{"id":3367,"date":"2024-09-19T19:31:53","date_gmt":"2024-09-19T18:31:53","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=3367"},"modified":"2024-09-19T20:37:38","modified_gmt":"2024-09-19T19:37:38","slug":"windows-service-monitoring-at-scale-using-cloud-native-azure-components","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=3367","title":{"rendered":"Windows Service Monitoring at Scale using Cloud Native Azure Components"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Recently, I was challenged to build a <strong>scalable, cloud native solution<\/strong> that should be used for monitoring of <strong>critical Windows Services<\/strong> on <strong>both Azure Native and Azure Arc servers<\/strong>. Solution should scale to +1000 servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Requirements included the concept of <strong>server maintenance mode<\/strong> (true\/false); <strong>send mail &amp; SMS notification when stopped &amp; running<\/strong>; <strong>run every 5 min<\/strong>; <strong>easy to manage using tags<\/strong> and <strong>integrate with Azure Update Manager maintenance config for Patching (pre\/post)<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This blog shows how I built it using <strong>Azure Tags<\/strong>, <strong>Kusto Query<\/strong> against <strong>Azure Resource Graph<\/strong> and <strong>Azure LogAnalytics Change Tracking data<\/strong>; collected with <strong>Azure Monitor Agent<\/strong> using <strong>Azure Data Collection Rule<\/strong> and everything wrapped into an <strong>Azure Logic App<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Content<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"#stopped\">Output: Service is stopped<\/a><\/li>\n\n\n\n<li><a href=\"#started\">Output: Service is running<\/a><\/li>\n\n\n\n<li><a href=\"#overviewlogicapp\" data-type=\"internal\" data-id=\"#overviewlogicapp\">Overview: Azure Logic Apps Engine<\/a><\/li>\n\n\n\n<li><a href=\"#tags\" data-type=\"internal\" data-id=\"#tags\">Tags used on Azure Native &amp; Azure Arc Servers<\/a><\/li>\n\n\n\n<li><a href=\"#logicapp\" data-type=\"internal\" data-id=\"#logicapp\">Azure Logic App configuration<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"#step1\" data-type=\"internal\" data-id=\"#step1\">Step 1 &#8211; Recurrence<\/a><\/li>\n\n\n\n<li><a href=\"#step2\" data-type=\"internal\" data-id=\"#step2\">Step 2 &#8211; Query stopped\/started (list output format)<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"#step2stoppedquery\" data-type=\"internal\" data-id=\"#step2stoppedquery\">Query &#8211; Detect Windows Service Stopped<\/a><\/li>\n\n\n\n<li><a href=\"#step2runningquery\" data-type=\"internal\" data-id=\"#step2runningquery\">Query &#8211; Detect Windows Service Running<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"#Step3\" data-type=\"internal\" data-id=\"#Step3\">Step 3 &#8211; Condition (output) from step 2<\/a><\/li>\n\n\n\n<li><a href=\"#step4\" data-type=\"internal\" data-id=\"#step4\">Step 4 &#8211; Query stopped\/started (HTML output format)<\/a><\/li>\n\n\n\n<li><a href=\"#step5\" data-type=\"internal\" data-id=\"#step5\">Step 5 &#8211; Send mail<\/a><\/li>\n\n\n\n<li><a href=\"#final\" data-type=\"internal\" data-id=\"#final\">Final layout<\/a><\/li>\n\n\n\n<li><a href=\"#LogicAppCodeView\" data-type=\"internal\" data-id=\"#LogicAppCodeView\">Azure Logic Apps (Code view)<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"#dcr\" data-type=\"internal\" data-id=\"#dcr\">Azure Data Collection Rules for Change Tracking Collection<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"#dcrtemplate\" data-type=\"internal\" data-id=\"#dcrtemplate\">Azure Data Collection Rules Template (JSON)<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"#la\" data-type=\"internal\" data-id=\"#la\">Azure LogAnalytics Workspace for Change Tracking<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"stopped\">Output: Service is stopped<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"82\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-43-1024x82.png\" alt=\"\" class=\"wp-image-3390\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-43-1024x82.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-43-300x24.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-43-768x61.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-43-1536x123.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-43.png 1705w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"203\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-50-1024x203.png\" alt=\"\" class=\"wp-image-3397\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-50-1024x203.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-50-300x59.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-50-768x152.