Introduction.
Effective monitoring is a critical aspect of managing cloud resources, enabling administrators to gain visibility into system performance, troubleshoot issues proactively, and optimize resource utilization. Azure Monitor, together with Log Analytics, provides a centralized platform for collecting, analyzing, and visualizing telemetry data from Azure resources. By leveraging the Azure Monitor Agent (AMA) and Data Collection Rules (DCRs), organizations can efficiently collect performance data while maintaining flexibility and scalability in their monitoring strategy.
In this exercise, I created a Log Analytics workspace, configured and deployed the Azure Monitor Agent to a Linux virtual machine using a Data Collection Rule, verified successful data ingestion through Kusto Query Language (KQL), configured data retention and daily ingestion limits, and implemented role-based access control (RBAC) to securely manage access to the Log Analytics workspace.
Create a Log Analytics workspace
- In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.
- On the Log Analytics workspaces page, choose Create.
- On the Basics page of the Create Log Analytics workspace wizard, provide the following information and choose Review + Create.
- Choose Review + Create.
- Review the information and choose Create.
Install and configure the Azure Monitor Agent on Linux-VM using a Data Collection Rule.
- In the Azure Portal, enter Data Collection Rules in the search bar and select Data Collection Rules from the results.
- Select + Create to start a new data collection rule.
- On the Basics page, provide the following:
- Under Resources, select + Add resources
- Search for and select Linux-VM.
- Select Apply.
- Select Next: Collect and deliver >
- In the Collect and deliver tab:
- Select + Add data source.
- For Data source type, choose Performance Counters.
- Select Next: Destination >.
- Select + Add destination.
- Under Destination type choose Azure Monitor Logs.(In the newer Azure Portal UI, Microsoft renamed the destination from Azure Monitor Logs to Log Analytics Workspaces.)
- Under Destination Details choose LogAnalytics1 (rg-alpha)
- Select Add data source.
- Select Next: Review + create
Verify agent installation and data ingestion:
- In the Azure Portal, use the search bar to search for Log Analytics workspaces and select it from the results.
- In the list of workspaces, select LogAnalytics1.
- In the left-hand menu of the LogAnalytics1 workspace, select Logs.
- Use the mode drop-down to change from Simple mode to KQL mode.
- In the query window, enter the following query
- Select Run or press Shift + Enter to execute the query.
- If results are returned, data is flowing and the Azure Monitor Agent is working.
Configure Log Analytics data retention and archive policies.
- In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.
- On the Log Analytics workspaces page, choose LogAnalytics1.
- On the Log Analytics workspace page for LogAnalytics1, under Settings, choose Usage and estimated costs.
- Select Data Retention and set the slider to 60 days. Select OK.
- On the Log Analytics workspace page for LogAnalytics1, choose Usage and estimated costs.
- Select Daily cap. Select On. Set the daily cap to 10 GB and select OK.
Enable access to a Log Analytics workspace.
- In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.
- On the Log Analytics workspaces page, choose LogAnalytics1.
- Select Access control (IAM).
- Choose Add and then choose Add role assignment.
- On the list of roles, select Log Analytics Reader and choose Next.
- On the Members page, choose Select Members and choose the App Log Examiners security group. Choose Select.
- On the Members step, choose Review + Assign.
Conclusion.
This exercise demonstrated the complete process of implementing centralized monitoring for Azure resources using Azure Monitor and Log Analytics. By successfully deploying the Azure Monitor Agent, configuring a Data Collection Rule, and verifying data ingestion through KQL queries, I confirmed that monitoring data was flowing correctly into the Log Analytics workspace. Additionally, configuring data retention policies, setting daily ingestion limits, and assigning appropriate RBAC permissions ensured that the monitoring solution was both cost-effective and secure. These configurations provide a strong foundation for proactive monitoring, operational visibility, and effective cloud resource management within Azure environments.
Top comments (1)
This lab provided valuable hands-on experience with Azure Monitor and Log Analytics, reinforcing the importance of centralized monitoring in cloud environments. One notable difference I observed was that the current Azure Portal interface has evolved from the original Microsoft Learning lab. For example, Azure Monitor Logs is now displayed as Log Analytics Workspaces, and some configuration steps, such as Data Collection Rules and Azure Monitor Agent deployment, have slightly changed in the newer portal experience. Despite these interface differences, the core concepts and implementation process remain the same. Successfully retrieving heartbeat records from the Linux virtual machine confirmed that the Azure Monitor Agent was installed correctly and that telemetry data was being collected and ingested into the Log Analytics workspace as expected. This exercise also emphasized the importance of balancing monitoring capabilities with governance by configuring retention policies, daily data caps, and role-based access control.