-howto-disaster-recovery-backup-restore.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json) | +|Azure App Service| [Reliability in Azure App Service](reliability-app-service.md)| +|Azure Container Apps| [Reliability in Azure Container Apps](reliability-azure-container-apps.md)| +|Azure Notification Hubs| [Reliability in Azure Notification Hubs](reliability-notification-hubs.md)| +|Azure SignalR Service| [Resiliency and disaster recovery in Azure SignalR Service](../azure-signalr/signalr-concept-disaster-recovery.md?toc=/azure/reliability/toc.json&bc=/azure/reliability/breadcrumb/toc.json)| +++## Related content +++- [Azure services and regions with availability zones](availability-zones-service-support.md) +- [Build solutions for high availability using availability zones](/azure/architecture/high-availability/building-solutions-for-high-availability) |
| reliability | Reliability Bastion | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-bastion.md | Last updated 10/25/2024 # Reliability in Azure Bastion -This article describes reliability support in Azure Bastion and covers both intra-regional resiliency with [availability zones](#availability-zone-support) and information on [multi-region deployments](#multi-region-support). +This article describes reliability support in Azure Bastion. It covers intra-regional resiliency via [availability zones](#availability-zone-support). It also covers [multi-region deployments](#multi-region-support). -Because resiliency is a shared responsibility between you and Microsoft, this article also covers ways for you to build a resilient solution that meets your needs. +Because resiliency is a shared responsibility between you and Microsoft, this article also covers ways for you to create a resilient solution that meets your needs. > [!IMPORTANT]-> Zone redundancy features for Azure Bastion resources are currently in PREVIEW. -> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. +> Zone redundancy features for Azure Bastion resources are currently in preview. +> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability. -Azure Bastion is a fully managed PaaS service that you provision to securely connect to virtual machines via a private IP address. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly over TLS from the Azure portal, or via the native SSH or RDP client already installed on your local computer. When you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client software. +Azure Bastion is a fully managed platform as a service (PaaS) that you provision to provide high-security connections to virtual machines via a private IP address. It provides seamless RDP/SSH connectivity to your virtual machines directly over TLS from the Azure portal, or via the native SSH or RDP client that's already installed on your local computer. When you connect via Azure Bastion, your virtual machines don't need a public IP address, an agent, or special client software. ## Production deployment recommendations -For production deployments, you should: -+For production deployments, you should [enable zone redundancy](#availability-zone-support) if your Azure Bastion resources are in a supported region. ## Transient faults -Transient faults are short, intermittent failures in components. They occur frequently in a distributed environment like the cloud, and they're a normal part of operations. They correct themselves after a short period of time. It's important that your applications handle transient faults, usually by retrying affected requests. +*Transient faults* are short intermittent failures in components. They occur frequently in a distributed environment like the cloud, and they're a normal part of operations. They correct themselves after a short period of time. It's important that your applications handle transient faults, usually by retrying affected requests. -If transient faults affect your virtual machine or Azure Bastion host, clients using the secure sockets host (SSH) and remote desktop connection (RDP) protocols typically retry automatically. +If transient faults affect your virtual machine or Azure Bastion host, clients using the secure sockets host (SSH) and Remote Desktop Protocol (RDP) protocols typically retry automatically. ## Availability zone support -You can configure Azure Bastion to be *zone-redundant*, so that your resources are spread across multiple [availability zones](../reliability/availability-zones-overview.md). When you spread resources across availability zones you can achieve resiliency and reliability for your production workloads. +You can configure Azure Bastion to be *zone redundant* so that your resources are spread across multiple [availability zones](../reliability/availability-zones-overview.md). When you spread resources across availability zones, you can achieve resiliency and reliability for your production workloads. -You can specify which availability zone or zones an Azure Bastion resource should be deployed to. Azure Bastion spreads your instances across those zones. In the following diagram, Azure Bastion has three instances spread across three zones: +You can specify which availability zone or zones an Azure Bastion resource should be deployed to. Azure Bastion spreads your instances across those zones. The following diagram shows Azure Bastion instances spread across three zones: :::image type="content" source="media/reliability-bastion/bastion-instances-zones.png" alt-text="Diagram that shows Azure Bastion with three instances, each in a separate availability zone." border="false"::: - > [!NOTE]-> If you specify more availability zones than you have instances, Azure Bastion spreads instances across as many zones as it can. If an availability zone is unavailable, the instance in the faulty zone will be replaced with another instance in a healthy zone. +> If you specify more availability zones than you have instances, Azure Bastion spreads instances across as many zones as it can. If an availability zone is unavailable, the instance in the faulty zone is replaced with another instance in a healthy zone. ### Requirements -To configure Azure Bastion resources with zone redundancy you must deploy with the Basic, Standard, or Premium SKUs. --The Developer SKU is intended for non-production use. It doesn't support zone redundancy. However, in the event of a region failure, Azure Bastion attempts to route traffic through different infrastructure. +To configure Azure Bastion resources with zone redundancy, you must deploy with the Basic, Standard, or Premium SKUs. -Bastion requires a Standard SKU zone redundant Public IP. +Bastion requires a Standard SKU zone-redundant Public IP. ### Regions supported There's no additional cost to use zone redundancy for Azure Bastion. ### Configure availability zone support -**New resources:** When you deploy a new Bastion resource in a [region that supports availability zones](#regions-supported), you select the specific zones you want to deploy to. For zone redundancy, you must select multiple zones. +**New resources:** When you deploy a new Azure Bastion resource in a [region that supports availability zones](#regions-supported), you select the specific zones that you want to deploy to. For zone redundancy, you must select multiple zones. >[!IMPORTANT]- > You can't change the availability zone setting after you deploy your Bastion resource. + > You can't change the availability zone setting after you deploy your Azure Bastion resource. -When you select which availability zones to use, you're actually selecting the *logical availability zone*. If you deploy other workload components in a different Azure subscription, they might use a different *logical availability zone* number to access the same physical availability zone. For more information, see [Physical and logical availability zones](./availability-zones-overview.md#physical-and-logical-availability-zones). +When you select which availability zones to use, you're actually selecting the *logical availability zone*. If you deploy other workload components in a different Azure subscription, they might use a different logical availability zone number to access the same physical availability zone. For more information, see [Physical and logical availability zones](./availability-zones-overview.md#physical-and-logical-availability-zones). -**Migration:** It's not possible to migrate from non-availability zone support to availability zone support. Instead, you need to create a Bastion resource in the new region and delete the old one. +**Migration:** It's not possible to add availability zone support to an existing resource that doesn't have it. Instead, you need to create an Azure Bastion resource in the new region and delete the old one. ### Traffic routing between zones When you initiate an SSH or RDP session, it can be routed to an Azure Bastion instance in any of the availability zones you selected. -It's possible that a session might be sent to an Azure Bastion instance in an availability zone that's different from the virtual machine you're connecting to. In the following diagram, a request from the user is sent to an Azure Bastion instance in zone 2, while the virtual machine is in zone 1: +A session might be sent to an Azure Bastion instance in an availability zone that's different from the virtual machine you're connecting to. In the following diagram, a request from the user is sent to an Azure Bastion instance in zone 2, although the virtual machine is in zone 1: -In most scenarios, the small amount of cross-zone latency isn't significant. However, if you have unusually stringent latency requirements for your Azure Bastion workloads, you should deploy a dedicated single-zone Azure Bastion instance in the virtual machine's availability zone. However, this configuration doesn't provide zone redundancy, and we don't recommend it for most customers. +In most scenarios, the small amount of cross-zone latency isn't significant. However, if you have unusually stringent latency requirements for your Azure Bastion workloads, you should deploy a dedicated single-zone Azure Bastion instance in the virtual machine's availability zone. This configuration doesn't provide zone redundancy, and we don't recommend it for most customers. ### Zone-down experience -**Detection and response:** Azure Bastion detects and responses to failures in an availability zone. You don't need to do anything to initiate an availability zone failover. +**Detection and response:** Azure Bastion detects and responds to failures in an availability zone. You don't need to do anything to initiate an availability zone failover. **Active requests:** When an availability zone is unavailable, any RDP or SSH connections in progress that use an Azure Bastion instance in the faulty availability zone are terminated and need to be retried. If the virtual machine you're connecting to isn't in the affected availability zone, the virtual machine continues to be accessible. See [Reliability in virtual machines: Zone down experience](./reliability-virtual-machines.md#zone-down-experience) for more information on the VM zone down experience. -**Traffic rerouting:** New connections use Azure Bastion instances in the surviving availability zones. Overall, Azure Bastion continues to remain operational. +**Traffic rerouting:** New connections use Azure Bastion instances in the surviving availability zones. Overall, Azure Bastion remains operational. ### Failback When the availability zone recovers, Azure Bastion: - Automatically restores instances in the availability zone.-- Removes any temporary instances created in the other availability zones+- Removes any temporary instances created in the other availability zones. - Reroutes traffic between your instances as normal. ### Testing for zone failures The Azure Bastion platform manages traffic routing, failover, and failback for z ## Multi-region support -Azure Bastion is deployed within virtual networks or peered virtual networks, and is associated with an Azure region. Azure Bastion is a single-region service. If the region becomes unavailable, your Bastion resource is also unavailable. +Azure Bastion is deployed within virtual networks or peered virtual networks and is associated with an Azure region. Azure Bastion is a single-region service. If the region becomes unavailable, your Azure Bastion resource is also unavailable. -Azure Bastion supports reaching virtual machines in globally peered virtual networks, but if the region that hosts your Azure Bastion resource is unavailable, you won't be able to use your Bastion resource. For higher resiliency, if you deploy your overall solution into multiple regions with separate virtual networks in each region, you should deploy Azure Bastion into each region. +Azure Bastion supports reaching virtual machines in globally peered virtual networks, but if the region that hosts your Azure Bastion resource is unavailable, you won't be able to use your Azure Bastion resource. For higher resiliency, if you deploy your overall solution into multiple regions with separate virtual networks in each region, you should deploy Azure Bastion into each region. -If you have a disaster recovery (DR) site in another Azure region, ensure you deploy Azure Bastion into the virtual network in that region. +If you have a disaster recovery site in another Azure region, be sure to deploy Azure Bastion into the virtual network in that region. -## Service-level agreement (SLA) +## Service-level agreement -The service-level agreement (SLA) for Azure Bastion describes the expected availability of the service, and the conditions that must be met to achieve that availability expectation. To understand those conditions, it's important that you review the [Service Level Agreements (SLA) for Online Services](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services). +The service-level agreement (SLA) for Azure Bastion describes the expected availability of the service and the conditions that must be met to achieve that availability expectation. To understand those conditions, it's important that you review the [SLA for Online Services](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services). ## Related content |
| reliability | Reliability Community Training | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-community-training.md | Title: Reliability in Azure Community Training -description: Find out about reliability in Azure Community Training. + Title: Reliability in Microsoft Community Training +description: Find out about reliability in Microsoft Community Training. Previously updated : 12/06/2023 Last updated : 11/01/2024 -# Reliability in Community Training +# Reliability in Microsoft Community Training -Community Training is an Azure-powered cloud-based solution that can deliver large-scale, far-spread training programs with high quality and efficiency. With Community Training, organizations of all sizes and types can run large scale training programs for their internal and external communities. Communities can include frontline workers, extended workforces, a partner ecosystem, a volunteer network, and program beneficiaries. +Microsoft Community Training is an Azure-powered cloud-based solution that can deliver large-scale, far-spread training programs with high quality and efficiency. With Community Training, organizations of all sizes and types can run large scale training programs for their internal and external communities. Communities can include frontline workers, extended workforces, a partner ecosystem, a volunteer network, and program beneficiaries. This article describes reliability support in Community Training, and covers both regional resiliency with [availability zones](/azure/reliability/availability-zones-overview?tabs=azure-clit) and [disaster recovery and business continuity](/azure/reliability/disaster-recovery-overview). For a more detailed overview of a reliability principle in Azure, see [Azure reliability](/azure/reliability/overview). |
| reliability | Reliability Cosmos Db Nosql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-cosmos-db-nosql.md | Last updated 05/06/2024 # High availability (Reliability) in Azure Cosmos DB for NoSQL -This article describes high availability (reliability) support in Azure CosmosDB for NoSQL and covers both [availability zones](#availability-zone-support), as well as [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). +This article describes high availability (reliability) support in Azure Cosmos DB for NoSQL and covers both [availability zones](#availability-zone-support), as well as [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). -For general resiliency recommendations for Azure Cosmos DB for NoSQL, see [Resiliency recommendations for Azure Cosmos DB for NoSQL](./resiliency-recommendations/recommend-cosmos-db-nosql.md). ## Availability zone support Consult the table below to estimate the impact of using availability zones in yo ### SLA improvements -Because availability zones are physically separate and provide distinct power source, network, and cooling, Availability SLAs (Service-level agreements) are higher (99.995%) than accounts with a single region (99.99%). Regions where availability zones are enabled are charged at 25% premium, while those without those without availability zones don't incur the premium. Moreover, the premium pricing for availability zones is waived for accounts configured with multi-region writes and/or for collections configured with autoscale mode. +Because availability zones are physically separate and provide distinct power source, network, and cooling, Availability SLAs (Service-level agreements) are higher (99.995%) than accounts with a single region (99.99%). Regions where availability zones are enabled are charged at 25% premium, while those without availability zones don't incur the premium. Moreover, the premium pricing for availability zones is waived for accounts configured with multi-region writes and/or for collections configured with autoscale mode. Adding an additional region to Cosmos DB account typically increases existing bill by 100% (additively not multiplicatively) though small variations in cost across regions exist. For more details, see [pricing page](https://azure.microsoft.com/pricing/details/cosmos-db/autoscale-provisioned/). -Enabling AZs, adding additional region(s), or turning on multi-region writes can be thought as a layering approach that increases resiliency and availability of a given Cosmos DB account at each step of the way - from 4 9's availability for single region no-AZ configuration, through 4 and half 9's for single region with AZs, all the way to 5 9's of availability for multi-region configuration with the multi-region write option enabled. Please refer the following table for a summary of SLAs for each configuration. +Enabling AZs, adding additional region(s), or turning on multi-region writes can be thought as a layering approach that increases resiliency and availability of a given Cosmos DB account at each step of the way - from 4 9's availability for single region no-AZ configuration, through 4 and half 9's for single region with AZs, all the way to 5 9's of availability for multi-region configuration with the multi-region write option enabled. Please refer to the following table for a summary of SLAs for each configuration. |KPI|Single-region writes without availability zones|Single-region writes with availability zones|Multiple-region, single-region writes without availability zones|Multiple-region, single-region writes with availability zones|Multiple-region, multiple-region writes with or without availability zones| |
