I am using the Azure Service Bus topic mechanism. I have sent the messages to topic and want to see the messages which are all sent to the topic in azure portal.
I can see the messages count but want to see the actual messages instead of count.
How can I do this?
You can use the Service Bus Explorer.
You can download it from here:
https://github.com/paolosalvatori/ServiceBusExplorer/releases
Here is a tutorial on how to use it:
http://colinvermander.com/tag/service-bus-explorer/
And here is a link for more information about the software and features: https://blogs.msdn.microsoft.com/paolos/2015/03/02/service-bus-explorer-2-6-now-available/
Most easy way get this done ::
https://github.com/paolosalvatori/ServiceBusExplorer/releases
Check the assets folder of required version.
Download the Zip file among others.
unzip to new folder and double click on "ServiceBusExplorer" (not exe.config file).
Now you can connect and see the actual messages.
You can also use Azure Service Bus manager online tool
You will have to provide the connection string in order to use it
Thought it does not answer your question how to view it in the portal directly. Portal has very limited capabilities.
Microsoft has recently released Service Bus Explorer on Portal. We can send/receive/peek messages here. It's still in preview though.
Related
Are the resource logs (which are part of platform logs) from Azure supported in QRadar or do we need to build a custom parser for each of the resource type in the subscription?
I read the DSM documentation of QRadar, and it mentions platform activity logs, but not resource logs. Let’s take an example where we get gateway logs, websocket connection logs, request logs, etc. from our Azure deployment. Are all resource logs supported by QRadar to be taken from event hub and integrate to QRadar (list of supported resource logs by QRadar)?
if I understand your question correctly you are looking to extend existing parsers to QR without having to implement custom properties.
For this IBM has published the "IBM QRadar Content Extension for Azure":
https://exchange.xforce.ibmcloud.com/hub/extension/7a89f51852efa37de0809457ef1006dd
I recommend installing another extension "Microsoft Azure Security Center Connected Assets & Risks Connector" (https://exchange.xforce.ibmcloud.com/hub/extension/0dbfab6a22bca7add7a99fa19fdd426f), which allows you to monitor other risk events via ASC and integrate assets that are not yet parsed into the QR.
And probably the best scenario how to solve issue with Azure log data is to run side-by-side QR + Sentinel and use Azure Sentinel and turn on Data Connectors for Azure specific resources. This keeps you up to date with integration, data parsing and current buildin rules. We have this scenario deployed and it is for selected sources (Exchange, Teams, risk signins, etc.) and we monitor them via buildin rules in Sentinel. Subsequently, we integrate them into the QR see. https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-side-by-side-with-qradar/ba-p/1488333. We finally store the logs in QRadar, but we use Sentinel for Azure-specific rules and then integrate the incidents into QR.
Regards.
I am new to Service Bus and Azure. My service bus has messages but data looks not readable. I am using Service Bus Explorer. Can you please guide how to see data in readable form?
Thanks
In the following link at step "After connecting to the required instance, click on Register –> Register New Service Endpoint.", choose the message format as "JSON or XML " as suggested by people who have already seen this issue.
https://community.dynamics.com/365/b/ajitpatra365crm/archive/2018/09/26/azure-service-bus-queue-integration-with-d365-part-1
Reference from previous instance of this issue elsewhere
https://community.dynamics.com/crm/f/117/t/155942
https://community.dynamics.com/crm/f/117/t/155628
plugin registration tool when you register your service endpoint you MUST select either JSON or XML for Message Format.
use a 'queue' instead of 'persistentqueue' as the contract type in the Plugin registration tool while configuring the endpoint.
Similar past question of mine: Azure Service Bus Queue: Can I manage/cancel scheduled messages? - accepted answer here details how to cancel scheduled messages.
I'm wondering now if there's a way to view scheduled messages using the AMQP APIs. The Azure UI (and this method https://learn.microsoft.com/en-gb/java/api/com.microsoft.azure.management.servicebus._message_count_details?view=azure-java-stable) offer message counts but I can't see anything that lets me actually view those messages.
Is this a limitation of the service bus/Azure architecture? Or is there an API that will allow it? My goal would be to build a nice UI that displays scheduled tasks, and ideally I'd like to do that without maintaining that list of tasks myself outside of Azure if possible.
