How to link multiple DCRs to VMs and ARC servers?

Question

Hi all!

I have some questions about Log Analytics workspace and Data Collection Rules.

1. How to link multiple DCRs to VMs and ARC servers? I see in some diagrams that it should be possible, but using policy I don't see that it allows to set multiple DCRs
2. Performance counters in DCR have 2 different options: "Microsoft-Perf" and "Microsoft-InsightsMetrics". What is pros and cons each option? I have just found they use 2 different tables.

Best regards,

Viktor

Answer 1

Each VM or ARC server can have only one DCR applied to it directly through Azure Policy. However, you can link multiple DCRs indirectly to a VM or ARC server by leveraging Workspace Direct Agent (MDMDiagnostics) and the Log Analytics agent.

Both Microsoft-Perf and Microsoft-InsightsMetrics are options for collecting performance counters in Data Collection Rules.

Microsoft-Perf Pros:

• Directly collects performance counters from the VM or ARC server using the Perf data source.
• Provides fine-grained control over which performance counters to collect.
• Data is stored in the "Perf" table in the Log Analytics workspace. Cons:
• Requires manual configuration of each performance counter to collect.
• Can result in a larger number of records in the "Perf" table, especially if collecting a large number of performance counters.

Microsoft-InsightsMetrics Pros:

• Collects predefined sets of performance counters without the need for manual configuration.
• Provides built-in sets for common workloads such as IIS, SQL Server, and more.
• Data is stored in the "InsightsMetrics" table in the Log Analytics workspace. Cons:
• Limited customization options compared to "Microsoft-Perf."
• May not cover all specific performance counters you require.

Microsoft-Perf offers more flexibility and control over the performance counters to collect, but requires manual configuration."Microsoft-InsightsMetric provides predefined sets of performance counters for common workloads, simplifying the configuration process but with less customization options.