| reliability | Reliability Device Registry | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-device-registry.md | + + Title: Reliability in Azure Device Registry +description: Find out about reliability in Azure Device Registry, including availability zones and multi-region deployments. +++++ Last updated : 10/31/2024 +++# Reliability in Azure Device Registry Preview ++This article describes reliability support in Azure Device Registry Preview. It covers both intra-regional resiliency with [availability zones](#availability-zone-support) and information on [multi-region deployments](#multi-region-support). ++Because resiliency is a shared responsibility between you and Microsoft, this article also covers ways for you to build a resilient solution that meets your needs. +++## Transient faults ++Transient faults are short, intermittent failures in components. They occur frequently in a distributed environment like the cloud, and they're a normal part of operations. They correct themselves after a short period of time. +It's important that your applications handle transient faults, usually by retrying affected requests. +++## Availability zone support ++Azure Device Registry is zone-redundant, which means that it automatically replicates across multiple [availability zones](../reliability/availability-zones-overview.md). This setup enhances the resiliency of the service by providing high availability. If there's a failure in one zone, the service can continue to operate seamlessly from another zone. ++Microsoft manages setup and configuration for zone redundancy in Azure Device Registry. You don't need to perform any more configuration to enable this zone redundancy. Microsoft ensures that the service is configured to provide the highest level of availability and reliability. ++### Regions supported ++The following list of regions support availability zones in Azure Device Registry: +++| Americas | Europe | Middle East | Africa | Asia Pacific | +||-||--|-| +| East US | North Europe | | | | +| East US 2 | West Europe | | | | +| West US 2 | | | | | +| West US 3 | | | | | +++### Cost ++There's no extra cost to use zone redundancy for Azure Device Registry. ++### Configure availability zone support ++**New resources:** When you create an Azure Device Registry resource in Azure IoT Operations, it automatically includes zone-redundancy by default. There's no need for you to perform any more configuration. +++### Zone-down experience ++During a zone-wide outage, you don't need to take any action to failover to a healthy zone. The service automatically self-heals and rebalances itself to take advantage of the healthy zone automatically. ++**Detection and response:** Because Azure Device Registry detects and responds automatically to failures in an availability zone, you don't need to do anything to initiate an availability zone failover. +++## Multi-region support ++Azure Device Registry is a regional service with automatic geographical data replication. In a region-wide outage, Microsoft initiates compute failover from one region to another. If Azure Device Registry fails over, it continues to support its primary region, and no more actions by you're required. ++When using Azure IoT Operations (Azure IoT Operations), Azure Device Registry projects assets as Azure resources in the cloud within a single registry. The single registry is a source of truth for asset metadata and asset management capabilities. However, Azure IoT Operations includes various other components beyond Azure Device Registry. For detailed information on the high availability and zero data loss features of Azure IoT Operations components, refer to [Azure IoT Operations frequently asked questions](/azure/iot-operations/troubleshoot/iot-operations-faq#does-azure-iot-operations-offer-high-availability-and-zero-data-loss-features-). +++### Region down experience ++During a region outage, Microsoft adheres to the Recovery Time Objective (RTO) to recover the service. During this time, the customer can expect some service interruption until the service is fully recovered. ++In a complete region loss scenario, you can expect a manual recovery from Microsoft. +++For Azure Device Registry, Recovery Time Objective (RTO) is approximately 24 hours. For Recovery Point Objective (RPO), you can expect less than 15 minutes. +++## Service-level agreement (SLA) ++The service-level agreement (SLA) for Azure Device Registry describes the expected availability of the service, and the conditions that must be met to achieve that availability expectation. To understand those conditions, it's important that you review the [Service Level Agreements (SLA) for Online Services](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services). +++## Related content +++- [What is Azure IoT Operations? - Azure IoT Operations Preview](/azure/iot-operations/overview-iot-operations) ++- [Reliability in Azure](/azure/availability-zones/overview) |
| reliability | Reliability Hdinsight On Aks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-hdinsight-on-aks.md | CustomerIntent: As a cloud architect/engineer, I want to understand reliability > [!IMPORTANT] > This feature is currently in preview. The [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include more legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability. For information about this specific preview, see [Azure HDInsight on AKS preview information](/azure/hdinsight-aks/preview). For questions or feature suggestions, please submit a request on [AskHDInsight](https://aka.ms/askhdinsight) with the details and follow us for more updates on [Azure HDInsight Community](https://www.linkedin.com/groups/14313521/). -This article describes reliability support in [Azure HDInsight on Azure Kubernetes Service (AKS)](../hdinsight-aks/overview.md), and covers both [specific reliability recommendations](#reliability-recommendations) and [disaster recovery and business continuity](#disaster-recovery-and-business-continuity). For a more detailed overview of reliability principles in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). +This article describes reliability support in [Azure HDInsight on Azure Kubernetes Service (AKS)](../hdinsight-aks/overview.md), and [disaster recovery and business continuity](#disaster-recovery-and-business-continuity). -## Reliability recommendations ---### Reliability recommendations summary --| Category | Priority |Recommendation | -||--|| -| Availability |:::image type="icon" source="medi#clusters) | -| |:::image type="icon" source="medi) | -| Monitoring |:::image type="icon" source="medi) | -| |:::image type="icon" source="medi) | -| Security |:::image type="icon" source="medi) | ## Availability zone support |
| reliability | Reliability Image Builder | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-image-builder.md | Last updated 08/22/2023 # Reliability in Azure Image Builder (AIB) -This article contains [specific reliability recommendations for Image Builder](#reliability-recommendations) and [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). +This article contains [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). Azure Image Builder (AIB) is a regional service with a cluster that serves single regions. The AIB regional setup keeps data and resources within the regional boundary. AIB as a service doesn't do fail over for cluster and SQL database in region down scenarios. -For an architectural overview of reliability in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). -- >[!NOTE] > Azure Image Builder doesn't support [availability zones](./availability-zones-overview.md). -## Reliability recommendations -- -### Reliability recommendations summary ---| Category | Priority |Recommendation | -||--|| -| [**High Availability**](#high-availability) |:::image type="icon" source="media/icon-recommendation-low.svg":::| [Use generation 2 virtual machine source images](#-use-generation-2-virtual-machine-vm-source-images) | -|[**Disaster Recovery**](#disaster-recovery)|:::image type="icon" source="media/icon-recommendation-low.svg"::: |[Replicate image templates to a secondary region](#-replicate-image-templates-to-a-secondary-region) | ---### High availability - -#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Use generation 2 virtual machine (VM) source images** --When building your image templates, use source images that support generation 2 VMs. Generation 2 VMs support key features that arenΓÇÖt supported in generation 1 VMs such as: --- Increased memory-- Support for disks greater than 2TB-- New UEFI-based boot architecture instead, which can improve boot and installation times-- Intel Software Guard Extensions (Intel SGX)-- Virtualized persistent memory (vPMEM)---For more information on generation 2 VM features and capabilities, see [Generation 2 VMs: Features and capabilities](/azure/virtual-machines/generation-2#features-and-capabilities). --### Disaster recovery --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Replicate image templates to a secondary region** --The Azure Image Builder service that's used to deploy Image Templates doesnΓÇÖt currently support availability zones. Therefore, when building your image templates, you should replicate them to a secondary region, preferably to your primary regionΓÇÖs [paired region](./availability-zones-overview.md#paired-and-unpaired-regions). With a secondary region, you can quickly recover from a region failure and continue to deploy virtual machines from your image templates. For more information, see [Cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). ---# [Azure Resource Graph](#tab/graph) ---- ## Cross-region disaster recovery and business continuity |
| reliability | Reliability Load Balancer | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-load-balancer.md | Title: Reliability in Azure Load Balancer description: Find out about reliability in Azure Load Balancer -+ Previously updated : 02/05/2024 Last updated : 10/31/2024 # Reliability in Load Balancer -This article contains [specific reliability recommendations](#reliability-recommendations) for [Load Balancer](/azure/load-balancer/load-balancer-overview), as well as detailed information on Load Balancer regional resiliency with [availability zones](#availability-zone-support) and [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). +This article contains detailed information on Load Balancer regional resiliency with [availability zones](#availability-zone-support) and [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). -For an architectural overview of reliability in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). ---## Reliability recommendations -- -### Reliability recommendations summary --| Category | Priority |Recommendation | -||--|| -|[**Availability**](#availability) |:::image type="icon" source="media/icon-recommendation-high.svg":::|[Ensure that Standard Load Balancer is zone-redundant](#-use-nat-gateway-instead-of-outbound-rules-for-production-workloads) | -| |:::image type="icon" source="media/icon-recommendation-high.svg"::: |[Ensure that the backend pool contains at least two instances](#-ensure-that-the-backend-pool-contains-at-least-two-instances) | -|[**System Efficiency**](#system-efficiency) |:::image type="icon" source="media/icon-recommendation-medium.svg":::|[Use NAT Gateway instead of outbound rules for production workloads](#-use-nat-gateway-instead-of-outbound-rules-for-production-workloads) | -| |:::image type="icon" source="media/icon-recommendation-high.svg":::| [Use Standard Load Balancer SKU](#-use-standard-load-balancer-sku) | ---### Availability ---#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Ensure that Standard Load Balancer is zone-redundant** --In a region that supports availability zones, Standard Load Balancer should be deployed with zone-redundancy. A zone-redundant Load Balancer allows traffic to be served by a single frontend IP address that can survive zone failure. The frontend IP may be used to reach all (non-impacted) backend pool members regardless of zone. If an availability zone fails, the data path can survive as long as the remaining zones in the region remain healthy. For more information, see [Zone-redundant load balancer](#zone-redundant-load-balancer). ---# [Azure Resource Graph](#tab/graph) -------#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Ensure that the backend pool contains at least two instances** --Deploy Load Balancer with at least two instances in the backend. A single instance could result in a single point of failure. In order to build for scale, you might want to pair load balancer with [Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/overview). ---# [Azure Resource Graph](#tab/graph) ------### System Efficiency ---#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Use NAT Gateway instead of outbound rules for production workloads** --Outbound rules allocates fixed amounts of SNAT ports to each virtual machine instance in a backend pool. This method of allocation can lead to SNAT port exhaustion, especially if uneven traffic patterns result in a specific virtual machine sending a higher volume of outgoing connections. For production workloads, it's recommended that you couple Standard Load Balancer or any subnet deployment with [Azure NAT Gateway](/azure/nat-gateway/nat-overview). NAT Gateway dynamically allocates SNAT ports across all virtual machine instances in a subnet and in turn reduces the risk of SNAT port exhaustion. ---# [Azure Resource Graph](#tab/graph) --------#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Use Standard Load Balancer SKU** --Standard SKU Load Balancer supports availability zones and zone resiliency, while the Basic SKU doesn't. When a zone goes down, your zone-redundant Standard Load Balancer will not be impacted and your deployments are able to withstand zone failures within a region. In addition, Standard Load Balancer supports cross region load balancing to ensure that your application isn't impacted by region failures. -->[!NOTE] -> Basic load balancers donΓÇÖt have a Service Level Agreement (SLA). --# [Azure Resource Graph](#tab/graph) ---- ## Availability zone support |
| reliability | Reliability Traffic Manager | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-traffic-manager.md | Title: Reliability in Azure Traffic Manager description: Learn about reliability in Azure Traffic Manager. -+ Previously updated : 02/06/2024 Last updated : 10/31/2024 # Reliability in Azure Traffic Manager -This article contains [specific reliability recommendations for Azure Traffic Manager](#reliability-recommendations) as well as [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity) support for Azure Traffic Manager. --- For a more detailed overview of reliability principles in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). --## Reliability recommendations -- -### Reliability recommendations summary --| Category | Priority |Recommendation | -||--|| -| [**Availability**](#availability) |:::image type="icon" source="media/icon-recommendation-high.svg":::| [Traffic Manager Monitor status should be Online](#-traffic-manager-monitor-status-should-be-online) | -| |:::image type="icon" source="media/icon-recommendation-high.svg":::| [Traffic manager profiles should have more than one endpoint](#-traffic-manager-profiles-should-have-more-than-one-endpoint) | -|[**System efficiency**](#system-efficiency)|:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[TTL value of user profiles should be in 60 seconds](#-ttl-value-of-user-profiles-should-be-in-60-seconds) | -|[**Disaster recovery**](#disaster-recovery)|:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Configure at least one endpoint within another region](#-configure-at-least-one-endpoint-within-another-region) | -||:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Ensure endpoint configured to ΓÇ£(All World)ΓÇ¥ for geographic profiles](#-ensure-endpoint-configured-to-all-world-for-geographic-profiles) | ---### Availability - -#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Traffic Manager Monitor Status should be Online** --Monitor status should be online to provide failover for the application workload. If the health of your Traffic Manager displays a **Degraded** status, then the status of one or more endpoints may also be **Degraded**. --For more information Traffic Manager endpoint monitoring, see [Traffic Manager endpoint monitoring](/azure/traffic-manager/traffic-manager-monitoring). --To troubleshoot a degraded state on Azure Traffic Manager, see [Troubleshooting degraded state on Azure Traffic Manager](/azure/traffic-manager/traffic-manager-troubleshooting-degraded). --#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Traffic manager profiles should have more than one endpoint** --When configuring the Azure traffic manager, you should provision minimum of two endpoints to fail-over the workload to another instance. --To learn about Traffic Manager endpoint types, see [Traffic Manager endpoints](/azure/traffic-manager/traffic-manager-endpoint-types). --### System Efficiency --#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **TTL value of user profiles should be in 60 seconds** --Time to Live (TTL) affects how recent of a response a client will get when it makes a request to Azure Traffic Manager. Reducing the TTL value means that the client will be routed to a functioning endpoint faster in the case of a failover. Configure your TTL to 60 seconds to route traffic to a health endpoint as quickly as possible. --For more information on configuring DNS TTL, see [Configure DNS Time to Live](/azure/advisor/advisor-reference-performance-recommendations#configure-dns-time-to-live-to-60-seconds). --### Disaster recovery --#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Configure at least one endpoint within another region** --Profiles should have more than one endpoint to ensure availability if one of the endpoints fails. It is also recommended that endpoints be in different regions. --To learn about Traffic Manager endpoint types, see [Traffic Manager endpoints](/azure/traffic-manager/traffic-manager-endpoint-types). ---#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Ensure endpoint configured to ΓÇ£(All World)ΓÇ¥ for geographic profiles** --For geographic routing, traffic is routed to endpoints based on defined regions. When a region fails, there is no pre-defined failover. Having an endpoint where the Regional Grouping is configured to ΓÇ£All (World)ΓÇ¥ for geographic profiles will avoid traffic black holing and guarantee service remains available. --To learn how to add and configure an endpoint, see [Add, disable, enable, delete, or move endpoints](/azure/traffic-manager/traffic-manager-manage-endpoints). +This article contains [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity) support for Azure Traffic Manager. ## Cross-region disaster recovery and business continuity |
