09 Jan 2025 08:16 AM - last edited on 15 Jan 2025 01:07 PM by Michal_Gebacki
the report should have the following and the same to be shared with on a weekly basis. Please report keeping the focus on the following aspects and share the same. I want to calcultae these in weekly basis please give me with an example .
Solved! Go to Solution.
09 Jan 2025 09:03 AM
Hi Pram,
1) System Availability - you can use the metric "Host availability %" and split by host. Display it is table format.
2) Capacity and utilization - CPU usage % , Disk used %, Memory used %, NIC connectivity metrics can be used.
3) Resource spikes - You can use the above metrics and change the value from "Auto" to "Max". With this you will be able to capture the spikes.
4) Security alerts - I doubt whether this can be added to the dashboard.
09 Jan 2025 12:09 PM
For security alerts you can try:
fetch events, from:now() - 7d
| filter event.kind == "SECURITY_EVENT"
| filter isNotNull(dt.entity.host)
| lookup
[
fetch dt.entity.host
| fieldsAdd entity.name
], sourceField:dt.entity.host, lookupField:id
| summarize by:{hostName =lookup.entity.name}, eventcount = count()
| sort eventcount desc
09 Jan 2025 02:27 PM
This sounds like a great opportunity to use Site Reliability Guardian in combination with a Workflow for automation. Once you've figured out the exact queries you'd like to run, build a SRG and run it weekly with a Workflow. You can then add a step to that Workflow to wait for the SRG to complete and then email the results out.