Azure Monitor SDK

from azure.identity import DefaultAzureCredential
from azure.monitor.metrics import MetricsClient

credential = DefaultAzureCredential()
metrics_client = MetricsClient(
    endpoint="https://eastus.monitoring.azure.com/",
    credential=credential,
)

# Query CPU metrics for a VM
response = metrics_client.query(
    resource_uri="/subscriptions/sub-id/resourceGroups/my-rg/providers/Microsoft.Compute/virtualMachines/my-vm",
    metric_names=["Percentage CPU"],
    timespan="P1D",  # Last 1 day
    interval="PT5M",  # 5-minute intervals
    aggregation="Average",
)

for metric in response.metrics:
    print(f"Metric: {metric.name}")
    for timeseries in metric.timeseries:
        for data in timeseries.data:
            print(f"  {data.time_stamp}: {data.average:.1f}%")

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient, LogsQueryStatus

credential = DefaultAzureCredential()
logs_client = LogsQueryClient(credential)

workspace_id = "your-workspace-id"  # From the Azure portal

# Run a KQL query
response = logs_client.query_workspace(
    workspace_id=workspace_id,
    query="""
    AzureDiagnostics
    | where Category == "AuditEvent"
    | summarize count() by ResourceGroup, OperationName
    | order by count_ desc
    """,
    timespan="PT24H",  # Last 24 hours
)

if response.status == LogsQueryStatus.SUCCESS:
    table = response.tables[0]
    for row in table.rows:
        print(f"{row[0]}: {row[1]} ({row[2]} operations)")
elif response.status == LogsQueryStatus.PARTIAL:
    print("Query returned partial results")
else:
    print(f"Query failed: {response.error}")

from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import (
    MetricAlertResource,
    MetricCriteria,
    MetricDimension,
)

credential = DefaultAzureCredential()
client = MonitorManagementClient(credential, "subscription-id")

# Create a CPU alert rule
alert_rule = MetricAlertResource(
    location="global",
    description="Alert when CPU > 80% for 5 minutes",
    severity=2,  # 0=critical, 1=error, 2=warning, 3=informational
    enabled=True,
    scopes=[
        "/subscriptions/sub-id/resourceGroups/my-rg/providers/Microsoft.Compute/virtualMachines/my-vm"
    ],
    criteria=MetricCriteria(
        odata_type="Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria",
        all_of=[
            {
                "name": "criteria1",
                "metric_name": "Percentage CPU",
                "metric_namespace": "Microsoft.Compute/virtualMachines",
                "operator": "GreaterThan",
                "threshold": 80,
                "time_aggregation": "Average",
                "criterion_type": "StaticThresholdCriterion",
            }
        ],
    ),
    window_size="PT5M",
    evaluation_frequency="PT1M",
)

client.metric_alerts.create_or_update(
    "my-rg", "high-cpu-alert", alert_rule
)
print("Alert rule created")

from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import (
    ActionGroupResource,
    EmailReceiver,
    SmsReceiver,
    AutomationRunbookReceiver,
)

credential = DefaultAzureCredential()
client = MonitorManagementClient(credential, "subscription-id")

# Create an action group
action_group = ActionGroupResource(
    location="global",
    group_short_name="OnCall",
    enabled=True,
    email_receivers=[
        EmailReceiver(
            name="oncall-email",
            email_address="oncall@example.com",
            use_common_alert_schema=True,
        ),
    ],
    sms_receivers=[
        SmsReceiver(
            name="oncall-sms",
            country_code="1",
            phone_number="5551234567",
        ),
    ],
    automation_runbook_receivers=[
        AutomationRunbookReceiver(
            name="auto-remediation",
            runbook_account_name="my-automation",
            runbook_name="restart-service",
            webhook_service_uri="https://s12.azure-automation.net/webhooks",
            webhook_token="token-value",
        ),
    ],
)

client.action_groups.create_or_update(
    "my-rg", "oncall-group", action_group
)

from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import DiagnosticSettingsResource

credential = DefaultAzureCredential()
client = MonitorManagementClient(credential, "subscription-id")

# Send VM metrics to Log Analytics
resource_id = "/subscriptions/sub-id/resourceGroups/my-rg/providers/Microsoft.Compute/virtualMachines/my-vm"

settings = DiagnosticSettingsResource(
    storage_account_id="/subscriptions/sub-id/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorage",
    workspace_id="/subscriptions/sub-id/resourceGroups/my-rg/providers/Microsoft.OperationalInsights/workspaces/myworkspace",
    metrics=[
        {"category": "AllMetrics", "enabled": True, "retention_policy": {"enabled": True, "days": 90}},
    ],
    logs=[
        {"category": "AuditEvent", "enabled": True, "retention_policy": {"enabled": True, "days": 30}},
    ],
)

client.diagnostic_settings.create_or_update(
    resource_id=resource_id,
    name="my-diagnostic-settings",
    parameters=settings,
)