| reliability | Reliability Virtual Machine Scale Sets | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-virtual-machine-scale-sets.md | Title: Reliability in Azure Virtual Machine Scale Sets description: Learn about reliability in Azure Virtual Machine Scale Sets. -+ Previously updated : 06/12/2023 Last updated : 10/31/2024 # Reliability in Virtual Machine Scale Sets -This article contains [specific reliability recommendations](#reliability-recommendations) and information on [availability zones support](#availability-zone-support) for Virtual Machine Scale Sets. +This article contains information on [availability zones support](#availability-zone-support) for Virtual Machine Scale Sets. >[!NOTE] >Virtual Machine Scale Sets can only be deployed into one region. If you want to deploy VMs across multiple regions, see [Virtual Machines-Disaster recovery: cross-region failover](./reliability-virtual-machines.md#cross-region-disaster-recovery-and-business-continuity). -For an architectural overview of reliability in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). ---## Reliability recommendations ----### Reliability recommendations summary --| Category | Priority |Recommendation | -||--|| -| [**High Availability**](#high-availability) |:::image type="icon" source="../reliability/media/icon-recommendation-high.svg":::| [Enable automatic repair policy](#-enable-automatic-repair-policy) | -| |:::image type="icon" source="../reliability/media/icon-recommendation-high.svg":::| [Deploy Virtual Machine Scale Sets across availability zones with Virtual Machine Scale Sets Flex](#-deploy-virtual-machine-scale-sets-across-availability-zones-with-virtual-machine-scale-sets-flex) | -| [**Scalability**](#scalability) |:::image type="icon" source="../reliability/media/icon-recommendation-medium.svg":::| [VMSS-1: Deploy VMs with flexible orchestration mode](#-deploy-vms-with-flexible-orchestration-mode) | -| |:::image type="icon" source="../reliability/media/icon-recommendation-high.svg":::| [Configure Virtual Machine Scale Sets Autoscale to Automatic](#-configure-virtual-machine-scale-sets-autoscale-to-automatic) | -| |:::image type="icon" source="../reliability/media/icon-recommendation-low.svg":::| [Set Virtual Machine Scale Sets custom scale-in policies to default](#-set-virtual-machine-scale-sets-custom-scale-in-policies-to-default) | -| [**Disaster Recovery**](#disaster-recovery) |:::image type="icon" source="../reliability/media/icon-recommendation-low.svg":::| [Enable Protection Policy for all Virtual Machine Scale Set VMs](#-enable-protection-policy-for-all-virtual-machine-scale-set-vms) | -| [**Monitoring**](#monitoring) |:::image type="icon" source="../reliability/media/icon-recommendation-medium.svg":::| [Enable Virtual Machine Scale Sets application health monitoring](#-enable-virtual-machine-scale-sets-application-health-monitoring) | -| [**System Efficiency**](#system-efficiency) |:::image type="icon" source="../reliability/media/icon-recommendation-medium.svg":::| [Configure Allocation Policy Spreading algorithm to max spreading](#-configure-allocation-policy-spreading-algorithm-to-max-spreading) | -| [**Automation**](#automation) |:::image type="icon" source="../reliability/media/icon-recommendation-low.svg":::| [Set patch orchestration options to Azure-orchestrated](#-set-patch-orchestration-options-to-azure-orchestrated) | ---### High availability --#### :::image type="icon" source="../reliability/media/icon-recommendation-high.svg"::: **Enable automatic repair policy** --To achieve high availability for applications, [enable automatic instance repairs](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs#requirements-for-using-automatic-instance-repairs) to maintain a set of healthy VMs. When the [Application Health extension](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-health-extension) or [Load Balancer health probes](../load-balancer/load-balancer-custom-probe-overview.md) find that an instance is unhealthy, automatic instance repair deletes the unhealthy instance and creates a new one to replace it. --A grace period can be set using the property `automaticRepairsPolicy.gracePeriod`. The grace period, specified in minutes and in ISO 8601 format, can range between 10 to 90 minutes, and has a default value of 30 minutes. ---# [Azure Resource Graph](#tab/graph-4) -------#### :::image type="icon" source="../reliability/media/icon-recommendation-high.svg"::: **Deploy Virtual Machine Scale Sets across availability zones with Virtual Machine Scale Sets Flex** --When you create your Virtual Machine Scale Sets, use availability zones to protect your applications and data against unlikely datacenter failure. For more information, see [Availability zone support](#availability-zone-support). --# [Azure Resource Graph](#tab/graph-4) ------### Scalability --#### :::image type="icon" source="../reliability/media/icon-recommendation-medium.svg"::: **Deploy VMs with flexible orchestration mode** --All VMs, including single instance VMs, should be deployed into a scale set using [flexible orchestration mode](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes#scale-sets-with-flexible-orchestration) to future-proof your application for scaling and availability. Flexible orchestration offers high availability guarantees (up to 1000 VMs) by spreading VMs across fault domains in a region or within an availability zone. --For more information on how to use scale sets appropriately, see [When to use Virtual Machine Scale Sets instead of VMs](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-design-overview#when-to-use-scale-sets-instead-of-virtual-machines) --# [Azure Resource Graph](#tab/graph-1) ------#### :::image type="icon" source="../reliability/media/icon-recommendation-high.svg"::: **Configure Virtual Machine Scale Sets Autoscale to Automatic** --[Autoscale is a built-in feature of Azure Monitor](/azure/azure-monitor/autoscale/autoscale-overview) that helps the performance and cost-effectiveness of your resources by adding and removing scale set VMs based on demand. In addition, you can choose to scale your resources manually to a specific instance count or in accordance with metrics thresholds. You can also schedule instance counts that scale during designated time windows. --To learn how to enable automatic OS image upgrades, see [Azure Virtual Machine Scale Set automatic OS image upgrades](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade). --# [Azure Resource Graph](#tab/graph-2) -------#### :::image type="icon" source="../reliability/media/icon-recommendation-low.svg"::: **Set Virtual Machine Scale Sets custom scale-in policies to default** ---The [Virtual Machine Scale Sets custom scale-in policy feature](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy) gives you a way to configure the order in which virtual machines are scaled-in. There are three scale-in policy configurations: --- [Default](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy?WT.mc_id=Portal-Microsoft_Azure_Monitoring#default-scale-in-policy)-- [NewestVM](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy?WT.mc_id=Portal-Microsoft_Azure_Monitoring#newestvm-scale-in-policy)-- [OldestVM](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy?WT.mc_id=Portal-Microsoft_Azure_Monitoring#oldestvm-scale-in-policy)--A Virtual Machine Scale Set deployment can be scaled-out or scaled-in based on an array of metrics, including platform and user-defined custom metrics. While a scale-out creates new virtual machines based on the scale set model, a scale-in affects running virtual machines that may have different configurations and/or functions as the scale set workload evolves. --It's not necessary that you specify a scale-in policy if you only want the default ordering to be followed, as the default custom scale-in policy provides the best algorithm and flexibility for most of the scenarios. The default ordering is as follows: --1. Balance virtual machines across availability zones (if the scale set is deployed with availability zone support). -1. Balance virtual machines across fault domains (best effort). -1. Delete virtual machine with the highest instance ID. --Only use the *Newest* and *Oldest* policies when your workload requires that the oldest or newest VMs should be deleted after balancing across availability zones. -->[!NOTE] ->Balancing across availability zones or fault domains doesn't move VMs across availability zones or fault domains. The balancing is achieved through the deletion of virtual machines from the unbalanced availability zones or fault domains until the distribution of virtual machines becomes balanced. ---# [Azure Resource Graph](#tab/graph-3) ---------### Disaster recovery --#### :::image type="icon" source="../reliability/media/icon-recommendation-low.svg"::: **Enable Protection Policy for all Virtual Machine Scale Set VMs** --Use [Virtual Machine Scale Sets Protection Policy](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-instance-protection) if you want specific VMs to be treated differently from the rest of the scale set instance. --As your application processes traffic, there can be situations where you want specific VMs to be treated differently from the rest of the scale set instance. For example, certain VMs in the scale set could be performing long-running operations, and you donΓÇÖt want these VMs to be scaled-in until the operations complete. You might also have specialized a few VMs in the scale set to perform different tasks than other members of the scale set. You require these special VMs not to be modified with the other VMs in the scale set. Instance protection provides the extra controls to enable these and other scenarios for your application. --# [Azure Resource Graph](#tab/graph-5) -----### Monitoring --#### :::image type="icon" source="../reliability/media/icon-recommendation-medium.svg"::: **Enable Virtual Machine Scale Sets application health monitoring** --Monitoring your application health is an important signal for managing and upgrading your deployment. Azure Virtual Machine Scale Sets provides support for rolling upgrades, including: --- [Automatic OS-Image Upgrades](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade)-- [Automatic VM Guest Patching](/azure/virtual-machines/automatic-vm-guest-patching), which relies on health monitoring of individual VMs to upgrade your deployment. -- [Load Balancer health probes](../load-balancer/load-balancer-custom-probe-overview.md) *or* [Application Health extension](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-health-extension), which both monitors the application health of each VM in your scale set and [performs instance repairs using Automatic Instance Repairs](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs).---# [Azure Resource Graph](#tab/graph-6) -------### System Efficiency --#### :::image type="icon" source="../reliability/media/icon-recommendation-medium.svg"::: **Configure Allocation Policy Spreading algorithm to max spreading** --With max spreading, the scale set spreads your VMs across as many fault domains as possible within each zone. This spreading could be across greater or fewer than five fault domains per zone. With static fixed spreading, the scale set spreads your VMs across exactly five fault domains per zone. If the scale set can't find five distinct fault domains per zone to satisfy the allocation request, the request fails. --For more information, see [Spreading options](#spreading-options). --# [Azure Resource Graph](#tab/graph-6) ------### Automation --#### :::image type="icon" source="../reliability/media/icon-recommendation-low.svg"::: **Set patch orchestration options to Azure-orchestrated** --Enable automatic VM guest patching for your Azure VMs. Automatic VM guest patching helps ease update management by safely and automatically patching VMs to maintain security compliance, while limiting the blast radius of VMs. --# [Azure Resource Graph](#tab/graph-6) ----- ## Availability zone support [!INCLUDE [Availability zone description](./includes/reliability-availability-zone-description-include.md)] It's also recommended that you use the max spreading deployment option for your When you deploy a scale set into one or more availability zones, you have the following spreading options (as of API version *2017-12-01*): -- **Max spreading (platformFaultDomainCount = 1)**. Max spreading is the recommended deployment option, as it provides the best spreading in most cases. If you to spread replicas across distinct hardware isolation units, it's recommended that you spread across availability zones and utilize max spreading within each zone.+- **Max spreading (platformFaultDomainCount = 1)**. Max spreading is the recommended deployment option, as it provides the best spreading in most cases. If you spread replicas across distinct hardware isolation units, it's recommended that you spread across availability zones and utilize max spreading within each zone. With max spreading, the scale set spreads your VMs across as many fault domains as possible within each zone. This spreading could be across greater or fewer than five fault domains per zone. When you deploy a Virtual Machine Scale Set, you have the option to deploy with > [Deploy applications on Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/tutorial-install-apps-cli) > [!div class="nextstepaction"]-> [Use autoscale with Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/tutorial-autoscale-cli). +> [Use autoscale with Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/tutorial-autoscale-cli). |
| reliability | Reliability Virtual Machines | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/reliability-virtual-machines.md | Title: Reliability in Azure Virtual Machines description: Find out about reliability in Azure Virtual Machines --++ Previously updated : 07/18/2023 Last updated : 10/31/2024 # Reliability in Virtual Machines -This article contains [specific reliability recommendations for Virtual Machines](#reliability-recommendations), as well as detailed information on VM regional resiliency with [availability zones](#availability-zone-support) and [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). ---For an architectural overview of reliability in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). ---## Reliability recommendations -- -### Reliability recommendations summary --| Category | Priority |Recommendation | -||--|| -| [**High Availability**](#high-availability) |:::image type="icon" source="media/icon-recommendation-high.svg":::| [Run production workloads on two or more VMs using Azure Virtual Machine Scale Sets Flex](#-run-production-workloads-on-two-or-more-vms-using-virtual-machine-scale-sets-flex) | -||:::image type="icon" source="media/icon-recommendation-high.svg"::: |[Deploy VMs across availability zones or use Virtual Machine Scale Sets Flex with zones](#-deploy-vms-across-availability-zones-or-use-virtual-machine-scale-sets-flex-with-zones) | -||:::image type="icon" source="media/icon-recommendation-high.svg":::|[Migrate VMs using availability sets to Virtual Machine Scale Sets Flex](#-migrate-vms-using-availability-sets-to-virtual-machine-scale-sets-flex) | -||:::image type="icon" source="media/icon-recommendation-high.svg"::: |[Use managed disks for VM disks](#-use-managed-disks-for-vm-disks)| -|[**Disaster Recovery**](#disaster-recovery)| :::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Replicate VMs using Azure Site Recovery](#-replicate-vms-using-azure-site-recovery) | -||:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Back up data on your VMs with Azure Backup service](#-back-up-data-on-your-vms-with-azure-backup-service) | -|[**Performance**](#performance) |:::image type="icon" source="media/icon-recommendation-low.svg"::: | [Host application and database data on a data disk](#-host-application-and-database-data-on-a-data-disk)| -||:::image type="icon" source="media/icon-recommendation-high.svg"::: | [Production VMs should be using SSD disks](#-production-vms-should-be-using-ssd-disks)| -||:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Enable Accelerated Networking (AccelNet)](#-enable-accelerated-networking-accelnet) | -||:::image type="icon" source="media/icon-recommendation-low.svg"::: |[When AccelNet is enabled, you must manually update the GuestOS NIC drive](#-when-accelnet-is-enabled-you-must-manually-update-the-guestos-nic-driver) | -|[**Management**](#management)|:::image type="icon" source="media/icon-recommendation-low.svg"::: |[VM-9: Watch for VMs in Stopped state](#-review-vms-in-stopped-state) | -||:::image type="icon" source="media/icon-recommendation-high.svg"::: |[Use maintenance configurations for the VM](#-use-maintenance-configurations-for-the-vm) | -|[**Security**](#security)|:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[VVMs shouldn't have a Public IP directly associated](#-vms-shouldnt-have-a-public-ip-directly-associated) | -||:::image type="icon" source="media/icon-recommendation-low.svg"::: |[Virtual Network Interfaces have an NSG associated](#-vm-network-interfaces-have-a-network-security-group-nsg-associated) | -||:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[IP Forwarding should only be enabled for Network Virtual Appliances](#-ip-forwarding-should-only-be-enabled-for-network-virtual-appliances) | -||:::image type="icon" source="media/icon-recommendation-low.svg"::: |[Network access to the VM disk should be set to "Disable public access and enable private access"](#-network-access-to-the-vm-disk-should-be-set-to-disable-public-access-and-enable-private-access) | -||:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Enable disk encryption and data at rest encryption by default](#-enable-disk-encryption-and-data-at-rest-encryption-by-default) | -|[**Networking**](#networking) | :::image type="icon" source="media/icon-recommendation-low.svg"::: |[Customer DNS Servers should be configured in the Virtual Network level](#-dns-servers-should-be-configured-in-the-virtual-network-level) | -|[**Storage**](#storage) |:::image type="icon" source="media/icon-recommendation-medium.svg"::: |[Shared disks should only be enabled in clustered servers](#-shared-disks-should-only-be-enabled-in-clustered-servers) | -|[**Compliance**](#compliance)| :::image type="icon" source="media/icon-recommendation-low.svg"::: |[Ensure that your VMs are compliant with Azure Policies](#-ensure-that-your-vms-are-compliant-with-azure-policies) | -|[**Monitoring**](#monitoring)| :::image type="icon" source="media/icon-recommendation-low.svg"::: |[Enable VM Insights](#-enable-vm-insights) | -||:::image type="icon" source="media/icon-recommendation-low.svg"::: |[Configure diagnostic settings for all Azure resources](#-configure-diagnostic-settings-for-all-azure-resources) | --### High availability - -#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Run production workloads on two or more VMs using Virtual Machine Scale Sets Flex** --To safeguard application workloads from downtime due to the temporary unavailability of a disk or VM, it's recommended that you run production workloads on two or more VMs using Virtual Machine Scale Sets Flex. --To run production workloads, you can use: --- [Azure Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/overview) to create and manage a group of load balanced VMs. The number of VM instances can automatically increase or decrease in response to demand or a defined schedule.