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-50.png 1046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"487\" height=\"115\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-48.png\" alt=\"\" class=\"wp-image-3395\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-48.png 487w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-48-300x71.png 300w\" sizes=\"auto, (max-width: 487px) 100vw, 487px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"644\" height=\"124\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-49.png\" alt=\"\" class=\"wp-image-3396\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-49.png 644w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-49-300x58.png 300w\" sizes=\"auto, (max-width: 644px) 100vw, 644px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"running\">Output: Service is running<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"948\" height=\"137\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-47.png\" alt=\"\" class=\"wp-image-3394\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-47.png 948w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-47-300x43.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-47-768x111.png 768w\" sizes=\"auto, (max-width: 948px) 100vw, 948px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"59\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-44-1024x59.png\" alt=\"\" class=\"wp-image-3391\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-44-1024x59.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-44-300x17.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-44-768x44.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-44.png 1485w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"overviewlogicapp\">Overview: Azure Logic Apps Engine<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"865\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-27-1024x865.png\" alt=\"\" class=\"wp-image-3371\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-27-1024x865.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-27-300x254.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-27-768x649.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-27.png 1381w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"tags\">Tags used on Azure Native &amp; Azure Arc Servers<\/h2>\n\n\n\n<figure class=\"wp-block-table has-small-font-size\"><table class=\"has-fixed-layout\"><tbody><tr><td>TagName<\/td><td>TagValues<\/td><td>Purpose<\/td><\/tr><tr><td>MonitorMaintenanceModeActive<\/td><td>FALSE<br>TRUE<\/td><td>If a server should be put into maintenance mode, you can set the value to TRUE. Then no alerts will arrive until status is changed back t FALSE again.<br><br>You can also control this tag-value using azure Update Manager pre\/post-events<\/td><\/tr><tr><td>MonitorWindowsServices<\/td><td>Windows Service name, separated by , (comma)<br><br>sample<br>IISADMIN,Dfs,DFSR,DNS,ADSync,AADConnectProvisioningAgent<\/td><td>Lists the services that should be monitored<\/td><\/tr><tr><td>MonitorContactMail<\/td><td>Mail address like<br>mok@mortenknudsen.net<\/td><td>Value of it alerts group that should receive notifications<\/td><\/tr><tr><td>MonitorContactSMS<\/td><td>Mobile number like<br>+45 12345678<\/td><td>Mobile number of recipient<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"623\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-26-1024x623.png\" alt=\"\" class=\"wp-image-3370\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-26-1024x623.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-26-300x183.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-26-768x467.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-26.png 1395w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"431\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-29-1024x431.png\" alt=\"\" class=\"wp-image-3374\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-29-1024x431.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-29-300x126.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-29-768x323.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-29-1536x646.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-29.png 1810w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"logicapp\">Azure Logic App configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Logic app is defined by the following phases: <\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Step #<\/td><td>Step<\/td><td>Action<\/td><\/tr><tr><td>1<\/td><td>Recurrence<\/td><td>Runs every 5 min<\/td><\/tr><tr><td>2<\/td><td>Query stopped\/started (list output format)<\/td><td>Checks if any service in scope has stopped (or started) during last 5 min.<\/td><\/tr><tr><td>3<\/td><td>Condition (output) from step 2<\/td><td>If output, then it continues to step 4<\/td><\/tr><tr><td>4<\/td><td>Query stopped\/started (HTML output format)<\/td><td>Checks if any service in scope has stopped (or started) during last 5 min.