Tutorial: Collect guest logs and metrics from an Azure virtual machine

To monitor the guest operating system and workloads on an Azure virtual machine, install Azure Monitor Agent and create a data collection rule (DCR) that specifies which data to collect.

In this tutorial, you learn how to:

Prerequisites

To complete this tutorial, you need an Azure virtual machine to monitor.

Create a data collection rule

Data collection rules in Azure Monitor define data to collect and where it should be sent. When you define the DCR by using the Azure portal, you specify the virtual machines it should be applied to. Azure Monitor Agent is automatically installed on any virtual machines that don't already have it.

On the Monitor menu in the Azure portal, select Data Collection Rules. Then select Create to create a new DCR.

On the Basics tab, enter a Rule Name, which is the name of the rule displayed in the Azure portal. Select a Subscription, Resource Group, and Region where the DCR and its associations are stored. These resources don't need to be the same as the resources being monitored. The Platform Type defines the options that are available as you define the rest of the DCR. Select Windows or Linux if the rule is associated only with those resources or select Custom if it's associated with both types.

Select resources

On the Resources tab, identify one or more virtual machines to which the DCR applies. Azure Monitor Agent is installed on any VMs that don't already have it. Select Add resources and select either your virtual machines or the resource group or subscription where your virtual machine is located. The DCR applies to all virtual machines in the selected scope.

Select data sources

A single DCR can have multiple data sources. For this tutorial, we use the same rule to collect both guest metrics and guest logs. We send metrics to Azure Monitor Metrics and to Azure Monitor Logs so that they can both be analyzed with metrics explorer and Log Analytics.

On the Collect and deliver tab, select Add data source. For the Data source type, select Performance counters. Leave the Basic setting and select the counters that you want to collect. Use Custom to select individual metric values.

Select the Destination tab. Azure Monitor Metrics should already be listed. Select Add destination to add another. Select Azure Monitor Logs for Destination type. Select your Log Analytics workspace for Account or namespace. Select Add data source to save the data source.

Select Add data source again to add logs to the DCR. For the Data source type, select Windows event logs or Linux syslog. Select the types of log data that you want to collect.

Select the Destination tab. Azure Monitor Logs should already be selected for Destination type. Select your Log Analytics workspace for Account or namespace. If you don't already have a workspace, you can select the default workspace for your subscription, which is automatically created. Select Add data source to save the data source.

Select Review + create to create the DCR and install the Azure Monitor agent on the selected virtual machines.

View guest metrics

You can view metrics for your host virtual machine with metrics explorer without a DCR like any other Azure resource. With the DCR, you can use metrics explorer to view guest metrics and host metrics.

Select Metrics from your virtual machine's menu. Metrics explorer opens with the scope set to your virtual machine. Select Metric Namespace > Virtual Machine Guest.

The available guest metrics are displayed. Select a metric to add to the chart.

For a tutorial on how to view and analyze metric data by using metrics explorer, see Tutorial: Analyze metrics for an Azure resource. For a tutorial on how to create metrics alerts, see Tutorial: Create a metric alert for an Azure resource.

Next steps

Recommended alerts and the VM Availability metric alert from the virtual machine host but don't have any visibility into the guest operating system and its workloads. Now that you're collecting guest metrics for the virtual machine, you can create metric alerts based on guest metrics such as logical disk space.