More kusto – Reading email recipients for Azure Action Groups

by ezs | Jun 1, 2023 | evilzenscientist

Lots of hygiene work, including cleaning up Azure Action Groups that send to individual emails. That’s a red flag and anti pattern.

Here’s the KQL to read the Action Groups, their subscriptions, and expand out the recipients.

It’s easy work to continue to audit this, and clean up the dead wood.

resources

| join kind=leftouter (ResourceContainers | where type==’microsoft.resources/subscriptions’ | project SubName=name, subscriptionId) on subscriptionId

| where type == “microsoft.insights/actiongroups”

| extend emailRecsCount =array_length(properties.emailReceivers)

| mv-expand emailRecs = properties.emailReceivers

| project SubName, resourceGroup, name, emailRecsCount, emailRecs.name, emailRecs.status, emailRecs.emailAddress

| order by [‘name’] asc

Using the Azure VM Agent to find server health

by ezs | Jun 1, 2023 | evilzenscientist

I discovered a pool of servers that seemed to be unused, and used the Azure VM Agent “Run PowerShell Script” to determine the real health.

The output told me: not domain joined, not managed, not being patched, so targets for decommissioning.

$boot = Get-CimInstance -ClassName Win32_OperatingSystem

$hotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1

$name = Get-CimInstance -Classname Win32_ComputerSystem

write-host “Server $($name.name) Domain $($name.domain)”

write-host “Last reboot $($boot.LastBootUpTime)”

write-host “Last patch $($hotfix.HotFixID) $($hotfix.InstalledOn)”

Server FOOSERVER Domain WORKGROUP
Last reboot 10/12/2022 18:50:02
Last patch KB4495585 05/15/2019 00:00:00

Microsoft Flow – MSN weather connector, units

by ezs | Mar 10, 2023 | evilzenscientist

I’ve had a Microsoft Flow connector in production for a long time. It runs twice daily, reads the weather forecast for my location (Issaquah, WA), and if it’s forecast to be warm, sends an email to remind that plants need watering.

At some point recently, the flow stopped working correctly. It was triggering for Fahrenheit temperatures rather than Celsius. Cue twice daily emails when it’s cold outside.

I pulled apart the flow – and the Inputs for the connector had changed:

Ubuntu Gen2 VM on Hyper-V

by ezs | Jan 15, 2023 | evilzenscientist

Note for myself – remember to switch the UEFI template to Microsoft UEFI Certificate Authority to allow booting from the ISO.

Azure Function timer triggers

by ezs | Jan 13, 2023 | evilzenscientist

Deep joy working with Azure Function apps, and using timer triggers this last few weeks.

I’ve been working on a set of Azure Functions that fire on a schedule, to read information from across the Azure environment, and write the results to Cosmos DB. Simple enough.

The trigger is set as a Timer:

The timer takes an NCRONTAB format for when it fires.

The various pieces of documentation are pretty clear, and I’ve got a lot of familiarity with CRON running on Linux.

My initial schedule was 0 0 */8 * * * – which should fire every 8 hours.

Instead – some really variable and unreliable results. I found "8-ish" hours between triggers to be best case, often the whole function stopped firing. Restart the function, and "8-ish hours" later it fired.

After a bunch of reading and testing, I changed the schedule to 0 0 0/8 * * * – which fires at 00Z, 08Z, 16Z – so every 8 hours, but locked to midnight, 8.00am and 4.00pm UTC.

So far – so good.

This was a good NCRONTAB expression tester: NCrontab Online Expression Tester Evaluator (swimburger.net)