<br><br>It is 100% the same output as step 2, but it builds an HTML output with tables<\/td><\/tr><tr><td>5<\/td><td>Send mail<\/td><td>Here mail it sent to the variable ContactMail<\/td><\/tr><tr><td>6<\/td><td>Send SMS (optional)<\/td><td>Here mail it sent to the variable ContactSMS<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step1\">Step 1 &#8211; Recurrence<\/h4>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"623\" height=\"539\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-41.png\" alt=\"\" class=\"wp-image-3387\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-41.png 623w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-41-300x260.png 300w\" sizes=\"auto, (max-width: 623px) 100vw, 623px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step2\">Step 2 &#8211; Query stopped\/started (list output format)<\/h4>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"482\" height=\"635\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-33.png\" alt=\"\" class=\"wp-image-3379\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-33.png 482w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-33-228x300.png 228w\" sizes=\"auto, (max-width: 482px) 100vw, 482px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step2stoppedquery\">Step 2 &#8211; Query &#8211; Detect Windows Service Stopped<\/h4>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>arg(\"\").resources\n| where type in ('microsoft.compute\/virtualmachines','microsoft.hybridcompute\/machines')\n| extend ContactMail = tostring(tags&#91;\"MonitorContactMail\"])\n| extend ContactSMS = tostring(tags&#91;\"MonitorContactSMS\"])\n| extend MonitorMaintenanceModeActive = tostring(tags&#91;\"MonitorMaintenanceModeActive\"])\n| extend PatchGroup = tostring(tags&#91;\"PatchGroup\"])\n| extend PatchActive = tostring(tags&#91;\"PatchActive\"])\n| mvexpand tags\n| extend Name = toupper(name)\n| extend tagKey = tostring(bag_keys(tags)&#91;0])\n| extend tagValue = split(tostring(tags&#91;tagKey]), \",\")\n| extend tagValueStr = tostring(tags&#91;tagKey])\n| where tagKey in (\"MonitorContactMail\",\"MonitorContactSMS\",\"MonitorMaintenanceModeActive\",\"MonitorWindowsServices\",\"PatchActive\",\"PatchGroup\",\"Environment\")\n| project Name, tagKey, tagValue, tagValueStr, type, location, resourceGroup, subscriptionId, id, ContactMail, ContactSMS, MonitorMaintenanceModeActive, PatchGroup, PatchActive\n| join kind=inner (\n    ConfigurationChange\n    | extend Name = toupper(Computer)\n) on $left.Name == $right.Name\n| where TimeGenerated &gt; ago(5m)\n| where MonitorMaintenanceModeActive =~ \"FALSE\"\n| where ConfigChangeType == \"WindowsServices\"\n| where SvcChangeType == \"State\"\n| where SvcState == \"Stopped\"\n| where SvcPreviousState == \"Running\"\n| where tagKey =~ \"MonitorWindowsServices\"\n| where SvcStartupType == \"Auto\"\n| sort by TimeGenerated desc\n| mv-apply tagValue on (\n    where SvcName == (tagValue)\n)\n| project Name, TimeGenerated, SvcName, SvcDisplayName, SvcState, SvcPreviousState, SvcStartupType, tagKey, tagValue, tagValueStr, ContactMail, ContactSMS, MonitorMaintenanceModeActive, PatchGroup, PatchActive<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step2runningquery\">Step 2 &#8211; Query &#8211; Detect Windows Service Running<\/h4>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>arg(\"\").resources\n| where type in ('microsoft.compute\/virtualmachines','microsoft.hybridcompute\/machines')\n| extend ContactMail = tostring(tags&#91;\"MonitorContactMail\"])\n| extend ContactSMS = tostring(tags&#91;\"MonitorContactSMS\"])\n| extend MonitorMaintenanceModeActive = tostring(tags&#91;\"MonitorMaintenanceModeActive\"])\n| extend PatchGroup = tostring(tags&#91;\"PatchGroup\"])\n| extend PatchActive = tostring(tags&#91;\"PatchActive\"])\n| mvexpand tags\n| extend Name = toupper(name)\n| extend tagKey = tostring(bag_keys(tags)&#91;0])\n| extend tagValue = split(tostring(tags&#91;tagKey]), \",\")\n| extend tagValueStr = tostring(tags&#91;tagKey])\n| where tagKey in (\"MonitorContactMail\",\"MonitorContactSMS\",\"MonitorMaintenanceModeActive\",\"MonitorWindowsServices\",\"PatchActive\",\"PatchGroup\",\"Environment\")\n| project Name, tagKey, tagValue, tagValueStr, type, location, resourceGroup, subscriptionId, id, ContactMail, ContactSMS, MonitorMaintenanceModeActive, PatchGroup, PatchActive\n| join kind=inner (\n    ConfigurationChange\n    | extend Name = toupper(Computer)\n) on $left.Name == $right.Name\n| where TimeGenerated &gt; ago(5m)\n| where MonitorMaintenanceModeActive =~ \"FALSE\"\n| where ConfigChangeType == \"WindowsServices\"\n| where SvcChangeType == \"State\"\n| where SvcState == \"Running\"\n| where SvcPreviousState == \"Stopped\"\n| where tagKey =~ \"MonitorWindowsServices\"\n| where SvcStartupType == \"Auto\"\n| sort by TimeGenerated desc\n| mv-apply tagValue on (\n    where SvcName == (tagValue)\n)\n| project Name, TimeGenerated, SvcName, SvcDisplayName, SvcState, SvcPreviousState, SvcStartupType, tagKey, tagValue, tagValueStr, ContactMail, ContactSMS, MonitorMaintenanceModeActive, PatchGroup, PatchActive<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step3\">Step 3 &#8211; Conditions<\/h4>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"898\" height=\"462\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-37.png\" alt=\"\" class=\"wp-image-3383\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-37.png 898w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-37-300x154.