--- **Availability zones**. For more information on availability zones and VMs, see [Availability zone support](#availability-zone-support).---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-high.svg"::: *Deploy VMs across availability zones or use Virtual Machine Scale Sets Flex with zones** - -When you create your VMs, use availability zones to protect your applications and data against unlikely datacenter failure. For more information about availability zones for VMs, see [Availability zone support](#availability-zone-support) in this document. --For information on how to enable availability zones support when you create your VM, see [create availability zone support](#create-a-resource-with-availability-zones-enabled). --For information on how to migrate your existing VMs to availability zone support, see [migrate to availability zone support](#migrate-to-availability-zone-support). ---# [Azure Resource Graph](#tab/graph) -------#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Migrate VMs using availability sets to Virtual Machine Scale Sets Flex** --Modernize your workloads by migrating them from VMs to Virtual Machine Scale Sets Flex. --With Virtual Machine Scale Sets Flex, you can deploy your VMs in one of two ways: --- Across zones-- In the same zone, but across fault domains (FDs) and update domains (UD) automatically. --In an N-tier application, it's recommended that you place each application tier into its own Virtual Machine Scale Sets Flex. --# [Azure Resource Graph](#tab/graph) -------#### :::image type="icon" source="media/icon-recommendation-high.svg"::: *Use managed disks for VM disks** --To provide better reliability for VMs in an availability set, use managed disks. Managed disks are sufficiently isolated from each other to avoid single points of failure. Also, managed disks arenΓÇÖt subject to the IOPS limits of VHDs created in a storage account. ---# [Azure Resource Graph](#tab/graph) -----### Disaster recovery --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Replicate VMs using Azure Site Recovery** --When you replicate Azure VMs using Site Recovery, all VM disks are continuously replicated to the target region asynchronously. The recovery points are created every few minutes, which gives you a Recovery Point Objective (RPO) in the order of minutes. You can conduct disaster recovery drills as many times as you want, without affecting the production application or the ongoing replication. --To learn how to run a disaster recovery drill, see [Run a test failover](/azure/site-recovery/site-recovery-test-failover-to-azure). ---# [Azure Resource Graph](#tab/graph) -----#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Back up data on your VMs with Azure Backup service** --The Azure Backup service provides simple, secure, and cost-effective solutions to back up your data and recover it from the Microsoft Azure cloud. For more information, see [What is the Azure Backup Service](/azure/backup/backup-overview). --# [Azure Resource Graph](#tab/graph) -----### Performance --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Host application and database data on a data disk** --A data disk is a managed disk thatΓÇÖs attached to a VM. Use the data disk to store application data, or other data you need to keep. Data disks are registered as SCSI drives and are labeled with a letter that you choose. Hosting your data on a data disk makes it easy to back up or restore your data. You can also migrate the disk without having to move the entire VM and Operating System. Also, you can select a different disk SKU, with different type, size, and performance that meet your requirements. For more information on data disks, see [Data Disks](/azure/virtual-machines/managed-disks-overview#data-disk). --# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Production VMs should be using SSD disks** ---Premium SSD disks offer high-performance, low-latency disk support for I/O-intensive applications and production workloads. Standard SSD Disks are a cost-effective storage option optimized for workloads that need consistent performance at lower IOPS levels. --It's recommended that you: --- Use Standard HDD disks for Dev/Test scenarios and less critical workloads at lowest cost.-- Use Premium SSD disks instead of Standard HDD disks with your premium-capable VMs. For any Single Instance VM using premium storage for all Operating System Disks and Data Disks, Azure guarantees VM connectivity of at least 99.9%. --If you want to upgrade from Standard HDD to Premium SSD disks, consider the following issues: --- Upgrading requires a VM reboot and this process takes 3-5 minutes to complete. -- If VMs are mission-critical production VMs, evaluate the improved availability against the cost of premium disks.- --For more information on Azure managed disks and disks types, see [Azure managed disk types](/azure/virtual-machines/disks-types#premium-ssd). ----# [Azure Resource Graph](#tab/graph) -----### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Enable Accelerated Networking (AccelNet)** --AccelNet enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its networking performance. This high-performance path bypasses the host from the data path, which reduces latency, jitter, and CPU utilization for the most demanding network workloads on supported VM types. --For more information on Accelerated Networking, see [Accelerated Networking](/azure/virtual-network/accelerated-networking-overview?tabs=redhat.) ---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **When AccelNet is enabled, you must manually update the GuestOS NIC driver** --When AccelNet is enabled, the default Azure Virtual Network interface in the GuestOS is replaced for a Mellanox interface. As a result, the GuestOS NIC driver is provided from Mellanox, a third party vendor. Although Marketplace images maintained by Microsoft are offered with the latest version of Mellanox drivers, once the VM is deployed, you need to manually update GuestOS NIC driver every six months. --# [Azure Resource Graph](#tab/graph) -----### Management --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Review VMs in stopped state** -VM instances go through different states, including provisioning and power states. If a VM is in a stopped state, the VM may be facing an issue or is no longer necessary and could be removed to help reduce costs. --# [Azure Resource Graph](#tab/graph) -----#### :::image type="icon" source="media/icon-recommendation-high.svg"::: **Use maintenance configurations for the VM** --To ensure that VM updates/interruptions are done in a planned time frame, use maintenance configuration settings to schedule and manage updates. For more information on managing VM updates with maintenance configurations, see [Managing VM updates with Maintenance Configurations](/azure/virtual-machines/maintenance-configurations). ---# [Azure Resource Graph](#tab/graph) -----### Security --#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **VMs shouldn't have a Public IP directly associated** --If a VM requires outbound internet connectivity, it's recommended that you use NAT Gateway or Azure Firewall. NAT Gateway or Azure Firewall help to increase security and resiliency of the service, since both services have higher availability and [Source Network Address Translation (SNAT)](/azure/load-balancer/load-balancer-outbound-connections) ports. For inbound internet connectivity, it's recommended that you use a load balancing solution such as Azure Load Balancer and Application Gateway. ---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-low.svg"::: *VM network interfaces have a Network Security Group (NSG) associated** --It's recommended that you associate an NSG to a subnet, or a network interface, but not both. Since rules in an NSG associated to a subnet can conflict with rules in an NSG associated to a network interface, you can have unexpected communication problems that require troubleshooting. For more information, see [Intra-Subnet traffic](/azure/virtual-network/network-security-group-how-it-works#intra-subnet-traffic). ---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **IP forwarding should only be enabled for network virtual appliances** --IP forwarding enables the virtual machine network interface to: --- Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.--- Send network traffic with a different source IP address than the one assigned to one of a network interfaceΓÇÖs IP configurations.--The IP forwarding setting must be enabled for every network interface that's attached to the VM receiving traffic to be forwarded. A VM can forward traffic whether it has multiple network interfaces, or a single network interface attached to it. While IP forwarding is an Azure setting, the VM must also run an application that's able to forward the traffic, such as firewall, WAN optimization, and load balancing applications. --To learn how to enable or disable IP forwarding, see [Enable or disable IP forwarding](/azure/virtual-network/virtual-network-network-interface?tabs=azure-portal#enable-or-disable-ip-forwarding). ---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Network access to the VM disk should be set to "Disable public access and enable private access"** --It's recommended that you set VM disk network access to ΓÇ£Disable public access and enable private accessΓÇ¥ and create a private endpoint. To learn how to create a private endpoint, see [Create a private endpoint](/azure/virtual-machines/disks-enable-private-links-for-import-export-portal#create-a-private-endpoint). ---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Enable disk encryption and data at rest encryption by default** --There are several types of encryption available for your managed disks, including Azure Disk Encryption (ADE), Server-Side Encryption (SSE) and encryption at host. --- Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.-- Azure Disk Storage Server-Side Encryption (also referred to as encryption-at-rest or Azure Storage encryption) automatically encrypts data stored on Azure managed disks (OS and data disks) when persisting on the Storage Clusters.-- Encryption at host ensures that data stored on the VM host hosting your VM is encrypted at rest and flows encrypted to the Storage clusters.-- Confidential disk encryption binds disk encryption keys to the VMΓÇÖs TPM and makes the protected disk content accessible only to the VM.--For more information about managed disk encryption options, see [Overview of managed disk encryption options](/azure/virtual-machines/disk-encryption-overview). --# [Azure Resource Graph](#tab/graph) -----### Networking --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **DNS Servers should be configured in the Virtual Network level** --Configure the DNS Server in the Virtual Network to avoid name resolution inconsistency across the environment. For more information on name resolution for resources in Azure virtual networks, see [Name resolution for VMs and cloud services](/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances?tabs=redhat). ---# [Azure Resource Graph](#tab/graph) ------### Storage --#### :::image type="icon" source="media/icon-recommendation-medium.svg"::: **Shared disks should only be enabled in clustered servers** --*Azure shared disks* is a feature of *Azure managed disks* that enables you to attach a managed disk to multiple VMs simultaneously. When you attach a managed disk to multiple VMs, you can either deploy new or migrate existing clustered applications to Azure. Shared disks should only be used in those situations where the disk is assigned to more than one VM member of a cluster. --To learn more about how to enable shared disks for managed disks, see [Enable shared disk](/azure/virtual-machines/disks-shared-enable?tabs=azure-portal). ---# [Azure Resource Graph](#tab/graph) ------### Compliance --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Ensure that your VMs are compliant with Azure Policies** --ItΓÇÖs important to keep your virtual machine (VM) secure for the applications that you run. Securing your VMs can include one or more Azure services and features that cover secure access to your VMs and secure storage of your data. For more information on how to keep your VM and applications secure, see [Azure Policy Regulatory Compliance controls for Azure Virtual Machines](/azure/virtual-machines/security-controls-policy). ---# [Azure Resource Graph](#tab/graph) -----### Monitoring --#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Enable VM Insights** --Enable [VM Insights](/azure/azure-monitor/vm/vminsights-overview) to get more visibility into the health and performance of your virtual machine. VM Insights gives you information on the performance and health of your VMs and virtual machine scale sets, by monitoring their running processes and dependencies on other resources. VM Insights can help deliver predictable performance and availability of vital applications by identifying performance bottlenecks and network issues. Insights can also help you understand whether an issue is related to other dependencies. ---# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="media/icon-recommendation-low.svg"::: **Configure diagnostic settings for all Azure resources** --Platform metrics are sent automatically to Azure Monitor Metrics by default and without configuration. Platform logs provide detailed diagnostic and auditing information for Azure resources and the Azure platform they depend on and are one of the following types: --- **Resource logs** that arenΓÇÖt collected until theyΓÇÖre routed to a destination.-- **Activity logs** that exist on their own but can be routed to other locations.--Each Azure resource requires its own diagnostic setting, which defines the following criteria: --- **Sources** The type of metric and log data to send to the destinations defined in the setting. The available types vary by resource type.-- **Destinations**: One or more destinations to send to.--A single diagnostic setting can define no more than one of each of the destinations. If you want to send data to more than one of a particular destination type (for example, two different Log Analytics workspaces), create multiple settings. Each resource can have up to five diagnostic settings. --Fore information, see [Diagnostic settings in Azure Monitor](/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal). ---# [Azure Resource Graph](#tab/graph) ----+This article contains detailed information on VM regional resiliency with [availability zones](#availability-zone-support) and [cross-region disaster recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). ## Availability zone support |
| reliability | Recommend Cosmos Db Nosql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/reliability/resiliency-recommendations/recommend-cosmos-db-nosql.md | - Title: Resiliency recommendations for Azure Cosmos DB for NoSQL -description: Learn about resiliency recommendations for Azure Cosmos DB for NoSQL ----- Previously updated : 5/06/2024 ----# Resiliency recommendations for Azure Cosmos DB for NoSQL --This article contains recommendations for achieving resiliency for Azure Cosmos DB for NoSQL. Many of the recommendations contain supporting Azure Resource Graph (ARG) queries to help identify non-compliant resources. --## Resiliency recommendations impact matrix --Each recommendation is marked in accordance with the following impact matrix: --| Image | Impact | Description -|-|-|-| -|:::image type="icon" source="../media/icon-recommendation-high.svg"::: |High|Immediate fix needed.| -|:::image type="icon" source="../media/icon-recommendation-medium.svg":::|Medium|Fix within 3-6 months.| -|:::image type="icon" source="../media/icon-recommendation-low.svg":::|Low|Needs to be reviewed.