Azure LOG ANALYTICS Inside-Out

Connect data sources to the Azure Log Analytics workspace to ingest data from Windows and virtual machines logs, activity logs, and resource logs, using a log forwarder.

Verify VMs are connected to the log analytics workspace and sending data, using advanced settings to run a prebuilt query identifying connected Windows and Linux machines.

Configure and collect performance and event log data from Windows, Linux, and IIS servers by selecting event logs, performance counters, and optional syslog forwarding to the workspace.

Customize the query window settings in Azure Log Analytics to display a chosen time zone, enable automatic sorting of results, and set how many results per page to show.

Save queries after testing to reuse or share with others in the same workspace. Access the save option, name the query, and assign a category, such as sample, before saving.

Learn to filter results directly with a query using keywords and autocomplete, isolating the system event log, and note that queries are case sensitive.

Compare starts with and ends with in Azure Log Analytics, explain how has prefix differs by word vs whole content, and note non case sensitive behavior.

Learn to use summarize to aggregate and count events by column, such as per computer or log type, and apply average and bin for time-based charts.

Learn how to use distinct and count operators in Azure Log Analytics to project the computer column, list unique values, and count rows in the event table.

Create and use computer groups to filter queries in Azure Log Analytics, saving groups as aliasable functions and applying them to targeted machines like domain controllers and Kubernetes servers.

Explore monitoring solutions in the Azure Log Analytics workspace, where solutions collect data, provide queries and views to analyze and visualize performance, and may incur ingestion charges.

Delete a solution from the right workspace by opening its overview page and clicking delete here, removing the solution from the workspace and requiring reinstallation to access it again.

Explore installing a monitoring solution via the solutions marketplace in the log analytics workspace, filter by your workspace, view dashboards, and deploy a chosen solution.

Learn to target log analytics solutions with scope configurations by selecting computer groups, creating a scope, and applying it to supported solutions to restrict targets.

Explore how service map automatically discovers components on Windows and Linux, maps interservice communications, and shows connections, latency, and port use across TCP-based architectures with a single dependency agent.

Install the service map dependency agent by downloading the Linux or Windows agent and running the installer. The service agent installs quickly, with the analytics agent also required.

Create and view mission groups to map up to ten servers in a multi-tier application, then add machines to existing or new groups via the groups tab.

Learn to identify and troubleshoot failed connections in service map, view the target server IP, and quickly diagnose issues with a seven- to thirty-day history.

Navigate the Azure Log Analytics map by selecting a system from the left pane, then click the three dots and load server map to change focus and load Studio ten.

Examine the machine summary to view a server OS, dependencies, and performance metrics, then use service map for context on machines, DNS, IPs, CPU, memory, VM type, and OS version.

Get process details from the operating system and metadata, including process name and description, to identify rogue or unexpected processes; the summary pane provides connectivity and failed connections information.

Explore service map in Azure log analytics to identify server issues using centralized investigation options. See changes, tracking, and updates in one easy-to-consume interface for streamlined troubleshooting.

Enable the change tracking solution in Azure Log Analytics by adding it to a workspace and linking an automation account to monitor software changes across Windows and Linux systems.

Learn to extend Azure change tracking by enabling registry locations, Windows and Linux files, and file content monitoring with folder recursion and custom paths, plus Windows services frequency settings.

Learn how to modify a tracked Linux file and verify the change in Azure Log Analytics change tracking, with updates appearing roughly every 15 minutes.

Inventory provides an accessible view of change tracking data that shows the same information: installed software, services and their status, tracked files, and registry, all in one click.

Configure Azure Log Analytics alerts by using a query to detect more than five failed logons in the last 30 minutes and trigger email notifications via an action group.