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-37-768x395.png 768w\" sizes=\"auto, (max-width: 898px) 100vw, 898px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"583\" height=\"739\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-39.png\" alt=\"\" class=\"wp-image-3385\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-39.png 583w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-39-237x300.png 237w\" sizes=\"auto, (max-width: 583px) 100vw, 583px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"632\" height=\"804\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-38.png\" alt=\"\" class=\"wp-image-3384\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-38.png 632w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-38-236x300.png 236w\" sizes=\"auto, (max-width: 632px) 100vw, 632px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Validate code<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\"type\": \"If\",\n  \"expression\": {\n    \"and\": &#91;\n      {\n        \"equals\": &#91;\n          \"@length(body('Detect_Windows_Service_Stopped_-_LIST')?&#91;'value'])\",\n          0\n        ]\n      }\n    ]<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step4\">Step 4 &#8211; Query stopped\/started (HTML output format)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Use same queries as earlier (stopped\/running)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"511\" height=\"610\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-32.png\" alt=\"\" class=\"wp-image-3378\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-32.png 511w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-32-251x300.png 251w\" sizes=\"auto, (max-width: 511px) 100vw, 511px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"614\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-31-1024x614.png\" alt=\"\" class=\"wp-image-3377\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-31-1024x614.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-31-300x180.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-31-768x460.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-31.png 1450w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"step5\">Step 5 &#8211; Send Mail<\/h4>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"754\" height=\"929\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-51.png\" alt=\"\" class=\"wp-image-3398\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-51.png 754w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-51-243x300.png 243w\" sizes=\"auto, (max-width: 754px) 100vw, 754px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"final\">Final layout<\/h4>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"865\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-42-1024x865.png\" alt=\"\" class=\"wp-image-3389\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-42-1024x865.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-42-300x254.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-42-768x649.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-42.png 1381w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"validate\">Validate that Azure Logic Apps runs every 5 min<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"310\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-40-1024x310.png\" alt=\"\" class=\"wp-image-3386\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-40-1024x310.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-40-300x91.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-40-768x233.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-40.png 1397w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Azure Logic Apps (Code View)<\/h2>\n\n\n<div class=\"wp-block-ub-content-toggle wp-block-ub-content-toggle-block\" id=\"ub-content-toggle-block-d68d3e2f-34d2-4cac-82f5-f5a04d0f4255\" data-mobilecollapse=\"true\" data-desktopcollapse=\"true\" data-preventcollapse=\"false\" data-showonlyone=\"false\">\n<div class=\"wp-block-ub-content-toggle-accordion\" style=\"border-color: #f1f1f1; \" id=\"ub-content-toggle-panel-block-\">\n\t\t\t<div class=\"wp-block-ub-content-toggle-accordion-title-wrap\" style=\"background-color: #f1f1f1;\" aria-controls=\"ub-content-toggle-panel-0-d68d3e2f-34d2-4cac-82f5-f5a04d0f4255\" tabindex=\"0\">\n\t\t\t<p class=\"wp-block-ub-content-toggle-accordion-title ub-content-toggle-title-d68d3e2f-34d2-4cac-82f5-f5a04d0f4255\" style=\"color: #000000; \">Azure Logic Apps (Code View)<\/p>\n\t\t\t<div class=\"wp-block-ub-content-toggle-accordion-toggle-wrap right\" style=\"color: #000000;\"><span class=\"wp-block-ub-content-toggle-accordion-state-indicator wp-block-ub-chevron-down\"><\/span><\/div>\n\t\t<\/div>\n\t\t\t<div role=\"region\" aria-expanded=\"false\" class=\"wp-block-ub-content-toggle-accordion-content-wrap ub-hide\" id=\"ub-content-toggle-panel-0-d68d3e2f-34d2-4cac-82f5-f5a04d0f4255\">\n\n<p