Azure Monitor & Alerts — AMA + DCR

# Đăng ký resource providers
az provider register --namespace Microsoft.Insights
az provider register --namespace Microsoft.AlertsManagement
az provider register --namespace Microsoft.Monitor

# Tạo resource group
az group create \
  --name rg-lab11-monitor \
  --location southeastasia

# Tạo Log Analytics Workspace
az monitor log-analytics workspace create \
  --resource-group rg-lab11-monitor \
  --workspace-name law-hoatranlab-lab11 \
  --location southeastasia \
  --sku PerGB2018

# Lấy Workspace ID
az monitor log-analytics workspace show \
  --resource-group rg-lab11-monitor \
  --workspace-name law-hoatranlab-lab11 \
  --query customerId --output tsv

# Tạo VM với System-assigned Identity (AMA yêu cầu)
az vm create \
  --resource-group rg-lab11-monitor \
  --name vm-lab11-win \
  --image Win2022AzureEditionCore \
  --size Standard_B2s \
  --admin-username azureadmin \
  --admin-password "P@ssw0rd2026!" \
  --public-ip-sku Standard \
  --assign-identity "[system]"

# Cài Azure Monitor Agent (AMA) qua extension
az vm extension set \
  --resource-group rg-lab11-monitor \
  --vm-name vm-lab11-win \
  --name AzureMonitorWindowsAgent \
  --publisher Microsoft.Azure.Monitor \
  --version 1.22 \
  --settings '{"workspaceId":""}' \
  --enable-auto-upgrade true

# Kiểm tra extension đã cài
az vm extension list \
  --resource-group rg-lab11-monitor \
  --vm-name vm-lab11-win \
  --output table

# Lấy workspace resource ID
WS_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-lab11-monitor \
  --workspace-name law-hoatranlab-lab11 \
  --query id --output tsv)

# Tạo DCR (Data Collection Rule) thu thập Windows Events + Perf
az monitor data-collection rule create \
  --resource-group rg-lab11-monitor \
  --name dcr-lab11-windows \
  --location southeastasia \
  --data-flows '[{
    "streams": ["Microsoft-Event","Microsoft-Perf"],
    "destinations": ["law-hoatranlab-lab11"]
  }]' \
  --destinations '{
    "logAnalytics": [{
      "workspaceResourceId": "'$WS_ID'",
      "name": "law-hoatranlab-lab11"
    }]
  }' \
  --data-sources '{
    "windowsEventLogs": [{
      "name": "eventLogsDataSource",
      "streams": ["Microsoft-Event"],
      "xPathQueries": [
        "Application!*[System[(Level=1 or Level=2)]]",
        "Security!*[System[(band(Keywords,13510798882111488))]]",
        "System!*[System[(Level=1 or Level=2)]]"
      ]
    }],
    "performanceCounters": [{
      "name": "perfCounters",
      "streams": ["Microsoft-Perf"],
      "samplingFrequencyInSeconds": 60,
      "counterSpecifiers": [
        "\\Processor Information(_Total)\\% Processor Time",
        "\\Memory\\Available Bytes",
        "\\LogicalDisk(_Total)\\% Free Space"
      ]
    }]
  }'

# Tạo Action Group với email notification
az monitor action-group create \
  --resource-group rg-lab11-monitor \
  --name ag-lab11-email \
  --short-name EmailAlert \
  --action email admin [email protected]

# Lấy VM resource ID
VM_ID=$(az vm show \
  --resource-group rg-lab11-monitor \
  --name vm-lab11-win \
  --query id --output tsv)

AG_ID=$(az monitor action-group show \
  --resource-group rg-lab11-monitor \
  --name ag-lab11-email \
  --query id --output tsv)

# Tạo Metric Alert: CPU > 80%
az monitor metrics alert create \
  --resource-group rg-lab11-monitor \
  --name alert-cpu-high \
  --scopes $VM_ID \
  --condition "avg Percentage CPU > 80" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --severity 2 \
  --action $AG_ID \
  --description "Alert khi CPU vuot 80%"