As of today, all messages can be peeked, but there's no way to peek those based on message status. There's an open issue on GitHub for the broker to add this feature. You can leave use-case scenario to help product team to have an idea why a feature as such would help customers.
Adding some information I found useful while reading about this.
Azure Service Bus Queues allows browsing/peeking scheduled messages.
Azure Service Bus Subscriptions does not support this feature yet.
Read More
View Example
I am working with Azure Service Bus Topics and Subscriptions. It's being used to send control messages across the application. The message listeners (subscribers) are running in a worker role and they are picking up the messages and processing the request. Each message in the bus can be picked up by only once, even if there are multiple listeners running simultaneously.
There is no issue in using the Service Bus; however we are facing some issues while debugging/testing the application in local. We have 2 service bus, one for the cloud and one for local debugging. Now if multiple people are debugging the application simultaneously, the message is being picked by only one of the system (at random). This is the intended behavior, but it's causing a nuisance while debugging.
Is there any way how I can use a local emulator for the Service Bus? I did some research but I couldn't find any reliable solution for this. Is there any way how we debug the application in isolation?
Unfortunately, there is no Azure SB local emulator. That was asked before, and you can try to use Service Bus for Windows Server but it is slightly behind the cloud service in terms of features support/functionality, etc. Still, it supports Azure SDK, for example. MSDN link for SB for WS.
Azure Service Bus is a broker with competing consumers. Having multiple developers debugging using the same namespace will be be tough (message lock duration expired and another developer that happened to be debugging got that message).
I would suggest to look into a namespace per developer. With MSDN license you're given enough Azure credit to have each developer work in a "sandboxed" namespace. As to how to get it working, you can read from a configuration file, environment variable, etc.
On the ASB for Windows Server - currently it's on version 1.1 where Azure SB is on 3+. Hosted version will be always ahead of the on-premises. Something to consider.
The problem should probably be solved by abstracting the service bus implementation so that it can be swapped for something that you actually can run locally (or in memory). I would suggest not to re-invent that wheel though and choose a library like Masstransit https://masstransit-project.com.
We ended up using a different topic name for each developer while debugging which is working pretty good.
We use the devlopers machine name in the path for alot of dev things. for example a queueName like "TheEventMessageQueue" can be "TheEventMessageQueue-Machine123" and we use a dev subscription so we dont make a mess :)
By using the machine name its easy to se who the que belongs to if its going out of control
I have a static dot net web application with application insights sdk. How do I send application insights data to Azure Event Hub? I have successfully used the Azure Continuous Export feature but I would rather like to send the telemetry data to the Event Hub.
To explicitly send data to eventhub you will need to use EventHub SDK, which is currently available in .NET/C#, Java, REST, and Node.js. For your case which is a web application, sending via REST APIs might be the easiest way. Take a look at API reference for more information: https://msdn.microsoft.com/en-us/library/azure/dn790674.aspx
One catch is that receiving events is not currently supported using REST, you would still need a .NET or Java application to be on the receive side.
If you are looking for a common logging framework - which can be configured to send data to "whatever data destination" you want to - you should consider looking at log4net.
Here's a good implementation of log4net-appender for EventHubs.
#greypanda,
As you know Continuous Export currently only exports Application Insights to blob storage, from which you can pick up the data for use in any workstream you want. Exporting directly in an Event Hub is something that could be a future feature, so please log this at our UserVoice site: https://visualstudio.uservoice.com/forums/357324-application-insights.
We will also have a set of REST APIs for Application Insights soon (see https://visualstudio.uservoice.com/forums/357324-application-insights/suggestions/4999529), which might help you.
I would like to learn more about your scenario so I can better help you in this instance and improve our export and API features. Feel free to reply here or if you want, shoot me a mail offline.
Thank you
Dale Koetke (dalek#microsoft.com)
We don't really support that. It's a lot easier to let the SDK send the data to App Insights portal, then you can use Continuous Export to move it out into Storage. If you want, you can use Stream Analytics to move it from there.
What do you plan to ultimately do with the data? (I mean, why event hub...?)