class=\"wp-block-paragraph\">Code View<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>{\n  \"definition\": {\n    \"$schema\": \"https:\/\/schema.management.azure.com\/providers\/Microsoft.Logic\/schemas\/2016-06-01\/workflowdefinition.json#\",\n    \"contentVersion\": \"1.0.0.0\",\n    \"triggers\": {\n      \"Recurrence\": {\n        \"type\": \"Recurrence\"\n      }\n    },\n    \"actions\": {\n      \"Detect_Windows_Service_Stopped_-_LIST\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\n          \"host\": {\n            \"connection\": {\n              \"name\": \"@parameters('$connections')['azuremonitorlogs']['connectionId']\"\n            }\n          },\n          \"method\": \"post\",\n          \"path\": \"\/queryDataV2\"\n        },\n        \"runAfter\": {}\n      },\n      \"Condition_(stopped)\": {\n        \"type\": \"If\",\n        \"actions\": {},\n        \"else\": {\n          \"actions\": {\n            \"Detect_Windows_Service_Stopped_-_HTML\": {\n              \"type\": \"ApiConnection\",\n              \"inputs\": {\n                \"host\": {\n                  \"connection\": {\n                    \"name\": \"@parameters('$connections')['azuremonitorlogs']['connectionId']\"\n                  }\n                },\n                \"method\": \"post\",\n                \"path\": \"\/visualizeQuery\"\n              }\n            },\n            \"For_each\": {\n              \"type\": \"Foreach\",\n              \"actions\": {},\n              \"runAfter\": {\n                \"Detect_Windows_Service_Stopped_-_HTML\": [\n                  \"Succeeded\"\n                ]\n              }\n            }\n          }\n        },\n        \"runAfter\": {\n          \"Detect_Windows_Service_Stopped_-_LIST\": [\n            \"Succeeded\"\n          ]\n        }\n      },\n      \"Detect_Windows_Service_Running_-_LIST\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\n          \"host\": {\n            \"connection\": {\n              \"name\": \"@parameters('$connections')['azuremonitorlogs']['connectionId']\"\n            }\n          },\n          \"method\": \"post\",\n          \"path\": \"\/queryDataV2\"\n        },\n        \"runAfter\": {}\n      },\n      \"Condition_(runnng)\": {\n        \"type\": \"If\",\n        \"actions\": {},\n        \"else\": {\n          \"actions\": {\n            \"Detect_Windows_Service_Started_-_HTML\": {\n              \"type\": \"ApiConnection\",\n              \"inputs\": {\n                \"host\": {\n                  \"connection\": {\n                    \"name\": \"@parameters('$connections')['azuremonitorlogs']['connectionId']\"\n                  }\n                },\n                \"method\": \"post\",\n                \"path\": \"\/visualizeQuery\"\n              }\n            },\n            \"For_each_1\": {\n              \"type\": \"Foreach\",\n              \"actions\": {},\n              \"runAfter\": {\n                \"Detect_Windows_Service_Started_-_HTML\": [\n                  \"Succeeded\"\n                ]\n              }\n            }\n          }\n        },\n        \"runAfter\": {\n          \"Detect_Windows_Service_Running_-_LIST\": [\n            \"Succeeded\"\n          ]\n        }\n      }\n    },\n    \"outputs\": {},\n    \"parameters\": {\n      \"$connections\": {\n        \"type\": \"Object\",\n        \"defaultValue\": {}\n      }\n    }\n  },\n  \"parameters\": {\n    \"$connections\": {\n      \"value\": {\n        \"azuremonitorlogs\": {\n          \"id\": \"\/subscriptions\/xxxxxxxxxx3-12e2bf9fbec0\/providers\/Microsoft.Web\/locations\/westeurope\/managedApis\/azuremonitorlogs\",\n          \"connectionId\": \"\/subscriptions\/xxxxxxxxxxx-12e2bf9fbec0\/resourceGroups\/rg-demo\/providers\/Microsoft.Web\/connections\/azuremonitorlogs-3\",\n          \"connectionName\": \"azuremonitorlogs-3\",\n          \"connectionProperties\": {\n            \"authentication\": {\n              \"type\": \"ManagedServiceIdentity\"\n            }\n          }\n        },\n        \"office365-1\": {\n          \"id\": \"\/subscriptions\/1xxxxxxxxxx-12e2bf9fbec0\/providers\/Microsoft.Web\/locations\/westeurope\/managedApis\/office365\",\n          \"connectionId\": \"\/subscriptions\/xxxxxxxxx3-12e2bf9fbec0\/resourceGroups\/rg-demo\/providers\/Microsoft.Web\/connections\/office365-1\",\n          \"connectionName\": \"office365-1\"\n        }\n      }\n    }\n  }\n}<\/code><\/pre>\n\n<\/div>\n\t\t<\/div>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Azure Data Collection Rules for Change Tracking Collection<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"459\" height=\"294\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-34.png\" alt=\"\" class=\"wp-image-3380\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-34.png 459w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-34-300x192.png 300w\" sizes=\"auto, (max-width: 459px) 100vw, 459px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"480\" height=\"91\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-35.png\" alt=\"\" class=\"wp-image-3381\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-35.png 480w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-35-300x57.png 300w\" sizes=\"auto, (max-width: 480px) 100vw, 480px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"694\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-36-1024x694.png\" alt=\"\" class=\"wp-image-3382\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-36-1024x694.