Exercise - Set up a Log Analytics workspace and Azure Monitor VM Insights


From the previous unit, recall that you need to explore Azure native monitoring tools for your company. To further your knowledge, you'll need to know how to provision a Log Analytics workspace with the right permissions model. Then, you'll configure Azure Monitor VM Insights to complete the process.

In this unit, you'll:

  1. Create a Log Analytics workspace.
  2. Configure the Log Analytics workspace permissions model for the environment you're supporting.
  3. Create two virtual machines and onboard both to Azure Monitor VM Insights.

Create and configure a Log Analytics workspace

  1. Sign in to the Azure portal with the same account you used to activate the sandbox.

  2. In the Search bar, search for and select Log Analytics Workspaces.

  3. Select the Create button in the toolbar.

  4. Enter the following values to build the Log Analytics workspace. For the Log Analytics workspace name, we suggest that you use your initials and numbers. For this module, we'll use the name xxxx-log-analytics.

    Screenshot of declaring the Log Analytics resource name, placing everything in the Concierge Subscription for Learn, and selecting Review + Create.

    Property Value
    Subscription Concierge Subscription
    Resource group [sandbox resource group name]
    Name xxxx-log-analytics
    Region Select the region closest to you.
  5. Select Review + Create, then select Create.

  6. After the resource deploys, select Go to resource.

  7. In the left menu, select Properties under Settings.

  8. Look for the access control mode and ensure it's set to Use resource or workspace permissions. This setting changes the access mode to use the resource-context.

    Screenshot of changing access control mode for Log Analytics workspace.

Set up your environment

  1. Run the following command in Azure Cloud Shell:

    az vm create \
      --resource-group <rgn>[sandbox resource group name]</rgn> \
      --location westus \
      --name SampleVM1 \
      --image UbuntuLTS \
      --admin-username azureuser \
      --generate-ssh-keys \
  2. After SampleVM1 finishes, run the following command in Azure Cloud Shell:

    az vm create \
      --resource-group <rgn>[sandbox resource group name]</rgn> \
      --location westus \
      --name SampleVM2 \
      --image UbuntuLTS \
      --admin-username azureuser \
      --generate-ssh-keys \

Onboard virtual machines to Azure Monitor VM Insights

  1. In the Azure portal, search for and select Virtual machines.

  2. Select SampleVM1.

  3. In the left menu under Monitoring, select Insights, then select the Enable button.

  4. Select the radio button for Log Analytics agent, then select the Log Analytics workspace you created in the Log Analytics workspaces drop-down.

  5. Select Configure.

    Enable Azure Monitor VM Insights after selecting the right subscription and Log Analytics workspace.

  6. Repeat the same steps for SampleVM2.

  7. Wait 5 to 10 minutes.

  8. In the left menu under Monitoring > Insights, select Refresh until you get results.

  9. Select the Map tab to review the map, which displays dependencies like processes running, ports open, connection details, health of the virtual machine, machine properties, and Azure virtual machine properties.

    Screenshot of Azure Monitor map, showcasing dependencies and information about virtual machine.

  10. Select the Performance tab.

    Screenshot of performance after enabling Azure Monitor VM Insights.

  11. Explore the different graphs for:

    • Logical Disk Performance
    • CPU Utilization
    • Available Memory
    • Logical Disk IOPS
    • Logical Disk MB/s
    • Logical Disk Latency (ms)
    • Max Logical Disk Used %
    • Bytes Sent Rate
    • Bytes Received Rate
  12. Experiment with different settings by moving from Avg, to Min, to Max, and so on. The virtual machines were created only a few minutes ago, so there might not be much data generated.

  13. Select Log Events. You might need to expand the Property panel on the right.

    Screenshot of where Log Events show up within Azure Monitor VM Insights.

  14. Select the InsightsMetrics row in the table.

    Screenshot after selecting Log Events from the Azure Monitor VM Insights pane.

  15. The logs section of a Log Analytics workspace opens with a prepopulated query showing the data being collected.

    Screenshot after selecting the InsightsMetrics table and Log Analytics opens up for further query writing.