| -- -## Resiliency recommendations summary --| Category | Priority |Recommendation | -||--|| -| [**Availability**](#availability) |:::image type="icon" source="../media/icon-recommendation-high.svg":::| [Configure at least two regions for high availability](#-configure-at-least-two-regions-for-high-availability)| -| [**Disaster recovery**](#disaster-recovery) |:::image type="icon" source="../media/icon-recommendation-high.svg":::| [Enable service-managed failover for multi-region accounts with single write region](#-enable-service-managed-failover-for-multi-region-accounts-with-single-write-region)| -||:::image type="icon" source="../media/icon-recommendation-high.svg":::| [Evaluate multi-region write capability](#-evaluate-multi-region-write-capability)| -|| :::image type="icon" source="../media/icon-recommendation-high.svg"::: | [Choose appropriate consistency mode reflecting data durability requirements](#-choose-appropriate-consistency-mode-reflecting-data-durability-requirements)| -||:::image type="icon" source="../media/icon-recommendation-high.svg":::| [Configure continuous backup mode](#-configure-continuous-backup-mode)| -|[**System efficiency**](#system-efficiency)|:::image type="icon" source="../media/icon-recommendation-high.svg":::| [Ensure query results are fully drained](#-ensure-query-results-are-fully-drained)| -||:::image type="icon" source="../media/icon-recommendation-medium.svg":::| [Maintain singleton pattern in your client](#-maintain-singleton-pattern-in-your-client)| -|[**Application resilience**](#application-resilience)|:::image type="icon" source="../media/icon-recommendation-medium.svg":::| [Implement retry logic in your client](#-implement-retry-logic-in-your-client)| -|[**Monitoring**](#monitoring)|:::image type="icon" source="../media/icon-recommendation-medium.svg":::| [Monitor Cosmos DB health and set up alerts](#-monitor-cosmos-db-health-and-set-up-alerts)| ----### Availability - -#### :::image type="icon" source="../media/icon-recommendation-high.svg"::: **Configure at least two regions for high availability** --It's crucial to enable a secondary region on your Cosmos DB to achieve higher SLA. Doing so doesn't incur any downtime and it's as easy as selecting a pin on map. Cosmos DB instances utilizing Strong consistency need to configure at least three regions to retain write availability if there is one region failure. --**Potential benefits:** Enhances SLA and resilience. --**Learn more:** [Reliability (High availability) in Cosmos DB for No SQL](../reliability-cosmos-db-nosql.md) ---# [Azure Resource Graph](#tab/graph) ------### Disaster recovery --#### :::image type="icon" source="../media/icon-recommendation-high.svg"::: **Enable service-managed failover for multi-region accounts with single write region** --Cosmos DB boasts high uptime and resiliency. Even so, issues may arise. With [Service-Managed failover](../reliability-cosmos-db-nosql.md#service-managed-failover), if a region is down, Cosmos DB automatically switches to the next available region, requiring no user action. ---# [Azure Resource Graph](#tab/graph) -------#### :::image type="icon" source="../media/icon-recommendation-high.svg"::: **Evaluate multi-region write capability** --Multi-region write capability allows for designing applications that are highly available across multiple regions, though it demands careful attention to consistency requirements and conflict resolution. Improper setup may decrease availability and cause data corruption due to unhandled conflicts. --**Potential benefits:** Enhances high availability. --**Learn more:** -- [Distribute your data globally with Azure Cosmos DB](/azure/cosmos-db/distribute-data-globally)-- [Conflict types and resolution policies when using multiple write regions](/azure/cosmos-db/conflict-resolution-policies)----# [Azure Resource Graph](#tab/graph) ------#### :::image type="icon" source="../media/icon-recommendation-high.svg"::: **Choose appropriate consistency mode reflecting data durability requirements** --In a globally distributed database, consistency level impacts data durability during regional outages. Understand data loss tolerance for recovery planning. Use Session consistency unless stronger is needed, accepting higher write latencies and potential write region impact from read-only outages. --**Potential benefits:** Enhances data durability and recovery. --**Learn more:** [Consistency levels in Azure Cosmos DB](/azure/cosmos-db/consistency-levels) -----#### :::image type="icon" source="../media/icon-recommendation-high.svg"::: **Configure continuous backup mode** ---Cosmos DB's backup is always on, offering protection against data mishaps. Continuous mode allows for self-serve restoration to a pre-mishap point, unlike periodic mode, which requires contacting Microsoft support, leading to longer restore times. ---**Potential Benefits:** Faster self-serve data restore. --**Learn more:** [Continuous backup with point in time restore feature in Azure Cosmos DB](/azure/cosmos-db/continuous-backup-restore-introduction) --# [Azure Resource Graph](#tab/graph) ------### System efficiency --#### :::image type="icon" source="../media/icon-recommendation-high.svg"::: **Ensure query results are fully drained** --Cosmos DB has a 4 MB response limit, leading to paginated results for large or partition-spanning queries. Each page shows availability and provides a continuation token for the next. A while loop in code is necessary to traverse all pages until completion. ---**Potential Benefits:** Maximizes data retrieval efficiency. --**Learn more:** [Pagination in Azure Cosmos DB for No SQL](/azure/cosmos-db/nosql/query/pagination#handling-multiple-pages-of-results). ----#### :::image type="icon" source="../media/icon-recommendation-medium.svg"::: **Maintain singleton pattern in your client** ---Using a single instance of the SDK client for each account and application is crucial as connections are tied to the client. Compute environments have a limit on open connections, affecting connectivity when exceeded. ----**Potential Benefits:** Optimizes connections and efficiency. --**Learn more:** [Designing resilient applications with Azure Cosmos DB SDKs](/azure/cosmos-db/nosql/conceptual-resilient-sdk-applications). ---### Application resilience ---#### :::image type="icon" source="../media/icon-recommendation-medium.svg"::: **Implement retry logic in your client** --Cosmos DB SDKs automatically manage many transient errors through retries. Despite this, it's crucial for applications to implement additional retry policies targeting specific cases that the SDKs can't generically address, ensuring more robust error handling. --**Potential Benefits:** Enhances error handling resilience. --**Learn more:** [Designing resilient applications with Azure Cosmos DB SDKs](/azure/cosmos-db/nosql/conceptual-resilient-sdk-applications). ------### Monitoring --#### :::image type="icon" source="../media/icon-recommendation-medium.svg"::: **Monitor Cosmos DB health and set up alerts** --Monitoring the availability and responsiveness of Azure Cosmos DB resources and having alerts set up for your workload is a good practice. This ensures you stay proactive in handling unforeseen events. --**Potential Benefits:** Proactive issue management. --**Learn more:** [Create alerts for Azure Cosmos DB using Azure Monitor](/azure/cosmos-db/create-alerts) |
| role-based-access-control | Security | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/role-based-access-control/built-in-roles/security.md | Manage key vaults, but does not allow you to assign roles in Azure RBAC, and doe [Learn more](/azure/key-vault/general/security-features) + > [!div class="mx-tableFixed"] > | Actions | Description | > | | | |
| role-based-access-control | Compute | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/role-based-access-control/permissions/compute.md | Azure service: [Azure Container Apps](/azure/container-apps/) > | microsoft.app/containerapps/authconfigs/read | Get auth config of a container app | > | microsoft.app/containerapps/authconfigs/write | Create or update auth config of a container app | > | microsoft.app/containerapps/authconfigs/delete | Delete auth config of a container app |+> | microsoft.app/containerapps/builds/read | Get a ContainerApp's Build by Build name | +> | microsoft.app/containerapps/builds/delete | Delete a Container App's Build | > | microsoft.app/containerapps/detectors/read | Get detector of a container app | > | microsoft.app/containerapps/labelhistory/read | Get a Container App's label history |+> | microsoft.app/containerapps/patches/read | Get a ContainerApp's Patch | +> | microsoft.app/containerapps/patches/delete | Delete a ContainerApp's Patch | +> | microsoft.app/containerapps/patches/skip/action | Skip a ContainerApp's Patch | +> | microsoft.app/containerapps/patches/apply/action | Apply a ContainerApp's Patch | > | microsoft.app/containerapps/privateendpointconnectionproxies/validate/action | Validate Container App Private Endpoint Connection Proxy | > | microsoft.app/containerapps/privateendpointconnectionproxies/write | Create or Update Container App Private Endpoint Connection Proxy | > | microsoft.app/containerapps/privateendpointconnectionproxies/read | Get Container App Private Endpoint Connection Proxy | Azure service: [Azure Container Apps](/azure/container-apps/) > | microsoft.app/jobs/delete | Delete a Container Apps Job | > | microsoft.app/jobs/start/action | Start a Container Apps Job | > | microsoft.app/jobs/stop/action | Stop multiple Container Apps Job executions |+> | microsoft.app/jobs/suspend/action | Suspend Container Apps Job | +> | microsoft.app/jobs/resume/action | Resume Container Apps Job | > | microsoft.app/jobs/read | Get a Container Apps Job | > | microsoft.app/jobs/listsecrets/action | List secrets of a container apps job | > | microsoft.app/jobs/authtoken/action | Get Auth Token for Container App Dev APIs to get log stream, exec or port forward from a container. This operation will be deprecated. | Azure service: [Azure Container Apps](/azure/container-apps/) > | microsoft.app/locations/billingmeters/read | Get Billing Meters in a Region | > | microsoft.app/locations/connectedenvironmentoperationresults/read | Get a Connected Environment Long Running Operation Result | > | microsoft.app/locations/connectedenvironmentoperationstatuses/read | Get a Connected Environment Long Running Operation Status |+> | microsoft.app/locations/connectedoperationresults/read | Get a Long Running Operation Result | +> | microsoft.app/locations/connectedoperationstatuses/read | Get a Long Running Operation Status | > | microsoft.app/locations/containerappoperationresults/read | Get a Container App Long Running Operation Result | > | microsoft.app/locations/containerappoperationstatuses/read | Get a Container App Long Running Operation Status | > | microsoft.app/locations/containerappsjoboperationresults/read | Get a Container Apps Job Long Running Operation Result | Azure service: [Azure Container Apps](/azure/container-apps/) > | microsoft.app/managedenvironments/javacomponents/read | Read Managed Environment Java Component | > | microsoft.app/managedenvironments/javacomponents/write | Create or update Managed Environment Java Component | > | microsoft.app/managedenvironments/javacomponents/delete | Delete Managed Environment Java Component |+> | microsoft.app/managedenvironments/maintenanceconfigurations/read | Get maintenance configuration for a Managed Environment. | +> | microsoft.app/managedenvironments/maintenanceconfigurations/write | Create or Update a maintenance configuration of Managed Environment. | +> | microsoft.app/managedenvironments/maintenanceconfigurations/delete | Delete a maintenance configuration of Managed Environment. | > | microsoft.app/managedenvironments/managedcertificates/write | Create or update a Managed Certificate in Managed Environment | > | microsoft.app/managedenvironments/managedcertificates/read | Get a Managed Certificate in Managed Environment | > | microsoft.app/managedenvironments/managedcertificates/delete | Delete a Managed Certificate in Managed Environment | Azure service: [Azure Container Apps](/azure/container-apps/) > | microsoft.app/managedenvironments/storages/delete | Delete a storage of Managed Environment. | > | microsoft.app/managedenvironments/usages/read | Get Quota Usages in a Managed Environment | > | microsoft.app/managedenvironments/workloadprofilestates/read | Get Current Workload Profile States |-> | microsoft.app/microsoft.app/containerapps/builds/read | Get a ContainerApp's Build by Build name | -> | microsoft.app/microsoft.app/containerapps/builds/delete | Delete a Container App's Build | -> | microsoft.app/microsoft.app/containerapps/patches/read | Get a ContainerApp's Patch | -> | microsoft.app/microsoft.app/containerapps/patches/delete | Delete a ContainerApp's Patch | -> | microsoft.app/microsoft.app/containerapps/patches/skip/action | Skip a ContainerApp's Patch | -> | microsoft.app/microsoft.app/containerapps/patches/apply/action | Apply a ContainerApp's Patch | > | microsoft.app/operations/read | Get a list of supported container app operations | > | microsoft.app/sessionpools/write | Create or Update a Session Pool | > | microsoft.app/sessionpools/read | Get a Session Pool | |
| sap | Disaster Recovery Sap Hana | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/disaster-recovery-sap-hana.md | Requirements for additional HSR sites are different for HANA scale-up and HANA s ## HANA scale-up: Add HANA multitarget system replication for DR purposes -With SAP HANA HA hooks SAPHanaSR/susHanaSR for [SLES](./sap-hana-high-availability.md#implement-hana-resource-agents) and [RHEL](./sap-hana-high-availability-rhel.md#implement-the-python-system-replication-hook-saphanasr), you can add additional sites to HANA system replication. The Pacemaker environment is aware of a HANA multitarget setup. +With SAP HANA HA hooks SAPHanaSR/susHanaSR for [SLES](./sap-hana-high-availability.md#implement-hana-resource-agents) and [RHEL](./sap-hana-high-availability-rhel.md#implement-sap-hana-system-replication-hooks), you can add additional sites to HANA system replication. The Pacemaker environment is aware of a HANA multitarget setup. Failure of additional sites doesn't trigger any cluster action. The cluster detects the replication status of connected sites and the monitored attribute for the third site can change between `SOK` and `SFAIL` states. Any takeover tests to the additional site or executing your DR exercise process should first place the cluster resources into maintenance mode to prevent any undesired cluster action. |
| sap | Get Started | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/get-started.md | In the SAP workload documentation space, you can find the following areas: - **Azure Monitor for SAP solutions**: Microsoft developed monitoring solutions specifically for SAP supported OS and DBMS, as well as S/4HANA and NetWeaver. This section documents the deployment and usage of the service ## Change Log+- November 1, 2024: Adding HANA high-availability hook ChkSrv for [dying indexserver for RHEL based cluster setups](./sap-hana-high-availability-rhel.md#implement-sap-hana-system-replication-hooks). - October 29, 2024: some changes on disk caching and smaller updates in [Azure Virtual Machines Oracle DBMS deployment for SAP workload](./dbms-guide-oracle.md). Plus fixing some typoes in HANA storage configuration documents - October 28, 2024: Added information on RedHat support and the configuration of Azure fence agents for VMs in the Azure Government cloud to the document [Set up Pacemaker on Red Hat Enterprise Linux in Azure](./high-availability-guide-rhel-pacemaker.md). - October 25, 2024: Adding documentation link to [SQL Server Azure Virtual Machines DBMS deployment for SAP NetWeaver](./dbms-guide-sqlserver.md) that describes how to disable SMT to be able to use some Mv3 SKUs where SQL Server would have a problem with too large NUMA nodes. |
| sap | Sap Hana High Availability Netapp Files Red Hat | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/sap-hana-high-availability-netapp-files-red-hat.md | Follow the steps in [Set up Pacemaker on Red Hat Enterprise Linux](./high-availa ### Implement the Python system replication hook SAPHanaSR -This step is an important one to optimize the integration with the cluster and improve the detection when a cluster failover is needed. We highly recommend that you configure the SAPHanaSR Python hook. Follow the steps in [Implement the Python system replication hook SAPHanaSR](sap-hana-high-availability-rhel.md#implement-the-python-system-replication-hook-saphanasr). +This step is an important one to optimize the integration with the cluster and improve the detection when a cluster failover is needed. We highly recommend that you configure the SAPHanaSR Python hook. Follow the steps in [Implement the Python system replication hook SAPHanaSR](sap-hana-high-availability-rhel.md#implement-sap-hana-system-replication-hooks). ### Configure file system resources |
| sap | Sap Hana High Availability Rhel | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/sap-hana-high-availability-rhel.md | The steps in this section use the following prefixes: * [2593824 - Linux: Running SAP applications compiled with GCC 7.x](https://launchpad.support.sap.com/#/notes/2593824) * [2886607 - Linux: Running SAP applications compiled with GCC 9.x](https://launchpad.support.sap.com/#/notes/2886607) -1. **[A]** Install the SAP HANA. -- To install SAP HANA System Replication, see [Automating SAP HANA Scale-Up System Replication using the RHEL HA Add-On](https://access.redhat.com/articles/3004101). -- Run the **hdblcm** program from the HANA DVD. Enter the following values at the prompt: - 1. Choose installation: Enter **1**. - 1. Select additional components for installation: Enter **1**. - 1. Enter **Installation Path** [/hana/shared]: Select Enter. - 1. Enter **Local Host Name [..]**: Select Enter. - 1. **Do you want to add additional hosts to the system? (y/n)** [n]: Select Enter. - 1. Enter **SAP HANA System ID**: Enter the SID of HANA, for example: **HN1**. - 1. Enter **Instance Number** [00]: Enter the HANA Instance number. Enter **03** if you used the Azure template or followed the manual deployment section of this article. - 1. Select **Database Mode / Enter Index** [1]: Select Enter. - 1. Select **System Usage / Enter Index** [4]: Select the system usage value. - 1. Enter **Location of Data Volumes** [/hana/data]: Select Enter. - 1. Enter **Location of Log Volumes** [/hana/log]: Select Enter. - 1. **Restrict maximum memory allocation?** [n]: Select Enter. - 1. Enter **Certificate Host Name For Host '...'** [...]: Select Enter. - 1. Enter **SAP Host Agent User (sapadm) Password**: Enter the host agent user password. - 1. Confirm **SAP Host Agent User (sapadm) Password**: Enter the host agent user password again to confirm. - 1. Enter **System Administrator (hdbadm) Password**: Enter the system administrator password. - 1. Confirm **System Administrator (hdbadm) Password**: Enter the system administrator password again to confirm. - 1. Enter **System Administrator Home Directory** [/usr/sap/HN1/home]: Select Enter. - 1. Enter **System Administrator Login Shell** [/bin/sh]: Select Enter. - 1. Enter **System Administrator User ID** [1001]: Select Enter. - 1. Enter **ID of User Group (sapsys)** [79]: Select Enter. - 1. Enter **Database User (SYSTEM) Password**: Enter the database user password. - 1. Confirm **Database User (SYSTEM) Password**: Enter the database user password again to confirm. - 1. **Restart system after machine reboot?** [n]: Select Enter. - 1. **Do you want to continue? (y/n)**: Validate the summary. Enter **y** to continue. --1. **[A]** Upgrade the SAP Host Agent. -- Download the latest SAP Host Agent archive from the [SAP Software Center][sap-swcenter] and run the following command to upgrade the agent. Replace the path to the archive to point to the file that you downloaded: -- ```bash - sudo /usr/sap/hostctrl/exe/saphostexec -upgrade -archive <path to SAP Host Agent>; - ``` +1. **[A]** Install SAP HANA, following [SAP's documentation](https://help.sap.com/docs/SAP_HANA_PLATFORM/2c1988d620e04368aa4103bf26f17727/2d4de94c8bf14cda8d37278647fff8ab.html). 