Azure LOG ANALYTICS Inside-Out

Create a log analytics workspace in the Azure portal by naming it uniquely, assigning a resource group and location, selecting a pricing tier, and deploying the workspace.

Connect data sources to the Azure Log Analytics workspace to ingest data from Windows and virtual machines logs, activity logs, and resource logs, using a log forwarder.

Learn how to onboard a Linux virtual machine to the log analytics workspace by using the Linux agent, with ready-to-run commands to download and configure the agent for reporting.

Verify VMs are connected to the log analytics workspace and sending data, using advanced settings to run a prebuilt query identifying connected Windows and Linux machines.

Run your first query in the workspace using the query window, select a table, and apply filters to view heartbeat data and sample records.

Configure and collect performance and event log data from Windows, Linux, and IIS servers by selecting event logs, performance counters, and optional syslog forwarding to the workspace.

Customize the query window settings in Azure Log Analytics to display a chosen time zone, enable automatic sorting of results, and set how many results per page to show.

Save queries after testing to reuse or share with others in the same workspace. Access the save option, name the query, and assign a category, such as sample, before saving.

Load saved queries by opening the query explorer, selecting saved queries, choosing category sample, and loading your previously saved query back into the query window.

Master basic queries in Azure log analytics by examining event table, using autocomplete and pipe searches to find errors, and refining results with user interface filters and time ranges.

Learn to filter results directly with a query using keywords and autocomplete, isolating the system event log, and note that queries are case sensitive.

Explore string operators in log analytics, using equal to and not equals for case sensitive comparisons. Switch to case insensitive queries to capture all string variants and improve search results.

Explains the contains keyword for partial word matching in Azure Log Analytics, distinguishing it from has, which does whole-word matching, and shows how contains matches anywhere.

Compare starts with and ends with in Azure Log Analytics, explain how has prefix differs by word vs whole content, and note non case sensitive behavior.

Learn how to filter log data by TimeGenerated in Azure Log Analytics, using ago, now minus, and between syntax, with date time and UTC considerations for precise time ranges.

Learn to use summarize to aggregate and count events by column, such as per computer or log type, and apply average and bin for time-based charts.

Learn how to use distinct and count operators in Azure Log Analytics to project the computer column, list unique values, and count rows in the event table.

Learn how to speed up Azure Log Analytics queries by using the top keyword with time generated to retrieve the latest 100 records, instead of sorting all 10,000 rows.

Create and use computer groups to filter queries in Azure Log Analytics, saving groups as aliasable functions and applying them to targeted machines like domain controllers and Kubernetes servers.

Connect syslog data to an Azure Log Analytics workspace by configuring syslog daemons and facilities to send kernel, user, and authentication events.

Explore monitoring solutions in the Azure Log Analytics workspace, where solutions collect data, provide queries and views to analyze and visualize performance, and may incur ingestion charges.

List marketing solutions in Azure log analytics by navigating to the solutions option, opening view, and adding from marketplace with filters for publisher, operating system, and free or paid.

Deploy the Azure log analytics agent health solution to the correct workspace and select the Azure Activity Log Analytics solution to gain insights on activity status, trends, and outages.

Open the agent health solution from the solutions menu to view the agent health summary and detailed heartbeat dashboard, and learn how to delete or reinstall the solution.

Delete a solution from the right workspace by opening its overview page and clicking delete here, removing the solution from the workspace and requiring reinstallation to access it again.

Explore installing a monitoring solution via the solutions marketplace in the log analytics workspace, filter by your workspace, view dashboards, and deploy a chosen solution.

Learn to target log analytics solutions with scope configurations by selecting computer groups, creating a scope, and applying it to supported solutions to restrict targets.

Explore how service map automatically discovers components on Windows and Linux, maps interservice communications, and shows connections, latency, and port use across TCP-based architectures with a single dependency agent.

Add the service map solution to your workspace by using the marketplace, searching for service map, and selecting create; monitor deployment, then enable it in the workspace solutions.

Install the service map dependency agent by downloading the Linux or Windows agent and running the installer. The service agent installs quickly, with the analytics agent also required.

Access Azure service map from the Azure portal via the Log Analytics workspace, then view the summary tile to count machines with the dependency agent sending data.

Explore the service map basic user interface to view server dependencies, zoom the machine dependency map, and drill into processes with active network connections within a chosen time range.

Use the time controls to view dependency maps up to one hour for incident investigation, with data stored for 30 days in paid workspaces and seven days in free workspaces.

Create and view mission groups to map up to ten servers in a multi-tier application, then add machines to existing or new groups via the groups tab.

Learn to identify and troubleshoot failed connections in service map, view the target server IP, and quickly diagnose issues with a seven- to thirty-day history.

Navigate the Azure Log Analytics map by selecting a system from the left pane, then click the three dots and load server map to change focus and load Studio ten.

Show self links to reveal TCP connections that start and end on a server process, and use the toggle to hide them later; posts shown communicate only from within server.

Examine the machine summary to view a server OS, dependencies, and performance metrics, then use service map for context on machines, DNS, IPs, CPU, memory, VM type, and OS version.

Get process details from the operating system and metadata, including process name and description, to identify rogue or unexpected processes; the summary pane provides connectivity and failed connections information.

Explore service map in Azure log analytics to identify server issues using centralized investigation options. See changes, tracking, and updates in one easy-to-consume interface for streamlined troubleshooting.

Enable the change tracking solution in Azure Log Analytics by adding it to a workspace and linking an automation account to monitor software changes across Windows and Linux systems.

Explore the change tracking solution in Azure Log Analytics to monitor and audit software installations, Windows services, Linux daemons, files, and registry for change management and troubleshooting.

Learn to extend Azure change tracking by enabling registry locations, Windows and Linux files, and file content monitoring with folder recursion and custom paths, plus Windows services frequency settings.

Learn how to modify a tracked Linux file and verify the change in Azure Log Analytics change tracking, with updates appearing roughly every 15 minutes.

Inventory provides an accessible view of change tracking data that shows the same information: installed software, services and their status, tracked files, and registry, all in one click.

Configure Azure Log Analytics alerts by using a query to detect more than five failed logons in the last 30 minutes and trigger email notifications via an action group.