AZ-104

Deep Dive

Back to guides
All guides
Practice now
D5 · Monitoring

Log Analytics

Log Analytics is 's log analysis engine. The AZ-104 exam evaluates workspace configuration, basic KQL queries, important tables and the agent configuration for collecting data from VMs.

Contents

Log Analytics Workspace

A is the storage and query environment for logs in Azure Monitor. It's a regional resource where data from multiple Azure resources, VMs and solutions is centralized.

What is stored

  • •Activity Logs sent via Diagnostic Settings
  • •Resource Logs (resource diagnostics)
  • •Azure Monitor Agent data from VMs
  • •Application Insights (workspace-based)
  • •Microsoft Sentinel (SIEM)
  • •Data from

Design — how many workspaces

  • •A centralized workspace: easy to manage, cross-subscription queries
  • •Multiple workspaces: separation by team/region/environment, data sovereignty compliance
  • •Microsoft recommendation: centralized unless isolation requirements apply
  • •Cross-region limitations: the workspace can be in the same or a different region — no technical restriction, but egress has a cost

Key configuration

  • •Retention: 30 days (default), configurable 30-730 days (beyond that: Basic or Archive tier)
  • •Commitment tiers: discount for committed volume (100 GB/day, etc.)
  • •Table-level RBAC: granular control of which table each user/group can see
  • •Purge data: delete specific data for compliance
  • •Workspace replication (preview): workspace redundancy across regions

KQL — Kusto Query Language

KQL (Kusto Query Language) is Log Analytics' query language. It's a read-only, pipeline-oriented language — data flows from left to right through operators chained with the pipe |.

Fundamental KQL operators

whereFilters rows by condition
projectSelects/renames columns
summarizeAggregates data (count, avg, sum...)
order by / sort bySorts results
top NReturns the top N results
extendAdds calculated columns
joinJoins two tables
unionCombines rows from multiple tables
renderVisualizes as a chart (timechart, piechart...)
ago()Time function: ago(1h), ago(7d)

Example KQL queries

// VMs with CPU above 90% in the last hour

Perf

| where TimeGenerated > ago(1h)

| where ObjectName == "Processor"

| where CounterName == "% Processor Time"

| where CounterValue > 90

| summarize avg(CounterValue) by Computer

// Errors in Azure Activity Log in the last 24h

AzureActivity

| where TimeGenerated > ago(24h)

| where Level == "Error"

| project TimeGenerated, Caller, OperationName, ResourceGroup

| order by TimeGenerated desc

// Top 10 IPs with the most denied connections

AzureNetworkAnalytics_CL

| where FlowStatus_s == "D"

| summarize count() by SrcIP_s

| top 10 by count_

Important tables in Log Analytics

TableContentSource
AzureActivityControl-plane operations (create/update/delete of resources, RBAC changes)Activity Log (automatic)
HeartbeatAgent heartbeat: confirms the agent on the VM is activeAzure Monitor Agent
PerfOS performance metrics (CPU, memory, disk, network)Azure Monitor Agent
EventWindows Event Log events (System, Application, Security)Azure Monitor Agent (Windows)
SyslogLinux system logs (syslog, auth, daemon, etc.)Azure Monitor Agent (Linux)
SecurityEventWindows security events (login, policy change, account mgmt)Defender for Cloud / Sentinel
AzureDiagnosticsDiagnostic logs from multiple Azure resources (Legacy — catch-all table)Diagnostic Settings
StorageBlobLogsOperations on blobs (read, write, delete)Diagnostic Settings on Storage
AzureNetworkAnalytics_CLAnalysis of NSG Flow Logs processed by Traffic AnalyticsTraffic Analytics
SigninLogsSign-in logs from Entra ID Diagnostic Settings
AuditLogsChanges in Entra ID (users, groups, apps, roles)Entra ID Diagnostic Settings
requests / exceptions / tracesApplication Insights telemetryApplication Insights SDK

Azure Monitor Agent (AMA)

The Azure Monitor Agent (AMA) is the modern unified agent for collecting data from VMs (OS metrics, event logs, syslog). It replaces the legacy MMA (Microsoft Monitoring Agent / Log Analytics Agent) and Diagnostics Extension agents.

AMA characteristics

  • • Supports Windows and Linux
  • • Requires a Managed Identity on the VM (system-assigned)
  • • Configuration via Data Collection Rules (DCR) — not on the agent
  • • Can send to multiple workspaces simultaneously
  • • Supports Azure Arc (on-premises machines and other clouds)
  • • Replaces: MMA, OMS agent, Diagnostics Extension (WAD/LAD)

Legacy agents (being deprecated)

MMA / Log Analytics Agent

Deprecated — end of support August 2024. Migrate to AMA.

Diagnostics Extension (WAD/LAD)

Sends guest OS metrics to Azure Monitor Metrics (not directly to Log Analytics). Can be used together with AMA.

Data Collection Rules (DCR)

Data Collection Rules (DCR) are Azure resources that define what data to collect, how to transform it, and to which destinations to send it. They're the AMA's configuration mechanism — decoupling the agent's configuration.

Data Sources

What to collect

  • •Windows Event Logs (channels and levels)
  • •Linux Syslog (facilities and levels)
  • •Performance counters (CPU, memory, disk...)
  • •IIS Logs
  • •Custom logs (text, JSON)

Data Flows

Optional transformations

  • •KQL transformation: filter, parse, enrich data in transit
  • •Reduces data volume before it reaches the workspace
  • •Useful for filtering low-value data and cutting costs

Destinations

Where to send it

  • •Log Analytics Workspace(s)
  • •Azure Monitor Metrics (guest OS metrics)
  • •Event Hub (streaming)
  • •Storage Account (archiving)
  • •Multiple destinations simultaneously

Retention and cost model

TierRetentionQueryableCostUse
Interactive (Analytics)30-730 daysYes — full KQLPer GB ingested + extra days 31-730Active operational data
Basic Logs8 daysLimited — simple queries onlyMuch cheaper per ingestionHigh-volume, low-value logs (verbose logs)
ArchiveUp to 12 yearsNot direct — requires a Search JobVery cheap per storageLong retention for compliance/auditing

Ingestion pricing model

  • • Pay-as-you-go: price per GB ingested. No commitment.
  • • Commitment Tiers: 100, 200, 300, 400, 500, 1000, 2000, 5000 GB/day. Up to 30% discount vs. pay-as-you-go.
  • • Free tier: first 5 GB/month per subscription free.
  • • Retention: the first 31 days are included. Days 32-730: additional cost per GB/day.

Free data in Log Analytics

  • • Azure Activity Log — no ingestion cost
  • • Microsoft Defender for Cloud security data — no cost
  • • — first 31 days of certain types
  • • Application Insights SDK data — first 5 GB/month free per resource

Did you get this topic?

Test what you just learned

Which Log Analytics table contains the heartbeats of the Azure Monitor Agents installed on VMs, letting you verify that they are active?

Ready to test "Log Analytics"?

Put what you learned to the test with original AZ-104 exam questions.

Start AZ-104 mock exam

Unlimited mock exams with the Pro plan

Log in to track your progress.

PreviousAzure MonitorMonitoringNextAlerts and NotificationsMonitoring