No Heartbeat events in Log Analytics Workspace

Question

No Heartbeat events in Log Analytics Workspace
follwed the below steps to start creating logs

1. created AMA
2. created DCR
3. Create Log analytics space
4. added Datasource and Resource in DCR, and associated destination work space
5. enabled system identity for auth
6. confirmed AMA package is available in VM

Answer 1

Hello Srikanth Y, It looks like you're not seeing any Heartbeat events in your Log Analytics Workspace after following all the right steps. The Heartbeat table in Log Analytics is empty, even though AMA is installed and DCR is associated. Heartbeat is emitted automatically once per minute If Heartbeat is missing it means AMA is not operational currently.

This may happen because of below reason:

AMA Core Process Not Running: amaexthealthmonitor.exe may run but MonAgentCore.exe does not start. This results No Heartbeat, no logs.

Managed Identity Permission Gap: System Assigned Identity must have Log Analytics Contributor on the workspace. Without it, AMA installs but sends zero data.

Region Mismatch: DCR and Log Analytics Workspace must be in the same region. Mismatch prevents data ingestion.

Outbound Network Block: AMA must reach Azure Monitor endpoints over TCP 443. Firewall / proxy blocks cause silent failure.

To resolve this issue, follow the steps below:

1. Validate Heartbeat: Run in Log Analytics:

Heartbeat
| summarize LastHeartbeat = max(TimeGenerated) by Computer
Show more lines

If No rows then, agent is not healthy.

1. Verify AMA Extension State: Go to Azure Portal > Select VM > Extensions + applications as AzureMonitorWindowsAgent and Status must be “Provisioning succeeded”
2. Verify AMA Processes on VM: Go to Azure Portal > Select VM > under the operation select Run command > select RunPowerShellScript > then run the below command. 

      Get-Process | Where-Object {
      $_.ProcessName -match "AzureMonitor" -or $_.ProcessName -match "MonAgent"
      }
   

See that MonAgentCore.exe must be running. Amaexthealthmonitor.exe running alone is not sufficient, If MonAgentCore.exe is missing mean Heartbeat will never appear.

Also you can verify in your VM . Login to VM then open Task Manager and check if 'MonAgentCore.exe' process is running. If it is, wait for 5 minutes for heartbeat to show up. If not, check if you see any errors in core agent logs located at C:\WindowsAzure\Resources\AMADataStore.<virtual-machine-name>\Configuration on your machine

3. Validate DCR Configuration: confirm the Log Analytics Workspace added as destination, VM explicitly added as resource and DCR region is equal to Workspace region. Heartbeat requires only this (no extra data sources).
4. Confirm Managed Identity Permissions: On the Log Analytics Workspace. Assign Log Analytics Contributor to VM’s System Assigned Identity/. Without this, AMA installs but produces no data.
5. Verify the AMA connection: To ensure that the agent is properly installed and connected based on OS.

• Windows: How to use the Windows operating system (OS) Azure Monitor Agent Troubleshooter - Azure Monitor | Microsoft Learn.
• Linux: How to use the Linux Operating System (OS) Azure Monitor Agent Troubleshooter - Azure Monitor | Microsoft Learn

Hope this helps. and please feel free to reach out if you have any further questions. Thanks