This blog post will go through the process of creating an Azure Log Analytics workspace and connecting a test azure virtual server to the Log Analytics workspace. We will then setup the work space to collect System event logs from the test Azure VM.
1) Login to the Azure Portal
2) Search and select Log Analytics workspaces
3) Click Create Log Analytics workspace
4) Configure:
– Give your new Log Analytics workspace a name
– Select your subscription
– Select a Resource Group
– Select Location
– Pricing Tier (Only one pricing Tier exists as of the year 2018). At the time of writing this blog post, the one available Tier was named Pay-as-you-go (Per GB 2018)
5) Click OK
6) Now that you have created your Log Analytics workspace, let’s join a VM to this new work space
Note that adding servers to the work space will automatically deploy a monitoring extension (agent) to the server
7) Click your new Log Analytics workspace
8) From the left pane under Workspace Data Sources, click Virtual Machines. As you can see from the screenshot, you can also connect other resources to your workspace
Note: Workspaces work across different regions, so you could add servers to a workspace no matter what region they are located in.
9) As you can see from the right pane, I have two virtual servers and the Log Analytics Connection is showing as not connected
10) Click a VM you wish to add to this work space (Ensure the VM is powered on)
11) As you can see from the below screen shot, the server is not connected to the work space, but we have the option to connect.
12) Click Connect
13) Wait for the virtual server to connect (A monitoring agent (Extension) is being deployed to the virtual server)
14) Now that the machine is connected to your workspace, the status is displayed as below. If you wish to disconnect, click disconnect.
Note: Now that the extension agent is deployed, you will find that the monitoring agent has been deployed to the VM. Locate the VM under virtual machines and click extensions from the left pane. The screenshot below shows the MicrosoftMonitoringAgent has been provisioned successfully.
15) If we go back to our workspace, we’ll find the server is now showing as a connection of this workspace along with a green tick.
16) Now, let’s enable logging for this workspace. Note that these logs will apply for all resources attached to this resource, so if you have different logging requirements for different resources, create different work spaces. You could also complete this step straight after the Logs Analytics Workspace has been deployed.
17) Click on your Log Analytics Workspace, and click Advanced Settings from the left pane.
18) The screen below will appear
Note: If you wish to connect physical servers to your Log Analytics Workspace, you can do so by downloading the required agent.
19) Click Data
20) A few different options appear which may be of interest to you. For this demo let’s click Windows Event Logs. Click the plus icon (blue box) to the right of the screen
21) For this demo, we will monitor the system logs, type system into the text box, select system and click the plus icon located within the blue box.
22) All logs are selected by default. You can select the logs as per your requirements.
23) Click Save and OK
Hope this helps 🙂