1. **[A]** Configure the firewall. The steps in this section use the following prefixes: 1. **[1]** Create the tenant database. - If you're using SAP HANA 2.0 or MDC, create a tenant database for your SAP NetWeaver system. Replace **NW1** with the SID of your SAP system. - Run the following command as <hanasid\>adm: ```bash The steps in this section use the following prefixes: # site name: SITE1 ``` -## Configure SAP HANA 1.0 System Replication --The steps in this section use the following prefixes: --* **[A]**: The step applies to all nodes. -* **[1]**: The step applies to node 1 only. -* **[2]**: The step applies to node 2 of the Pacemaker cluster only. --1. **[A]** Configure the firewall. -- Create firewall rules to allow HANA System Replication and client traffic. The required ports are listed on [TCP/IP Ports of All SAP Products](https://help.sap.com/viewer/ports). The following commands are just an example to allow HANA 2.0 System Replication. Adapt it to your SAP HANA 1.0 installation. -- ```bash - sudo firewall-cmd --zone=public --add-port=40302/tcp --permanent - sudo firewall-cmd --zone=public --add-port=40302/tcp - ``` --1. **[1]** Create the required users. -- Run the following command as root. Make sure to replace the values for HANA System ID (for example, **HN1**), instance number (**03**), and any usernames, with the values of your SAP HANA installation: -- ```bash - PATH="$PATH:/usr/sap/HN1/HDB03/exe" - hdbsql -u system -i 03 'CREATE USER hdbhasync PASSWORD "passwd"' - hdbsql -u system -i 03 'GRANT DATA ADMIN TO hdbhasync' - hdbsql -u system -i 03 'ALTER USER hdbhasync DISABLE PASSWORD LIFETIME' - ``` --1. **[A]** Create the keystore entry. -- Run the following command as root to create a new keystore entry: -- ```bash - PATH="$PATH:/usr/sap/HN1/HDB03/exe" - hdbuserstore SET hdbhaloc localhost:30315 hdbhasync passwd - ``` --1. **[1]** Back up the database. -- Back up the databases as root: -- ```bash - PATH="$PATH:/usr/sap/HN1/HDB03/exe" - hdbsql -d SYSTEMDB -u system -i 03 "BACKUP DATA USING FILE ('initialbackup')" - ``` -- If you use a multitenant installation, also back up the tenant database: -- ```bash - hdbsql -d HN1 -u system -i 03 "BACKUP DATA USING FILE ('initialbackup')" - ``` --1. **[1]** Configure system replication on the first node. -- Create the primary site as <hanasid\>adm: -- ```bash - su - hdbadm - hdbnsutil -sr_enable ΓÇô-name=SITE1 - ``` --1. **[2]** Configure system replication on the secondary node. -- Register the secondary site as <hanasid\>adm: -- ```bash - HDB stop - hdbnsutil -sr_register --remoteHost=hn1-db-0 --remoteInstance=03 --replicationMode=sync --name=SITE2 - HDB start - ``` - ## Create a Pacemaker cluster Follow the steps in [Setting up Pacemaker on Red Hat Enterprise Linux in Azure](high-availability-guide-rhel-pacemaker.md) to create a basic Pacemaker cluster for this HANA server. Follow the steps in [Setting up Pacemaker on Red Hat Enterprise Linux in Azure]( > > When using HA solutions to manage SAP HANA system replication in combination with systemd-enabled SAP HANA instances (refer to SAP Note [3189534](https://me.sap.com/notes/3189534)), additional steps are necessary to ensure that the HA cluster can manage the SAP instance without systemd interference. So, for SAP HANA system integrated with systemd, additional steps outlined in [Red Hat KBA 7029705](https://access.redhat.com/solutions/7029705) must be followed on all cluster nodes. -## Implement the Python system replication hook SAPHanaSR +## Implement SAP HANA system replication hooks -This important step optimizes the integration with the cluster and improves the detection when a cluster failover is needed. We highly recommend that you configure the SAPHanaSR Python hook. +This important step optimizes the integration with the cluster and improves the detection when a cluster failover is needed. It is mandatory for correct cluster operation to enable the SAPHanaSR hook. We highly recommend that you configure both SAPHanaSR and ChkSrv Python hooks. -1. **[A]** Install the SAP HANA resource agents on **all nodes**. Make sure to enable a repository that contains the package. You don't need to enable more repositories, if you're using an RHEL 8.x HA-enabled image. +1. **[A]** Install the SAP HANA resource agents on **all nodes**. Make sure to enable a repository that contains the package. You don't need to enable more repositories, if you're using an RHEL 8.x or higher HA-enabled image. ```bash # Enable repository that contains SAP HANA resource agents sudo subscription-manager repos --enable="rhel-sap-hana-for-rhel-7-server-rpms" - sudo yum install -y resource-agents-sap-hana + sudo dnf install -y resource-agents-sap-hana ``` > [!NOTE] > For RHEL 8.x and RHEL 9.x, verify that the installed resource-agents-sap-hana package is version 0.162.3-5 or later. -1. **[A]** Install the HANA `system replication hook`. The hook needs to be installed on both HANA DB nodes. -- > [!TIP] - > The Python hook can only be implemented for HANA 2.0. -- 1. Prepare the hook as `root`. -- ```bash - mkdir -p /hana/shared/myHooks - cp /usr/share/SAPHanaSR/srHook/SAPHanaSR.py /hana/shared/myHooks - chown -R hn1adm:sapsys /hana/shared/myHooks - ``` +1. **[A]** Install the HANA `system replication hooks`. The configuration for the replication hooks needs to be installed on both HANA DB nodes. 1. Stop HANA on both nodes. Run as <sid\>adm. This important step optimizes the integration with the cluster and improves the ```output [ha_dr_provider_SAPHanaSR] provider = SAPHanaSR- path = /hana/shared/myHooks + path = /usr/share/SAPHanaSR/srHook execution_order = 1- ++ [ha_dr_provider_chksrv] + provider = ChkSrv + path = /usr/share/SAPHanaSR/srHook + execution_order = 2 + action_on_lost = kill + [trace] ha_dr_saphanasr = info+ ha_dr_chksrv = info ``` + If you point parameter `path` to the default `/usr/share/SAPHanaSR/srHook` location, the Python hook code updates automatically through OS updates or package updates. HANA uses the hook code updates when it next restarts. With an optional own path like `/hana/shared/myHooks`, you can decouple OS updates from the hook version that HANA will use. ++ You can adjust the behavior of `ChkSrv` hook by using the `action_on_lost` parameter. Valid values are [ `ignore` | `stop` | `kill` ]. + 1. **[A]** The cluster requires `sudoers` configuration on each cluster node for <sid\>adm. In this example, that's achieved by creating a new file. Use the `visudo` command to edit the `20-saphana` drop-in file as `root`. ```bash This important step optimizes the integration with the cluster and improves the sapcontrol -nr 03 -function StartSystem ``` -1. **[1]** Verify the hook installation. Run as <sid\>adm on the active HANA system replication site. +1. **[1]** Verify the SRHanaSR hook installation. Run as <sid\>adm on the active HANA system replication site. ```bash cdtrace This important step optimizes the integration with the cluster and improves the # 2021-04-12 21:37:04.898680 ha_dr_SAPHanaSR SOK ``` -For more information on the implementation of the SAP HANA System Replication hook, see [Enable the SAP HA/DR provider hook](https://access.redhat.com/articles/3004101#enable-srhook). +1. **[1]** Verify the ChkSrv hook installation. Run as <sid\>adm on the active HANA system replication site. ++ ```bash + cdtrace + tail -20 nameserver_chksrv.trc + ``` ++For more information on the implementation of the SAP HANA hooks, see [Enabling the SAP HANA srConnectionChanged() hook](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_sap_solutions/8/html-single/automating_sap_hana_scale-up_system_replication_using_the_rhel_ha_add-on/index#con_enable_hook_automating-sap-hana-scale-up-system-replication) and [Enabling the SAP HANA srServiceStateChanged() hook for hdbindexserver process failure action (optional)](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_sap_solutions/8/html-single/automating_sap_hana_scale-up_system_replication_using_the_rhel_ha_add-on/index#con_enable_hdbindexserver_automating-sap-hana-scale-up-system-replication). ## Create SAP HANA cluster resources |
| service-bus-messaging | Message Counters | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/message-counters.md | ms.devlang: azurecli This article shows you different ways of getting message counts for a queue or subscription. Knowing the active message count is useful in determining whether a queue builds up a backlog that requires more resources to process than what has currently been deployed. | Counter | Description |-| -- | - | -| ActiveMessageCount | Number of messages in the queue or subscription that are in the active state and ready for delivery. | +| -- | - | +| ActiveMessageCount | Number of messages in the queue or subscription that are in the active state and ready for delivery. This includes deferred messages. | | ScheduledMessageCount | Number of messages in the scheduled state. | | DeadLetterMessageCount | Number of messages in the dead-letter queue. | | TransferMessageCount | Number of messages pending transfer into another queue or topic. | If an application wants to scale resources based on the length of the queue, it Another useful metric to consider for scaling is the time between when the latest message was sent and when it was processed, also known as "critical time". This is helpful for scenarios where a queue may have thousands of messages in it, but the processing is fast enough to keep up, giving a "critical time" of only a couple of seconds, which may be more than enough for something like an email sending endpoint. Third-party libraries like [NServiceBus](https://docs.particular.net/nservicebus/operations/opentelemetry#meters-emitted-meters) emit this and other useful metrics via OpenTelemetry. > [!NOTE]-> The messages that are sent to a Service Bus topic are forwarded to subscriptions for that topic. So, the active message count on the topic itself is 0, as those messages have been successfully forwarded to the subscription. Get the message count at the subscription and verify that it's greater than 0. Even though you see messages at the subscription, they are actually stored in a storage owned by the topic. If you look at the subscriptions, then they would have non-zero message count (which add up to 323 MB of space for this entire entity). -+> The messages that are sent to a Service Bus topic are forwarded to subscriptions for that topic. So, the active message count on the topic itself is 0, as those messages have been successfully forwarded to the subscription. Get the message count at the subscription and verify that it's greater than 0. Even though you see messages at the subscription, they are actually stored in a storage owned by the topic. If you look at the subscriptions, then they would have non-zero message count, which contribute to the storage used by the topic. ## Using Azure portal Navigate to your namespace, and select the queue. You see message counters on the **Overview** page for the queue. |
| service-bus-messaging | Message Expiration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/message-expiration.md | Service Bus queues, topics, and subscriptions can be created as temporary entiti Automatic cleanup is useful in development and test scenarios in which entities are created dynamically and aren't cleaned up after use, due to some interruption of the test or debugging run. It's also useful when an application creates dynamic entities, such as a reply queue, for receiving responses back into a web server process, or into another relatively short-lived object where it's difficult to reliably clean up those entities when the object instance disappears. -The feature is enabled using the **auto delete on idle** property on the namespace. This property is set to the duration for which an entity must be idle (unused) before it's automatically deleted. The minimum value for this property is 5 minutes. +The feature is enabled using the **auto delete on idle** property on the entity. This property is set to the duration for which an entity must be idle (unused) before it's automatically deleted. The minimum value for this property is 5 minutes. > [!IMPORTANT] > Setting the Azure Resource Manager lock-level to [`CanNotDelete`](../azure-resource-manager/management/lock-resources.md), on the namespace or at a higher level doesn't prevent entities with `AutoDeleteOnIdle` from being deleted. If you don't want the entity to be deleted, set the `AutoDeleteOnIdle` property to `DataTime.MaxValue`. |
| service-bus-messaging | Topic Filters | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/topic-filters.md | Service Bus supports three types of filters: The following sections provide details about these filters. ### SQL filters-A **SqlFilter** holds a SQL-like conditional expression that will be evaluated in the broker against the arriving messages' user-defined properties and system properties. All system properties must be prefixed with `sys.` in the conditional expression. The [SQL-language subset for filter conditions](service-bus-messaging-sql-filter.md) tests for the existence of properties (`EXISTS`), null-values (`IS NULL`), logical `NOT`/`AND`/`OR`, relational operators, simple numeric arithmetic, and simple text pattern matching with `LIKE`. +A **SqlFilter** holds a SQL-like conditional expression that is evaluated in the broker against the arriving messages' user-defined properties and system properties. All system properties must be prefixed with `sys.` in the conditional expression. The [SQL-language subset for filter conditions](service-bus-messaging-sql-filter.md) tests for the existence of properties (`EXISTS`), null-values (`IS NULL`), logical `NOT`/`AND`/`OR`, relational operators, simple numeric arithmetic, and simple text pattern matching with `LIKE`. Here's a .NET example for defining a SQL filter: await adminClient.CreateRuleAsync(topicName, "ColorRed", new CreateRuleOptions } ``` +> [!IMPORTANT] +> When you update system properties through rule actions, note that it might change the expected behavior. Some properties are only evaluated when a message is received in a queue or a topic. Therefore, when you update these properties in a rule action and then deliver them in a subscription, they are ignored. Although, when auto-forwarding to another queue or topic, they are re-evaluated. +> +> - **ScheduledEnqueueTime**: When you set or update this property, it's ignored on the subscription. +> - **MessageID with deduplication**: No deduplication is performed in the subscription when the MessageID is updated and results in a duplicate. +> - **SessionID with partitioning**: In this scenario, the session ID is the partition key for partitioned entities and is used to decide the partition the message is sent to. Changing the sessionID in a rule action means that the partition key is changed after a message has landed in a partition. As a result, the consumer might not receive some of these messages in the session. Even if consumer receives the message, it appears as though they are coming from the wrong partition due to the changed partition key. + ## Usage patterns - **Broadcast** pattern |
| storage-mover | Job Definition Create | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage-mover/job-definition-create.md | When you migrate a share to Azure, you need to describe the source share, the Az Before you begin following the examples in this article, it's important that you have an understanding of the Azure Storage Mover resource hierarchy. Review the [Understanding the Storage Mover resource hierarchy](resource-hierarchy.md) article, to understand the necessity of the job definition prerequisites. -There are three prerequisites to the definition the migration of your source shares: +The following are the prerequisites to the definition the migration of your source shares: - **An existing storage mover resource.**<br/> If you haven't deployed a storage mover resource, follow the steps in the *[Create a storage mover resource](storage-mover-create.md)* article. These steps help you deploy a storage mover resource to the desired region within your Azure subscription. - **At least one existing Azure Storage Mover agent virtual machine (VM).**<br/> The steps in the [Azure Storage Mover agent VM deployment](agent-deploy.md) and [agent registration](agent-register.md) articles guide you through the deployment and registration process.-- **Finally, you need to create a job definition to define a migration.**<br/>+- **A job definition to define migration.**<br/> Job definitions are organized in a migration project. You need at least one migration project in your storage mover resource. If you haven't already done so, follow the deployment steps in the [manage projects](project-manage.md) article to create a migration project.+ - **Storage account access in case of firewall setting.**<br/> + If you have storage account firewall (security system) restrictions set, ensure that the traffic from agent VM is permitted to the storage account. +- **Accessible endpoints.**<br/> + The below endpoints must be accessible from the agent. ++|Source protocol |Target |Azure Endpoint |Description | +||-||-| +|SMB 2.x mount |Azure file share (SMB) |`< your-storage-account-name>.file.core.windows.net` |Azure Files endpoint. | +|SMB 2.x mount |Azure file share (SMB) |`<your-keyvault-name>.vault.azure.net` |Azure Key Vault endpoint. | +|NFS 3 & 4 mount |Azure blob storage container |`< your-storage-account-name>.blob.core.windows.net` |Azure Blob container endpoint. | + + ## Create and start a job definition |
| storage | Use Container Storage With Local Disk | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/container-storage/use-container-storage-with-local-disk.md | These three tiers offer a different range of IOPS. The following table contains | **Tier** | **Number of vCPUs** | **100 % Read IOPS** | **100 % Write IOPS** | | | | | |-| `Basic` | 12.5% of total VM cores | Up to 100,000 | Up to 90,000 | -| `Standard` (default)| 25% of total VM cores | Up to 200,000 | Up to 180,000 | -| `Premium` | 50% of total VM cores | Up to 400,000 | Up to 360,000 | +| `Basic` | 12.5% of total VM cores | Up to 120,000 | Up to 90,000 | +| `Standard` (default)| 25% of total VM cores | Up to 220,000 | Up to 180,000 | +| `Premium` | 50% of total VM cores | Up to 550,000 | Up to 360,000 | > [!NOTE] > RAM and hugepages consumption will stay consistent across all tiers: 1 GiB of RAM and 2 GiB of hugepages. |
| storage | Use Container Storage With Local Nvme Replication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/container-storage/use-container-storage-with-local-nvme-replication.md | kubectl delete sp -n acstor <storage-pool-name> Depending on your workloadΓÇÖs performance requirements, you can choose from three different performance tiers: **Basic**, **Standard**, and **Premium**. These tiers offer a different range of IOPS, and your selection will impact the number of vCPUs that Azure Container Storage components consume in the nodes where it's installed. Standard is the default configuration if you don't update the performance tier. -| **Tier** | **Number of vCPUs** | -||--| -| `Basic` | 12.5% of total VM cores | -| `Standard` (default) | 25% of total -| `Premium` | 50% of total VM cores | +**Single-zone replication** ++| **Tier** | **Number of vCPUs** | **100% Read IOPS** | **100% Write IOPS** | +||--|--|| +| `Basic` | 12.5% of total VM cores | Up to 120,000 | Up to 45,000 | +| `Standard` (default) | 25% of total VM cores | Up to 220,000 | Up to 90,000 | +| `Premium` | 50% of total VM cores | Up to 550,000 | Up to 180,000 | ++**Multi-zone replication** ++| **Tier** | **Number of vCPUs** | **100% Read IOPS** | **100% Write IOPS** | +||--|--|| +| `Basic` | 12.5% of total VM cores | Up to 120,000 | Up to 45,000 | +| `Standard` (default) | 25% of total VM cores | Up to 220,000 | Up to 90,000 | +| `Premium` | 50% of total VM cores | Up to 550,000 | Up to 180,000 | > [!NOTE] > RAM and hugepages consumption will stay consistent across all tiers: 1 GiB of RAM and 2 GiB of hugepages. |