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-36-300x203.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-36-768x521.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-36-1536x1041.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-36.png 1636w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Windows service collection runs every 60 sec. You can control this frequency by adjusting this value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">                          &#8220;servicesSettings&#8221;: {<br>                          &#8220;serviceCollectionFrequency&#8221;: 60<\/p>\n<\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Don&#8217;t forget to associate the servers, where you want to collect Windows Service Change Tracking information as shown below<\/p>\n<\/blockquote>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"355\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-25-1024x355.png\" alt=\"\" class=\"wp-image-3369\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-25-1024x355.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-25-300x104.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-25-768x266.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-25-1536x532.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-25.png 1886w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dcrtemplate\">Azure Data Collection Rules Template (JSON)<\/h4>\n\n\n<div class=\"wp-block-ub-content-toggle wp-block-ub-content-toggle-block\" id=\"ub-content-toggle-block-10353183-58f6-453e-af38-4a6801efe603\" data-mobilecollapse=\"true\" data-desktopcollapse=\"true\" data-preventcollapse=\"false\" data-showonlyone=\"false\">\n<div class=\"wp-block-ub-content-toggle-accordion\" style=\"border-color: #f1f1f1; \" id=\"ub-content-toggle-panel-block-\">\n\t\t\t<div class=\"wp-block-ub-content-toggle-accordion-title-wrap\" style=\"background-color: #f1f1f1;\" aria-controls=\"ub-content-toggle-panel-0-10353183-58f6-453e-af38-4a6801efe603\" tabindex=\"0\">\n\t\t\t<p class=\"wp-block-ub-content-toggle-accordion-title ub-content-toggle-title-10353183-58f6-453e-af38-4a6801efe603\" style=\"color: #000000; \">Azure Data Collection Rules Template (JSON). Used with Custom Deployment<\/p>\n\t\t\t<div class=\"wp-block-ub-content-toggle-accordion-toggle-wrap right\" style=\"color: #000000;\"><span class=\"wp-block-ub-content-toggle-accordion-state-indicator wp-block-ub-chevron-down\"><\/span><\/div>\n\t\t<\/div>\n\t\t\t<div role=\"region\" aria-expanded=\"false\" class=\"wp-block-ub-content-toggle-accordion-content-wrap ub-hide\" id=\"ub-content-toggle-panel-0-10353183-58f6-453e-af38-4a6801efe603\">\n\n<p class=\"wp-block-paragraph\">dcr-operation-windows-changetracking.json<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>{\n    \"$schema\": \"http:\/\/schema.management.azure.com\/schemas\/2015-01-01\/deploymentTemplate.json#\",\n    \"contentVersion\": \"1.0.0.0\",\n    \"parameters\": {\n        \"WorkspaceResourceId\": {\n            \"type\": \"String\",\n            \"metadata\": {\n                \"description\": \"LogAnalytics Workspace Resource ID\"\n            }\n        },\n        \"WorkspaceLocation\": {\n            \"type\": \"String\",\n            \"metadata\": {\n                \"description\": \"LogAnalytics Location (e.g. westeurope)\"\n            }\n        },\n        \"DcrName\": {\n            \"type\": \"String\",\n            \"metadata\": {\n                \"description\": \"Data Collection Rule name\"\n            }\n        },\n        \"DcrResourceGroup\": {\n            \"type\": \"String\",\n            \"metadata\": {\n                \"description\": \"Data Collection Rule resource group\"\n            }\n\t\t}\n    },\n    \"variables\": {},\n    \"resources\": [\n      {\n        \"type\": \"microsoft.resources\/deployments\",\n        \"name\": \"[parameters('DcrName')]\",\n        \"apiVersion\": \"2020-08-01\",\n        \"properties\": {\n          \"mode\": \"Incremental\",\n          \"template\": {\n            \"$schema\": \"https:\/\/schema.management.azure.com\/schemas\/2019-04-01\/deploymentTemplate.json#\",\n            \"contentVersion\": \"1.0.0.0\",\n            \"resources\": [\n              {\n                \"type\": \"Microsoft.Insights\/dataCollectionRules\",\n                \"apiVersion\": \"2021-04-01\",\n                \"name\": \"[parameters('DcrName')]\",\n                \"location\": \"[parameters('WorkspaceLocation')]\",\n                \"properties\": {\n                  \"description\": \"Data collection