Enable Performance Diagnostics for Azure Virtual Machines

More Info:

Ensure that Performance Diagnostics feature is enabled for your Microsoft Azure virtual machine instances in order to help mitigate VM performance issues. Performance Diagnostics installs a VM extension that runs a self-help diagnostics tool named PerfInsights, available for both Windows and Linux operating systems. PerfInsights can collect and analyze diagnostic information such as virtual machine hardware and storage configuration, various log files, OS information, PCI device information, guest OS log files, configuration files, information about running processes, virtual machine instance disk, memory, CPU usage, and networking information.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To enable Performance Diagnostics for Azure Virtual Machines, you can follow the below steps:

1. Log in to the Azure portal (https://portal.azure.com/).

2. In the left-hand menu, click on “Virtual machines”.

3. Select the virtual machine that you want to enable Performance Diagnostics for.

4. In the virtual machine menu, click on “Diagnostic settings” under the Monitoring section.

5. Click on the “Add diagnostic setting” button.

6. In the “Add diagnostic setting” blade, give a name to the setting.

7. Under “Metrics”, select the “Performance counters” option.

8. Click on the “Add +” button to add a new performance counter.

9. In the “Add performance counter” blade, select the desired counter from the list.

10. Click on the “Add” button to add the performance counter.

11. Under “Logs”, select the “Performance counters” option.

12. Click on the “Add +” button to add a new performance counter.

13. In the “Add performance counter” blade, select the desired counter from the list.

14. Click on the “Add” button to add the performance counter.

15. Click on the “Save” button to save the diagnostic setting.

Once you have completed the above steps, Performance Diagnostics will be enabled for the selected Azure virtual machine. You can view the collected metrics and logs in the Azure portal by navigating to the “Metrics” and “Logs” sections respectively.

Using CLI

To enable performance diagnostics for Azure Virtual Machines using Azure CLI, follow these steps:

1. Open the Azure CLI command prompt.

2. Set the subscription that contains the virtual machine. Use the following command to set the subscription:

   az account set --subscription <subscription-id>
   

3. Enable performance diagnostics for the virtual machine. Use the following command to enable performance diagnostics:

   az vm diagnostics set --resource-group <resource-group-name> --vm-name <vm-name> --settings "{
     \"performanceCounters\": {
       \"sinks\": [
         {
           \"name\": \"<sink-name>\",
           \"destination\": {
             \"storageUri\": \"<storage-account-uri>\",
             \"sasToken\": \"<sas-token>\"
           }
         }
       ],
       \"performanceCounters\": [
         {
           \"category\": \"<category>\",
           \"counterSpecifier\": \"<counter-specifier>\",
           \"samplingInterval\": \"<sampling-interval>\",
           \"unit\": \"<unit>\"
         }
       ]
     }
   }"
   

   Replace the following values in the command:

   • <resource-group-name>: The name of the resource group that contains the virtual machine.
   • <vm-name>: The name of the virtual machine.
   • <sink-name>: The name of the sink that will receive the performance data.
   • <storage-account-uri>: The URI of the storage account that will receive the performance data.
   • <sas-token>: The SAS token for the storage account.
   • <category>: The category of the performance counter.
   • <counter-specifier>: The name of the performance counter.
   • <sampling-interval>: The sampling interval for the performance counter.
   • <unit>: The unit of the performance counter.

4. Verify that performance diagnostics have been enabled for the virtual machine. Use the following command to verify the settings:

   az vm diagnostics get-default-config --is-windows-os --resource-group <resource-group-name> --vm-name <vm-name>
   

   Replace <resource-group-name> and <vm-name> with the actual resource group and virtual machine names.

   The command will return the default configuration for the virtual machine. Verify that the performance counters are included in the configuration.

That’s it! Performance diagnostics have been enabled for the Azure Virtual Machine.

Using Python

To enable Performance Diagnostics for Azure Virtual Machines using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:

1. Install the Azure SDK for Python. You can install it using pip by running the following command:

pip install azure-mgmt-compute

2. Authenticate with Azure. You can authenticate using a service principal or user credentials. Here’s an example of how to authenticate using a service principal:

from azure.common.credentials import ServicePrincipalCredentials

TENANT_ID = '<your tenant id>'
CLIENT_ID = '<your client id>'
CLIENT_SECRET = '<your client secret>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT_ID,
    secret=CLIENT_SECRET,
    tenant=TENANT_ID
)

3. Create a ComputeManagementClient object using the authenticated credentials:

from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.compute.models import DiagnosticsProfile, BootDiagnostics

SUBSCRIPTION_ID = '<your subscription id>'
RESOURCE_GROUP_NAME = '<your resource group name>'
VM_NAME = '<your virtual machine name>'

compute_client = ComputeManagementClient(credentials, SUBSCRIPTION_ID)

4. Get the virtual machine object:

vm = compute_client.virtual_machines.get(
    RESOURCE_GROUP_NAME,
    VM_NAME
)

5. Enable Performance Diagnostics for the virtual machine:

diagnostics_profile = DiagnosticsProfile(
    boot_diagnostics=BootDiagnostics(
        enabled=True,
        storage_uri='<your storage account uri>'
    )
)

vm.diagnostics_profile = diagnostics_profile

compute_client.virtual_machines.create_or_update(
    RESOURCE_GROUP_NAME,
    VM_NAME,
    vm
)

Replace <your tenant id>, <your client id>, <your client secret>, <your subscription id>, <your resource group name>, <your virtual machine name>, and <your storage account uri> with the appropriate values.

These steps will enable Performance Diagnostics for the specified Azure Virtual Machine.

Using Terraform

resource "azurerm_windows_virtual_machine" "EXAMPLE_VM" {
  name                = "REPLACE_WITH_VM_NAME"
  resource_group_name = azurerm_resource_group.EXAMPLE_RG.name
  location            = azurerm_resource_group.EXAMPLE_RG.location
  size                = "Standard_DS1_v2"
  admin_username      = "REPLACE_WITH_ADMIN_USERNAME"
  admin_password      = "REPLACE_WITH_ADMIN_PASSWORD"
  network_interface_ids = [
    azurerm_network_interface.EXAMPLE_NIC.id,
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2019-Datacenter"
    version   = "latest"
  }
}

resource "azurerm_virtual_machine_extension" "performance_diagnostics" {
  name                 = "PerformanceDiagnostics"
  virtual_machine_id   = azurerm_windows_virtual_machine.EXAMPLE_VM.id
  publisher            = "Microsoft.Azure.Performance.Diagnostics"
  type                 = "PerformanceDiagnostics"
  type_handler_version = "1.0"

  automatic_upgrade_enabled = true

  settings = jsonencode({
    # Add any PerfInsights configuration here if required by your ops team.
    # Empty settings enables the default Performance Diagnostics behavior.
  })
}

Replace:

• REPLACE_WITH_VM_NAME with the existing VM name.
• REPLACE_WITH_ADMIN_USERNAME / REPLACE_WITH_ADMIN_PASSWORD with appropriate credentials (or use admin_ssh_key for Linux and the corresponding azurerm_linux_virtual_machine plus this same azurerm_virtual_machine_extension attached to that VM’s ID).

This change adds a VM extension only; it does not replace the VM, so no outage is expected beyond the extension install operation on the running VM.

Verification: terraform plan should show a new azurerm_virtual_machine_extension.performance_diagnostics resource to be created, with no changes requiring replacement of the existing virtual machine.