| synapse-analytics | Synapse Workspace Synapse Rbac Roles | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/security/synapse-workspace-synapse-rbac-roles.md | The following table lists the built-in roles and the actions/permissions that ea |Role|Actions| |--|--|-|Synapse Administrator|workspaces/read</br>workspaces/roleAssignments/write, delete</br>workspaces/managedPrivateEndpoint/write, delete</br>workspaces/bigDataPools/useCompute/action</br>workspaces/bigDataPools/viewLogs/action</br>workspaces/integrationRuntimes/useCompute/action</br>workspaces/integrationRuntimes/viewLogs/action</br>workspaces/artifacts/read</br>workspaces/notebooks/write, delete</br>workspaces/sparkJobDefinitions/write, delete</br>workspaces/sqlScripts/write, delete</br>workspaces/kqlScripts/write, delete</br>workspaces/dataFlows/write, delete</br>workspaces/pipelines/write, delete</br>workspaces/triggers/write, delete</br>workspaces/datasets/write, delete</br>workspaces/libraries/write, delete</br>workspaces/linkedServices/write, delete</br>workspaces/credentials/write, delete</br>workspaces/notebooks/viewOutputs/action</br>workspaces/pipelines/viewOutputs/action</br>workspaces/linkedServices/useSecret/action</br>workspaces/credentials/useSecret/action</br>workspaces/linkConnections/read</br>workspaces/linkConnections/write</br>workspaces/linkConnections/delete</br>workspaces/linkConnections/useCompute/action| +|Synapse Administrator|workspaces/read</br>workspaces/roleAssignments/write</br>workspaces/roleAssignments/delete</br>workspaces/managedPrivateEndpoint/write</br>workspaces/managedPrivateEndpoint/delete</br>workspaces/bigDataPool/useCompute/action</br>workspaces/bigDataPool/viewLogs/action</br>workspaces/scopePool/useCompute/action</br>workspaces/scopePool/viewLogs/action</br>workspaces/integrationRuntime/useCompute/action</br>workspaces/integrationRuntime/viewLogs/action</br>workspaces/artifacts/read</br>workspaces/notebooks/write</br>workspaces/sparkJobDefinitions/write</br>workspaces/scopeJobDefinitions/write</br>workspaces/sqlScripts/write</br>workspaces/dataFlows/write</br>workspaces/dataMappers/write</br>workspaces/pipelines/write</br>workspaces/triggers/write</br>workspaces/datasets/write</br>workspaces/linkedServices/write</br>workspaces/credentials/write</br>workspaces/notebooks/delete</br>workspaces/sparkJobDefinitions/delete</br>workspaces/scopeJobDefinitions/delete</br>workspaces/sqlScripts/delete</br>workspaces/dataFlows/delete</br>workspaces/dataMappers/delete</br>workspaces/pipelines/delete</br>workspaces/triggers/delete</br>workspaces/datasets/delete</br>workspaces/linkedServices/delete</br>workspaces/credentials/delete</br>workspaces/cancelPipelineRun/action</br>workspaces/notebooksViewOutputs/action</br>workspaces/pipelinesViewOutputs/action</br>workspaces/linkedServicesUseSecret/action</br>workspaces/credentialsUseSecret/action</br>workspaces/libraries/delete</br>workspaces/libraries/write</br>workspaces/kQLScripts/write</br>workspaces/kQLScripts/delete</br>workspaces/sparkConfigurations/write</br>workspaces/sparkConfigurations/delete</br>workspaces/synapseLinkConnections/read</br>workspaces/synapseLinkConnections/write</br>workspaces/synapseLinkConnections/delete</br>workspaces/synapseLinkConnections/useCompute/action| |Synapse Apache Spark Administrator|workspaces/read</br>workspaces/bigDataPools/useCompute/action</br>workspaces/bigDataPools/viewLogs/action</br>workspaces/notebooks/viewOutputs/action</br>workspaces/artifacts/read</br>workspaces/notebooks/write, delete</br>workspaces/sparkJobDefinitions/write, delete</br>workspaces/libraries/write, delete</br>workspaces/linkedServices/write, delete</br>workspaces/credentials/write, delete| |Synapse SQL Administrator|workspaces/read</br>workspaces/artifacts/read</br>workspaces/sqlScripts/write, delete</br>workspaces/linkedServices/write, delete</br>workspaces/credentials/write, delete|-|Synapse Contributor|workspaces/read</br>workspaces/bigDataPools/useCompute/action</br>workspaces/bigDataPools/viewLogs/action</br>workspaces/integrationRuntimes/useCompute/action</br>workspaces/integrationRuntimes/viewLogs/action</br>workspaces/artifacts/read</br>workspaces/notebooks/write, delete</br>workspaces/sparkJobDefinitions/write, delete</br>workspaces/sqlScripts/write, delete</br>workspaces/kqlScripts/write, delete</br>workspaces/dataFlows/write, delete</br>workspaces/pipelines/write, delete</br>workspaces/triggers/write, delete</br>workspaces/datasets/write, delete</br>workspaces/libraries/write, delete</br>workspaces/linkedServices/write, delete</br>workspaces/credentials/write, delete</br>workspaces/notebooks/viewOutputs/action</br>workspaces/pipelines/viewOutputs/action</br>workspaces/linkConnections/read</br>workspaces/linkConnections/write</br>workspaces/linkConnections/delete</br>workspaces/linkConnections/useCompute/action| -|Synapse Artifact Publisher|workspaces/read</br>workspaces/artifacts/read</br>workspaces/notebooks/write, delete</br>workspaces/sparkJobDefinitions/write, delete</br>workspaces/sqlScripts/write, delete</br>workspaces/kqlScripts/write, delete</br>workspaces/dataFlows/write, delete</br>workspaces/pipelines/write, delete</br>workspaces/triggers/write, delete</br>workspaces/datasets/write, delete</br>workspaces/libraries/write, delete</br>workspaces/linkedServices/write, delete</br>workspaces/credentials/write, delete</br>workspaces/notebooks/viewOutputs/action</br>workspaces/pipelines/viewOutputs/action| +|Synapse Contributor|workspaces/read</br>workspaces/bigDataPool/useCompute/action</br>workspaces/bigDataPool/viewLogs/action</br>workspaces/scopePool/useCompute/action</br>workspaces/scopePool/viewLogs/action</br>workspaces/integrationRuntime/useCompute/action</br>workspaces/integrationRuntime/viewLogs/action</br>workspaces/artifacts/read</br>workspaces/notebooks/write</br>workspaces/sparkJobDefinitions/write</br>workspaces/sqlScripts/write</br>workspaces/dataFlows/write</br>workspaces/dataMappers/write</br>workspaces/pipelines/write</br>workspaces/triggers/write</br>workspaces/datasets/write</br>workspaces/linkedServices/write</br>workspaces/credentials/write</br>workspaces/notebooks/delete</br>workspaces/sparkJobDefinitions/delete</br>workspaces/sqlScripts/delete</br>workspaces/dataFlows/delete</br>workspaces/dataMappers/delete</br>workspaces/pipelines/delete</br>workspaces/triggers/delete</br>workspaces/datasets/delete</br>workspaces/linkedServices/delete</br>workspaces/credentials/delete</br>workspaces/cancelPipelineRun/action</br>workspaces/notebooksViewOutputs/action</br>workspaces/pipelinesViewOutputs/action</br>workspaces/libraries/delete</br>workspaces/libraries/write</br>workspaces/kQLScripts/write</br>workspaces/kQLScripts/delete</br>workspaces/sparkConfigurations/write</br>workspaces/sparkConfigurations/delete</br>workspaces/synapseLinkConnections/read</br>workspaces/synapseLinkConnections/write</br>workspaces/synapseLinkConnections/delete</br>workspaces/synapseLinkConnections/useComputeAction| +|Synapse Artifact Publisher|workspaces/read</br>workspaces/artifacts/read</br>workspaces/notebooks/write</br>workspaces/sparkJobDefinitions/write</br>workspaces/scopeJobDefinitions/write</br>workspaces/sqlScripts/write</br>workspaces/dataFlows/write</br>workspaces/dataMappers/write</br>workspaces/pipelines/write</br>workspaces/triggers/write</br>workspaces/datasets/write</br>workspaces/linkedServices/write</br>workspaces/credentials/write</br>workspaces/notebooks/delete</br>workspaces/sparkJobDefinitions/delete</br>workspaces/scopeJobDefinitions/delete</br>workspaces/sqlScripts/delete</br>workspaces/dataFlows/delete</br>workspaces/dataMappers/delete</br>workspaces/pipelines/delete</br>workspaces/triggers/delete</br>workspaces/datasets/delete</br>workspaces/linkedServices/delete</br>workspaces/credentials/delete</br>workspaces/notebooksViewOutputs/action</br>workspaces/pipelinesViewOutputs/action</br>workspaces/libraries/delete</br>workspaces/libraries/write</br>workspaces/kQLScripts/write</br>workspaces/kQLScripts/delete</br>workspaces/sparkConfigurations/write</br>workspaces/sparkConfigurationsDeleteAction| |Synapse Artifact User|workspaces/read</br>workspaces/artifacts/read</br>workspaces/notebooks/viewOutputs/action</br>workspaces/pipelines/viewOutputs/action| |Synapse Compute Operator |workspaces/read</br>workspaces/bigDataPools/useCompute/action</br>workspaces/bigDataPools/viewLogs/action</br>workspaces/integrationRuntimes/useCompute/action</br>workspaces/integrationRuntimes/viewLogs/action</br>workspaces/linkConnections/read</br>workspaces/linkConnections/useCompute/action| |Synapse Monitoring Operator |workspaces/read</br>workspaces/artifacts/read</br>workspaces/notebooks/viewOutputs/action</br>workspaces/pipelines/viewOutputs/action</br>workspaces/integrationRuntimes/viewLogs/action</br>workspaces/bigDataPools/viewLogs/action| |
| synapse-analytics | Performance Tuning Ordered Cci | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/performance-tuning-ordered-cci.md | -# Performance tuning with ordered clustered columnstore index +# Performance tuning with ordered clustered columnstore index in Azure Synapse Analytics -**Applies to:** Azure Synapse Analytics dedicated SQL pools, SQL Server 2022 (16.x) and later +**Applies to:** Azure Synapse Analytics dedicated SQL pools When users query a columnstore table in dedicated SQL pool, the optimizer checks the minimum and maximum values stored in each segment. Segments that are outside the bounds of the query predicate aren't read from disk to memory. A query can finish faster if the number of segments to read and their total size are small. +> [!NOTE] +> This article applies to Azure Synapse Analytics dedicated SQL pools. For information on ordered columnstore indexes in SQL Server and other SQL platforms, see [Performance tuning with ordered clustered columnstore indexes](/sql/relational-databases/indexes/columnstore-indexes-overview#ordered-columnstore-indexes). + ## Ordered vs. non-ordered clustered columnstore index By default, for each table created without an index option, an internal component (index builder) creates a non-ordered clustered columnstore index (CCI) on it. Data in each column is compressed into a separate CCI rowgroup segment. There's metadata on each segment's value range, so segments that are outside the bounds of the query predicate aren't read from disk during query execution. CCI offers the highest level of data compression and reduces the size of segments to read so queries can run faster. However, because the index builder doesn't sort data before compressing them into segments, segments with overlapping value ranges could occur, causing queries to read more segments from disk and take longer to finish. |
| trusted-signing | How To Renew Identity Validation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/trusted-signing/how-to-renew-identity-validation.md | Title: Renew Trusted Signing Identity Validation -description: How-to rerenew a Trusted Signing Identity Validation. + Title: Renew and delete Trusted Signing Identity Validation +description: How-to renew and delete a Trusted Signing Identity Validation. -# Renew Trusted Signing Identity Validation +# Renew or delete Trusted Signing Identity Validations +You can renew or delete your Trusted Signing Identity Validations with the right role. +## Renew Identity Validation You can check the expiration date of your Identity Validation on the Identity Validation page. You can renew your Trusted Signing Identity Validation **60 days** before the expiration. A notification is to the primary and secondary email addresses with the reminder to renew your Identity Validation. **Identity Validation can only be completed in the Azure portal ΓÇô it can not be completed with Azure CLI.** You can check the expiration date of your Identity Validation on the Identity Va - Navigate back to the trusted signing account overview page or from Objects, select **Certificate Profile**. - On the **Certificate Profiles**, delete the existing cert profile associated to the Identity Validation expiring soon: - Create new cert profile with the same name.- - Select the Identity Validation from the pull-down. Once the certificate profile is created successfully, signing resumes requiring no configuration changes on your end. + - Select the Identity Validation from the pull-down. Once the certificate profile is created successfully, signing resumes requiring no configuration changes on your end. + +## Delete Identity Validation ++You can delete an Identity Validation that is not in "In Progress" state from the Identity Validation page. ++>[!Note] +>Deleting an Identity Validation before stops the renewal of linked certificate profiles across all the accounts within a subscription where Identtiy Validation was done. This impacts signing. +>Deleted identity validation requests cannot be recovered. ++1. Navigate to your Trusted Signing account in the [Azure portal](https://portal.azure.com/). +2. Confirm you have the **Trusted Signing Identity Verifier role**. + - To learn more about Role Based Access management (RBAC) access management, see [Assigning roles in Trusted Signing](tutorial-assign-roles.md). +3. From either the Trusted Signing account overview page or from Objects, select **Identity Validation**. +4. Select the Identity Validation request that needs to be deleted. Select **Delete** on the top. +++5. A blade opens on the right hand side and lists the number of associated accounts and shows the certificate profiles linked to this Identity Validation. + - Ensure you have read permissions at the subscription level or on all trusted signing accounts to verify the usage of the current identity validation request across all certificate profiles. + + :::image type="content" source="media/trusted-signing-delete-identity-validation-linked-profiles.png" alt-text="Screenshot of trusted signing delete identity-validation showing linked-profiles.png." lightbox="media/trusted-signing-delete-identity-validation-linked-profiles.png"::: ++6. Select **Delete**, if you wish to continue with the deletion of the certificate profile. A deleted Identity Validation request cannot be recovered. + |
| trusted-signing | Quickstart | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/trusted-signing/quickstart.md | Title: "Quickstart: Set up Trusted Signing" description: This quickstart helps you get started with using Trusted Signing to sign your files.-+ You can complete your own identity validation by filling in the request form wit > [!NOTE] > You can't create an identity validation request if you aren't assigned the appropriate role. If the **New identity** button on the menu bar appears dimmed in the Azure portal, ensure that you are assigned the Trusted Signing Identity Verifier roler to proceed with identity validation. -To create an identity validation request: ++To create an identity validation request for an Organization: 1. In the Azure portal, go to your new Trusted Signing account. 2. Confirm that you're assigned the Trusted Signing Identity Verifier role. - To learn how to manage access by using role-based access control (RBAC), see [Tutorial: Assign roles in Trusted Signing](tutorial-assign-roles.md). + To learn how to manage, access by using role-based access control (RBAC), see [Tutorial: Assign roles in Trusted Signing](tutorial-assign-roles.md). 3. On the Trusted Signing account **Overview** pane or on the resource menu under **Objects**, select **Identity validations**. 4. Select **New identity**, and then select either **Public** or **Private**. To create an identity validation request: | Fields | Details | | :- | :- |- | **Organization Name** | For public identity validation, provide the legal business entity to which the certificate will be issued. For private identity validation, the value defaults to your Microsoft Entra tenant name. | + | **Organization Name** | For public identity validation, provide the legal business entity to which the certificate is issued. For private identity validation, the value defaults to your Microsoft Entra tenant name. | | **(Private Identity Type only) Organizational Unit** | Enter the relevant information. | | **Website url** | Enter the website that belongs to the legal business entity. | | **Primary Email** | Enter the email address associated with the legal business entity undergoing validation. Part of the Identity Validation process, a verification link is sent to this email address and the link expires in seven days. Ensure that the email address can receive emails(with links) from external email addresses. |- | **Secondary Email** | This email address must be different from the primary email address. For organizations, the domain must match the email address that's provided in the primary email address. Ensure that the email address can receive emails from external email addresses that have links.| + | **Secondary Email** | This email address must be different from the primary email address. For organizations, the domain must match the email address that is provided in the primary email address. Ensure that the email address can receive emails from external email addresses that have links.| | **Business Identifier** | Enter a business identifier for the legal business entity. | | **Seller ID** | Applies only to Microsoft Store customers. Find your Seller ID in the Partner Center portal. | | **Street, City, Country, State, Postal code** | Enter the business address of the legal business entity. | To create an identity validation request: | Requirements | Details | | :- | :- | | Onboarding | Trusted Signing at this time can onboard only legal business entities that have verifiable tax history of three or more years. For a quicker onboarding process, ensure that public records for the legal business entity that you're validated are up to date. |-| Accuracy | Ensure that you provide the correct information for public identity validation. If you need to make any changes after it is created, you must complete a new identity validation request. This change affects the associated certificates that are being used for signing. | +| Accuracy | Ensure that you provide the correct information for public identity validation. If you need to make any changes after it's created, you must complete a new identity validation request. This change affects the associated certificates that are being used for signing. | | Failed email verification | If email verification fails, you must initiate a new identity validation request. | | Identity validation status | You're notified through email when there's an update to the identity validation status. You can also check the status in the Azure portal at any time. | | Processing time | Processing your identity validation request takes from 1 to 7 business days (possibly longer if we need to request more documentation from you). |-| More documentation | If we need more documentation to process the identity validation request, you're notified through email. You can upload the documents in the Azure portal. The documentation request email contains information about file size requirements. Ensure that any documents you provide are the most current. <br>- All documents submitted must be issued within the previous 12 months or where the expiration date is a future date that is at least two months away. <br> - If it is not possible to provide additional documentation, please update your account information to match any legal documents already provided or your official Company registration details. <br> - When providing official business document, such as business registration form, business charter, or articles of incorporation that list the company name and address as it is provided at the time of Identity Validation request creation. <br> - Ensure the domain registration or domain invoice from registration or renewal that lists the entity/contact name and domain as it is state on the request.| +| More documentation | If we need more documentation to process the identity validation request, you're notified through email. You can upload the documents in the Azure portal. The documentation request email contains information about file size requirements. Ensure that any documents you provide are the most current. <br>- All documents submitted must be issued within the previous 12 months or where the expiration date is a future date that is at least two months away. <br> - If it isn't possible to provide additional documentation, update your account information to match any legal documents already provided or your official Company registration details. <br> - When providing official business document, such as business registration form, business charter, or articles of incorporation that list the company name and address as it is provided at the time of Identity Validation request creation. <br> - Ensure the domain registration or domain invoice from registration or renewal that lists the entity/contact name and domain as it is state on the request.| |
