Log Analytics Workspace Data Not Showing Correctly from VMs

Question

Why are the logs from my virtual machines (VMs) not appearing correctly in the Log Analytics Workspace, and how can I resolve this issue?

PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.

Answer 1

The issue arises because the logs from virtual machines (VMs) are being filtered using the "Computer name" field, which in some instances does not match the actual Azure resource name. This discrepancy occurs because the "Computer name" is the hostname of the guest OS, which may differ from the Azure resource name based on your implementation.

To resolve this issue, you should filter the logs using the "resource id/name" instead of the "Computer name." By doing this, you can accurately match and find the logs corresponding to each VM in the Log Analytics Workspace. Additionally, to verify if the logs are being sent correctly, you can check the Heartbeat table for AMA agents.

For more detailed guidance, please refer to Azure Monitor log analytics sample queries

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.