Cấu hình Log Analytics

# Tạo Resource Group
az group create \
  --name rg-az104-m30 \
  --location southeastasia \
  --tags Course=AZ-104 Module=30 Environment=Lab

# Tạo Log Analytics Workspace với retention 60 ngày
az monitor log-analytics workspace create \
  --resource-group rg-az104-m30 \
  --workspace-name law-az104-m30 \
  --location southeastasia \
  --sku PerGB2018 \
  --retention-time 60

LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az104-m30 \
  --workspace-name law-az104-m30 \
  --query id -o tsv)

LAW_CUSTOMER_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az104-m30 \
  --workspace-name law-az104-m30 \
  --query customerId -o tsv)

echo "Workspace ID (customerId): $LAW_CUSTOMER_ID"
echo "Workspace Resource ID: $LAW_ID"

# Tạo VM Windows Server 2022 để thu thập Windows Event Log
az vm create \
  --resource-group rg-az104-m30 \
  --name vm-law-lab30 \
  --image Win2022Datacenter \
  --size Standard_B2s \
  --admin-username azureuser \
  --admin-password "P@ssw0rd2026AZ104!" \
  --location southeastasia \
  --tags Course=AZ-104 Module=30

VM_ID=$(az vm show \
  --resource-group rg-az104-m30 \
  --name vm-law-lab30 \
  --query id -o tsv)

LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az104-m30 \
  --workspace-name law-az104-m30 \
  --query id -o tsv)

# Cài Azure Monitor Agent extension trên VM Windows
az vm extension set \
  --resource-group rg-az104-m30 \
  --vm-name vm-law-lab30 \
  --name AzureMonitorWindowsAgent \
  --publisher Microsoft.Azure.Monitor \
  --version 1.22

# Tạo Data Collection Rule — thu thập Windows Event Log và Perf counters
az monitor data-collection rule create \
  --resource-group rg-az104-m30 \
  --name dcr-az104-m30-windows \
  --location southeastasia \
  --data-flows '[{"streams":["Microsoft-Event","Microsoft-Perf"],"destinations":["law-az104-m30-dest"]}]' \
  --destinations '{"logAnalytics":[{"workspaceResourceId":"'"$LAW_ID"'","name":"law-az104-m30-dest"}]}' \
  --data-sources '{
    "windowsEventLogs":[{
      "streams":["Microsoft-Event"],
      "xPathQueries":["System!*[System[(Level=1 or Level=2 or Level=3)]]","Application!*[System[(Level=1 or Level=2)]]"],
      "name":"windowsEventLogsDataSource"
    }],
    "performanceCounters":[{
      "streams":["Microsoft-Perf"],
      "samplingFrequencyInSeconds":60,
      "counterSpecifiers":["\\Processor(_Total)\\% Processor Time","\\Memory\\Available MBytes","\\LogicalDisk(_Total)\\% Free Space"],
      "name":"perfCountersDataSource"
    }]
  }'

DCR_ID=$(az monitor data-collection rule show \
  --resource-group rg-az104-m30 \
  --name dcr-az104-m30-windows \
  --query id -o tsv)

# Associate DCR với VM
az monitor data-collection rule association create \
  --resource "$VM_ID" \
  --association-name "dcra-vm-law-lab30" \
  --rule-id "$DCR_ID"

echo "AMA cài xong. Dữ liệu sẽ xuất hiện trong Log Analytics sau 10-15 phút."

LAW_CUSTOMER_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az104-m30 \
  --workspace-name law-az104-m30 \
  --query customerId -o tsv)

# Query 1: Xem Heartbeat của VM
az monitor log-analytics query \
  --workspace "$LAW_CUSTOMER_ID" \
  --analytics-query "Heartbeat | where TimeGenerated > ago(1h) | project TimeGenerated, Computer, OSType | order by TimeGenerated desc | take 10" \
  --output table

# Query 2: CPU cao nhất theo VM
az monitor log-analytics query \
  --workspace "$LAW_CUSTOMER_ID" \
  --analytics-query "Perf | where TimeGenerated > ago(1h) | where CounterName == '% Processor Time' | summarize MaxCPU=max(CounterValue), AvgCPU=round(avg(CounterValue),1) by Computer | order by MaxCPU desc" \
  --output table

# Query 3: Windows Event Errors
az monitor log-analytics query \
  --workspace "$LAW_CUSTOMER_ID" \
  --analytics-query "Event | where TimeGenerated > ago(24h) | where EventLevelName in ('Error','Critical') | summarize Count=count() by EventLog, EventID, RenderedDescription | order by Count desc | take 10" \
  --output table

# Query 4: Disk free space thấp
az monitor log-analytics query \
  --workspace "$LAW_CUSTOMER_ID" \
  --analytics-query "Perf | where TimeGenerated > ago(1h) | where CounterName == '% Free Space' | where ObjectName == 'LogicalDisk' | where InstanceName != '_Total' | summarize FreePercent=avg(CounterValue) by Computer, InstanceName | where FreePercent < 20 | order by FreePercent asc" \
  --output table

LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az104-m30 \
  --workspace-name law-az104-m30 \
  --query id -o tsv)

# Tạo Workbook đơn giản hiển thị CPU và Memory
# Workbook dùng Azure Resource Manager template
cat > /tmp/workbook-template.json << 'EOF'
{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## VM Performance Dashboard\n\nWorkbook này hiển thị CPU và Memory của các VMs kết nối với Log Analytics Workspace."
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Perf\n| where TimeGenerated > ago(1h)\n| where CounterName == '% Processor Time'\n| summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 5m), Computer\n| render timechart",
        "size": 0,
        "title": "CPU Usage (1 giờ qua)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Perf\n| where TimeGenerated > ago(1h)\n| where CounterName == 'Available MBytes'\n| summarize AvgMemMB = avg(CounterValue) by bin(TimeGenerated, 5m), Computer\n| render timechart",
        "size": 0,
        "title": "Available Memory (MB)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      }
    }
  ]
}
EOF

# Deploy Workbook via ARM
WORKBOOK_GUID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")

az resource create \
  --resource-group rg-az104-m30 \
  --resource-type "microsoft.insights/workbooks" \
  --name "$WORKBOOK_GUID" \
  --location southeastasia \
  --properties "{
    \"displayName\": \"AZ104-M30-VM-Performance\",
    \"serializedData\": $(cat /tmp/workbook-template.json | python3 -c \"import sys,json; print(json.dumps(sys.stdin.read()))\"),
    \"version\": \"1.0\",
    \"sourceId\": \"$LAW_ID\",
    \"category\": \"workbook\"
  }"

echo "Workbook tạo thành công."
echo "Xem tại: Portal → law-az104-m30 → Workbooks"

# Xóa Data Collection Rule Association trước
VM_ID=$(az vm show \
  --resource-group rg-az104-m30 \
  --name vm-law-lab30 \
  --query id -o tsv)

az monitor data-collection rule association delete \
  --resource "$VM_ID" \
  --association-name "dcra-vm-law-lab30" \
  --yes

# Xóa Data Collection Rule
az monitor data-collection rule delete \
  --resource-group rg-az104-m30 \
  --name dcr-az104-m30-windows \
  --yes

# Xóa Resource Group — kéo theo VM, Log Analytics Workspace, Workbook
az group delete --name rg-az104-m30 --yes --no-wait

echo "Cleanup hoàn tất. RG và tất cả tài nguyên sẽ bị xóa trong vài phút."