| update-manager | Manage Hot Patching Arc Machines | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/update-manager/manage-hot-patching-arc-machines.md | Title: Hotpatching (preview) on Azure Arc-enabled machines description: This article details how to manage hotpatching (preview) on Azure Arc-enabled machines. Previously updated : 10/30/2024 Last updated : 11/01/2024 After you enroll to hotpatch (preview) license, your machine automatically recei #### [At scale](#tab/manage-scale) -To enable or disable hotpaching at scale, follow these steps: +To enable or disable hotpatching at scale, follow these steps: 1. Sign in to the [Azure portal](https://portal.azure.com) and go to **Azure Update Manager**. 1. Under **Resources**, select **Machines** and in the **Azure Update Manager | Machines** page, under **Settings**, select **Update settings**. |
| virtual-desktop | Configure Rdp Shortpath | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/configure-rdp-shortpath.md | Last updated 10/03/2024 # Configure RDP Shortpath for Azure Virtual Desktop > [!IMPORTANT]-> RDP Shortpath for public networks via TURN for Azure Virtual Desktop is only available in the Azure public cloud. +> RDP Shortpath for public networks via TURN for Azure Virtual Desktop is available in the Azure public cloud and Azure Government cloud. Users can connect to a remote session from Azure Virtual Desktop using the Remote Desktop Protocol (RDP) with a UDP or TCP-based transport. RDP Shortpath establishes a UDP-based transport between a local device Windows App or the Remote Desktop app on supported platforms and session host. |
| virtual-desktop | Rdp Shortpath | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/rdp-shortpath.md | RDP Shortpath can be used in two ways: The transport used for RDP Shortpath is based on the [Universal Rate Control Protocol (URCP)](https://www.microsoft.com/research/publication/urcp-universal-rate-control-protocol-for-real-time-communication-applications/). URCP enhances UDP with active monitoring of the network conditions and provides fair and full link utilization. URCP operates at low delay and loss levels as needed. > [!IMPORTANT]-> RDP Shortpath for public networks with TURN is only available in the Azure public cloud. +> RDP Shortpath for public networks via TURN for Azure Virtual Desktop is available in the Azure public cloud and Azure Government cloud. ## Key benefits |
| virtual-desktop | Troubleshoot Rdp Shortpath | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/troubleshoot-rdp-shortpath.md | -> [!IMPORTANT] -> Using RDP Shortpath for public networks with TURN for Azure Virtual Desktop is currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. - If you're having issues when using RDP Shortpath for public networks, use the information in this article to help troubleshoot. ## Verifying STUN/TURN server connectivity and NAT type You have access to TURN servers and your NAT type appears to be 'cone shaped'. Shortpath for public networks is very likely to work on this host. ``` -> [!IMPORTANT] -> During the preview, TURN is only available for connections to session hosts in a validation host pool. To configure your host pool as a validation environment, see [Define your host pool as a validation environment](create-validation-host-pool.md#define-your-host-pool-as-a-validation-host-pool). - ## Error information logged in Log Analytics Here are some error titles you may see logged in Log Analytics and what they mean. |
| virtual-wan | How To Network Virtual Appliance Inbound | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/how-to-network-virtual-appliance-inbound.md | The list below corresponds to the diagram above and describes the packet flow fo 1. The server responds and sends the reply packets to the NVA Firewall instance over the Firewall private IP. 1. The NAT translation is reversed and the response is sent out the untrusted interface. Azure then directly sends the packet back to the user. -## Known Limitations and Considerations +## Known Issues, Limitations and Considerations +The following section describes known issues, limitations and considerations associatd with the Internet Inbound feature. ++### Known Issues ++The following table describes known issues related to the internet inbound/DNAT feature. ++|Issue | Description| Mitigation| +|--|--|--| +| DNAT traffic is not forwarded to the NVA after associating an additional IP address.| After associating additional IP address(es) to an NVA that already has active inbound security rules, DNAT traffic is not forwarded properly to the NVA due to a code defect. | Use partner orchestration/management software to modify (create or delete existing) configured inbound-security rules to restore connectivity. | +|Inbound security rule configuration scalability| Inbound security rule configuration may fail when a large number (approximately 100) rules are configured.| No mitigation, reach out to Azure Support for fix timelines.| ### Limitations * Destination NAT is supported only for the following NVAs: **checkpoint**, **fortinet-sdwan-and-ngfw** and **fortinet-ngfw**. The list below corresponds to the diagram above and describes the packet flow fo * Timeout for idle flows is automatically set to 4 minutes. * You can assign individual IP address resources generated from an IP address prefix to the NVA as internet inbound IPs. Assign each IP address from the prefix individually. ++++ ## Managing DNAT/Internet Inbound configurations The following section describes how to manage NVA configurations related to internet inbound and DNAT. |
| virtual-wan | How To Routing Policies | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/how-to-routing-policies.md | Consider the following configuration where Hub 1 (Normal) and Hub 2 (Secured) ar ## <a name="knownlimitations"></a> Known Limitations -* Routing Intent is currently available in Azure public. Microsoft Azure operated by 21Vianet and Azure Government are currently in roadmap. +* The following table describes the avaiablility of routing intent in different Azure environments. + * Routing intent is not available in Mirosoft Azure operated by 21 Vianet. + * Palo Alto Cloud NGFW is only available in Azure Public. Reach out to Palo Alto Networks regarding avaialbility of Cloud NGFW in Azure Government and Microsoft Azure operated by Viacom. + * Network Virtual Appliances are not available in all Azure Government regions. Contact your NVA partner regarding availability in Azure Government. ++| Cloud Environment| Azure Firewall| Network Virtual Appliance| SaaS solutions| +|--|--|--| --| +| Azure Public | Yes | Yes | Yes| +|Azure Government|Yes| Limited | No| +|Microsoft Azure operated by 21 Vianet|No|No|No| + * Routing Intent simplifies routing by managing route table associations and propagations for all connections (Virtual Network, Site-to-site VPN, Point-to-site VPN, and ExpressRoute). Virtual WANs with custom route tables and customized policies therefore can't be used with the Routing Intent constructs. * Encrypted ExpressRoute (Site-to-site VPN tunnels running over ExpressRoute circuits) is supported in hubs where routing intent is configured if Azure Firewall is configured to allow traffic between VPN tunnel endpoints (Site-to-site VPN Gateway private IP and on-premises VPN device private IP). For more information on the required configurations, see [Encrypted ExpressRoute with routing intent](#encryptedER). * The following connectivity use cases are **not** supported with Routing Intent: |
| virtual-wan | Monitor Virtual Wan Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/monitor-virtual-wan-reference.md | This table contains more information about some of the metrics in the preceding |:-|:| | **Routing Infrastructure Units** | The virtual hub's routing infrastructure units (RIU). The virtual hub's RIU determines how much bandwidth the virtual hub router can process for flows traversing the virtual hub router. The hub's RIU also determines how many VMs in spoke VNets the virtual hub router can support. For more information on routing infrastructure units, see [Virtual Hub Capacity](hub-settings.md#capacity). | **Spoke VM Utilization** | The approximate number of deployed spoke VMs as a percentage of the total number of spoke VMs that the hub's routing infrastructure units can support. For example, if the hub's RIU is set to 2, which supports 2,000 spoke VMs, and 1,000 VMs are deployed across spoke virtual networks, this metric's value is approximately 50%. |+| **Count Of Routes Advertised To Peer** | The Virtual WAN hub router exchanges routes with all active instances of ExpressRoute gateways, VPN gateways and NVAs deployed in the Virtual WAN hub or in a connected Virtual Network spoke. When the Virtual WAN hub router learns a prefix with the same AS-PATH length from multiple peers, the router internally selects a peer to prefer for that specific route and re-advertises that route to all **other** peers (including the other gateway or NVA instance). This internal route selection process occurs for every route processed and the selected instance can change due to various factors such as network changes or maintenance events. As a result the number of routes advertised to an individual peer may fluctuate. When this metric is viewed with the maximum aggregation, Azure Monitor displays the data associated with a **single** BGP session between the Virtual WAN hub router and gateway or NVA. To effectively monitor changes or potential issues in your network, apply a split in Azure Monitor on the Count of Routes Advertised to Peer metric on a per peer IP address and ensure that the total number of routes advertised to your ExpressRoute, VPN or NVA is stable or in-line with any network changes. The total count of routes advertised must be calculated manually as the Azure Monitor **sum** aggregation type sums up data-points over the aggregation window, which does not accurately reflect routes advertised count. | + ### <a name="s2s-metrics"></a>Supported metrics for microsoft.network/vpngateways |
| virtual-wan | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/whats-new.md | The following features are currently in gated public preview. After working with | 7| BGP between the Virtual WAN hub router and NVAs deployed in the Virtual WAN hub does not come up if the ASN used for BGP peering is updated post-deployment.|Virtual Hub router expects NVA in the hub to use the ASN that was configured on the router when the NVA was first deployed. Updating the ASN associated with the NVA on the NVA resource does not properly register the new ASN with the Virtual Hub router so the router rejects BGP sessions from the NVA if the NVA OS is configured to use the new ASN. | |Delete and recreate the NVA in the Virtual WAN hub with the correct ASN.| |8| Advertising default route (0.0.0.0/0) from on-premises (VPN, ExpressRoute, BGP endpoint) or statically configured on a Virtual Network connection is not supported for forced tunneling use cases.| The 0.0.0.0/0 route advertised from on-premises (or statically configured on a Virtual Network connection) is not applied to the Azure Firewall or other security solutions deployed in the Virtual WAN hub. Packets inspected by the security solution in the hub are routed directly to the internet, bypassing the route learnt from on-premises||Publish the default route from on-premises only in non-secure hub scenarios.| |9| Routing intent update operations fail in deployments where private routing policy next hop resource is an NVA or SaaS solution.| In deployments where private routing policy is configured with next hop NVA or SaaS solutions alongside additional private prefixes, modifying routing intent fails. Examples of operations that fail are adding or removing internet or private routing policies. This known issue doesn't impact deployments with no additional private prefixes configured. | |Remove any additional private prefixes, update routing intent and then re-configure additional private prefixes.|+|10| DNAT traffic is not forwarded to the NVA after associating an additional IP address.|After associating additional IP address(es) to an NVA that already has active inbound security rules, DNAT traffic is not forwarded properly to the NVA due to a code defect. | November 2024 | Use partner orchestration/management software to modify (create or delete existing) configured inbound-security rules to restore connectivity.| +|11| Inbound security rule configuration scalability | Inbound security rule configuration may fail when a large number (approximately 100) rules are configured. | November 2024 | None, reach out Azure Support for more information.| + ## Next steps |
| vpn-gateway | About Active Active Gateways | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/vpn-gateway/about-active-active-gateways.md | description: Learn about active-active VPN gateways, including configuration and Previously updated : 08/08/2024 Last updated : 11/01/2024 Azure VPN gateways can be configured as active-standby or active-active. This ar ## Why create an active-active gateway? -VPN gateways consist of two instances in an active-standby configuration unless you specify active-active mode. In active-standby mode, during any planned maintenance or unplanned disruption affecting the active instance, the following behavior occurs: +VPN gateways consist of two instances in an active-standby configuration unless you specify active-active mode. ++### Active-standby mode behavior ++In active-standby mode, during any planned maintenance or unplanned disruption affecting the active instance, the following behavior occurs: * **S2S and VNet-to-VNet**: The standby instance takes over automatically (failover), and resumes the site-to-site (S2S) VPN or VNet-to-VNet connections. This switch over causes a brief interruption. For planned maintenance, connectivity is restored quickly. For unplanned issues, the connection recovery is longer. * **P2S**: For point-to-site (P2S) VPN client connections to the gateway, P2S connections are disconnected. Users need to reconnect from the client machines. To avoid interruptions, create your gateway in **active-active** mode, or switch an active-standby gateway to active-active. -### Active-active design +### Active-active mode design In an active-active configuration for a S2S connection, both instances of the gateway VMs establish S2S VPN tunnels to your on-premises VPN device, as shown the following diagram: When a planned maintenance or unplanned event happens to one gateway instance, t > [!NOTE] > [!INCLUDE [establish two tunnels](../../includes/vpn-gateway-active-active-tunnel.md)] -### Dual-redundancy active-active design +### Dual-redundancy active-active mode design The most reliable design option is to combine the active-active gateways on both your network and Azure, as shown in the following diagram. All gateways and tunnels are active from the Azure side, so the traffic is sprea This topology requires two local network gateways and two connections to support the pair of on-premises VPN devices. For more information, see [About highly available connectivity](vpn-gateway-highlyavailable.md). -## Configure an active-active gateway +## Configure an active-active mode gateway You can configure an active-active gateway using the [Azure portal](tutorial-create-gateway-portal.md), PowerShell, or CLI. You can also change an active-standby gateway to active-active mode. For steps, see [Change a gateway to active-active](gateway-change-active-active.md). An active-active gateway has slightly different configuration requirements than * Two public IP addresses are required. Both must be **Standard SKU** public IP addresses that are assigned as **Static**. * An active-active gateway configuration costs the same as an active-standby configuration. However, active-active configurations require two public IP addresses instead of one. See [IP Address pricing](https://azure.microsoft.com/pricing/details/ip-addresses/). -## Reset an active-active gateway +## Reset an active-active mode gateway If you need to reset an active-active gateway, you can reset both instances using the portal. You can also use PowerShell or CLI to reset each gateway instance separately using instance VIPs. See [Reset a connection or a gateway](reset-gateway.md#ps). |
| web-application-firewall | Waf Front Door Custom Rules Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/web-application-firewall/afds/waf-front-door-custom-rules-powershell.md | $myWAFPolicy=New-AzFrontDoorWafPolicy -Name $policyName -ResourceGroupName $reso Link the security policy object to an existing Azure Front Door front-end host and update Azure Front Door properties. First, retrieve the Azure Front Door object by using [Get-AzFrontDoor](/powershell/module/Az.FrontDoor/Get-AzFrontDoor). Next, set the front-end `WebApplicationFirewallPolicyLink` property to the `resourceId` of the `$myWAFPolicy$` created in the previous step by using [Set-AzFrontDoor](/powershell/module/Az.FrontDoor/Set-AzFrontDoor). +> [!NOTE] +> For Azure Front Door Standard and Premium, you should use [Get-AzFrontDoorCdnProfile](/powershell/module/az.cdn/Get-AzFrontDoorCdnProfile). + The following example uses the resource group name `myResourceGroupFD1` with the assumption that you've created the Azure Front Door profile by using instructions provided in [Quickstart: Create an Azure Front Door](../../frontdoor/quickstart-create-front-door.md). Also, in the following example, replace `$frontDoorName` with the name of your Azure Front Door profile. ```powershell-interactive |