rule for ChangeTracking\",\n                  \"dataSources\": {\n                    \"extensions\": [\n                      {\n                        \"streams\": [\n                          \"Microsoft-ConfigurationChange\",\n                          \"Microsoft-ConfigurationChangeV2\",\n                          \"Microsoft-ConfigurationData\"\n                        ],\n                        \"extensionName\": \"ChangeTracking-Windows\",\n                        \"extensionSettings\": {\n                          \"enableFiles\": false,\n                          \"enableSoftware\": false,\n                          \"enableRegistry\": false,\n                          \"enableServices\": true,\n                          \"enableInventory\": false,\n                          \"registrySettings\": {\n                            \"registryCollectionFrequency\": 3000,\n                            \"registryInfo\": [\n                              {\n                                \"name\": \"Registry_1\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Group Policy\\\\Scripts\\\\Startup\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_2\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Group Policy\\\\Scripts\\\\Shutdown\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_3\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_4\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Active Setup\\\\Installed Components\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_5\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Classes\\\\Directory\\\\ShellEx\\\\ContextMenuHandlers\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_6\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Classes\\\\Directory\\\\Background\\\\ShellEx\\\\ContextMenuHandlers\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_7\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Classes\\\\Directory\\\\Shellex\\\\CopyHookHandlers\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_8\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\ShellIconOverlayIdentifiers\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_9\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\ShellIconOverlayIdentifiers\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_10\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Browser Helper Objects\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_11\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Browser Helper Objects\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_12\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Extensions\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_13\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Internet Explorer\\\\Extensions\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_14\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Drivers32\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_15\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Drivers32\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_16\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\KnownDlls\",\n                                \"valueName\": \"\"\n                              },\n                              {\n                                \"name\": \"Registry_17\",\n                                \"groupTag\": \"Recommended\",\n                                \"enabled\": false,\n                                \"recurse\": true,\n                                \"description\": \"\",\n                                \"keyName\": \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Notify\",\n                                \"valueName\": \"\"\n                              }\n                            ]\n                          },\n                          \"fileSettings\": {\n                            \"fileCollectionFrequency\": 2700\n                          },\n                          \"softwareSettings\": {\n                            \"softwareCollectionFrequency\": 1800\n                          },\n                          \"inventorySettings\": {\n                            \"inventoryCollectionFrequency\": 36000\n                          },\n                          \"servicesSettings\": {\n                            \"serviceCollectionFrequency\": 60\n                          }\n                        },\n                        \"name\": \"CTDataSource-Windows\"\n                      },\n                      {\n                        \"streams\": [\n                          \"Microsoft-ConfigurationChange\",\n                          \"Microsoft-ConfigurationChangeV2\",\n                          \"Microsoft-ConfigurationData\"\n                        ],\n                        \"extensionName\": \"ChangeTracking-Linux\",\n                        \"extensionSettings\": {\n                          \"enableFiles\": false,\n                          \"enableSoftware\": false,\n                          \"enableRegistry\": false,\n                          \"enableServices\": true,\n                          \"enableInventory\": false,\n                          \"fileSettings\": {\n                            \"fileCollectionFrequency\": 900,\n                            \"fileInfo\": [\n                              {\n                                \"name\": \"ChangeTrackingLinuxPath_default\",\n                                \"enabled\": true,\n                                \"destinationPath\": \"\/etc\/*.conf\",\n                                \"useSudo\": true,\n                                \"recurse\": true,\n                                \"maxContentsReturnable\": 5000000,\n                                \"pathType\": \"File\",\n                                \"type\": \"File\",\n                                \"links\": \"Follow\",\n                                \"maxOutputSize\": 500000,\n                                \"groupTag\": \"Recommended\"\n                              }\n                            ]\n                          },\n                          \"softwareSettings\": {\n                            \"softwareCollectionFrequency\": 300\n                          },\n                          \"inventorySettings\": {\n                            \"inventoryCollectionFrequency\": 36000\n                          },\n                          \"servicesSettings\": {\n                            \"serviceCollectionFrequency\": 60\n                          }\n                        },\n                        \"name\": \"CTDataSource-Linux\"\n                      }\n                    ]\n                  },\n                  \"destinations\": {\n                    \"logAnalytics\": [\n                      {\n                        \"workspaceResourceId\": \"[parameters('workspaceResourceId')]\",\n                        \"name\": \"Microsoft-CT-Dest\"\n                      }\n                    ]\n                  },\n                  \"dataFlows\": [\n                    {\n                      \"streams\": [\n                          \"Microsoft-ConfigurationChange\",\n                          \"Microsoft-ConfigurationChangeV2\",\n                          \"Microsoft-ConfigurationData\"\n                      ],\n                      \"destinations\": [\n                        \"Microsoft-CT-Dest\"\n                      ]\n                    }\n                  ]\n                }\n              }\n            ]\n          }\n        },\n            \"subscriptionId\": \"[split(parameters('WorkspaceResourceId'),'\/')[2]]\",\n            \"resourceGroup\": \"[parameters('DcrResourceGroup')]\"\n      }\n    ]\n}<\/code><\/pre>\n\n<\/div>\n\t\t<\/div>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"la\">Azure LogAnalytics Workspace for Change Tracking<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"412\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-24-1024x412.png\" alt=\"\" class=\"wp-image-3368\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-24-1024x412.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-24-300x121.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-24-768x309.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-24-1536x618.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-24-2048x824.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently, I was challenged to build a scalable, cloud native solution that should be used for monitoring of critical Windows &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Windows Service Monitoring at Scale using Cloud Native Azure Components\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=3367#more-3367\" aria-label=\"Read more about Windows Service Monitoring at Scale using Cloud Native Azure Components\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3407,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[140,154,55,59,129,54,143,141,153,137,152,142,180,134,60],"tags":[20,179,18,62,174,178,176,177],"class_list":["post-3367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ama","category-automation","category-azure","category-azure-arc","category-azure-data-collection-rules","category-azure-loganalytics","category-azure-logging","category-azure-monitor-agent","category-azure-resource-graph","category-dcr","category-kusto","category-logging","category-logicapps","category-mvpbuzz","category-scripting","tag-automation","tag-availability","tag-azure","tag-azure-arc","tag-kusto","tag-logic-apps","tag-monitoring","tag-windows-services","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-53.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/09\/image-53.png","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3367"}],"version-history":[{"count":17,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3367\/revisions"}],"predecessor-version":[{"id":3416,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3367\/revisions\/3416"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/3407"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}