How to restrict which azure enabled ActiveGate is chosen to monitor a subscription.

[dougwillis]

I have a Dynatrace environment that is shared between different units within the organisation.
The various units within the organisation will be using different Azure subscriptions.

I want to enable Azure cloud monitoring in Dynatrace for specific subscriptions and direct Dyantrace to use the ActiveGates that are deployed in that specific subscription only rather than picking any Azure enabled ActiveGate.

How can I achieve this kind of mapping?

[radek_jasinski · Accepted solution]

Hi @dougwillis 

If you want to enforce that monitoring of specific Azure resources is handled by a designated ActiveGate, one potential approach is:

• Use Network Zones and network segmentation to ensure that OneAgents are assigned to an ActiveGate located within the same network zone/subscription,
• Physically deploy ActiveGates in separate Azure VNETs/subscriptions and restrict network access. This way, the OneAgent will only use the ActiveGate available within its network zone.

Radek

[dougwillis]

Hi,

I can see how that would work for the oneagent and ActiveGate traffic in Azure the environment out to Dynatrace but how does it relate to the which Azure enabled ActiveGate that Dynatrace will use to do the connection to the Azure API?

As far as I can see you provide a set of credentials and a set of tags when the cloud connect is enabled.
Dynatrace will then get a list of all Azure enabled ActiveGates that are in the Dynatrace environment.

My question is how do help Dynatrace target the selection of a specific ActiveGate for this Cloud connector traffic?

[kayjayeff1]

There is no way, that I know, of to select a particular ActiveGate for collecting metrics from specific subscriptions.  You can, however, create your Azure SPNs in such a way to limit the scope to specific subscriptions.

We are testing various configurations of Azure collection in an attempt to determine the best (and lowest administrative overhead) configuration of Azure Connections. I haven't come across anything that gets down to the granular level you are inquiring about, although I do see some entries in the "config.txt" on the Activegates that indicate there may be some way to narrow this down, but this is purely speculation. The line below in particular may be customizable to specify a subscription, but you should consult with Dynatrace before using.

credentials = <clientId>; azure; <subscriptionId>; <appId>; <directoryId>; <authKey> [;tenantUUID]

There are a couple things that I would like to see from the Dynatrace Azure collection. 

1) A way to load balance across activegates

2) be able to specify activegates for specific subscriptions

3) Azure Collection Self Monitoring

Regarding #3: we have installed OneAgent to start collecting logs, but there isn't any self-monitoring for the Azure connections as there seems to be for AWS connections. This functionality was advertised in a post in the Cloud community section, but there wasn't any actual functionality for Azure in the platform that we found that reflected what was posted.

Hope this helps.

-k

[bsnurka · Accepted solution]

The only way to ensure the Azure API monitoring is performed via a specific ActiveGate is to disable the Azure Monitoring AG Module for all ActiveGates besides the one we want to assume control of that Azure API Monitoring: https://docs.dynatrace.com/docs/shortlink/sgw-configure#azure_mod

[kayjayeff1]

This would be a good approach if you only had a couple activegates; however, if you are in a larger environment there could be many, many activegates for resiliency purposes that would negate this approach.