Update data-collection-troubleshoot.md

Author: guywi-ms

articles/azure-monitor/logs/data-collection-troubleshoot.md

@@ -15,7 +15,7 @@ This article explains how to detect when data collection in Azure Monitor stops
 
 The [daily cap](daily-cap.md) limits the amount of data that a Log Analytics workspace can collect in a day. When the daily cap is reached, data collection stops until the reset time. You can either wait for collection to automatically restart, or increase the daily data volume limit.
 
-### How to check the data collection status
+### Check Log Analytics workspace data collection status
 
 When data collection in a Log Analytics workspace stops, an event with a type of **Operation** is created in the workspace. Run the following query to check whether you're reaching the daily limit and missing data: 
 
@@ -30,27 +30,45 @@ To be notified when data collection stops, use the steps described in the [Alert
 ## Daily ingestion limitation in the legacy free pricing tier 
 If your Log Analytics workspace is in the [legacy Free pricing tier](cost-logs.md#legacy-pricing-tiers) and has collected more than 500 MB of data in a day, data collection stops for the rest of the day. Wait until the following day for collection to automatically restart, or change to a paid pricing tier.
 
-## Workspace reached the data ingestion volume rate
-The [default ingestion volume rate limit](../service-limits.md#log-analytics-workspaces) for data sent from Azure resources using diagnostic settings is approximately 6 GB/min per workspace. This is an approximate value because the actual size can vary between data types, depending on the log length and its compression ratio. This limit doesn't apply to data that's sent from agents or the [Data Collector API](data-collector-api.md). 
+## Workspace reached the data ingestion volume rate limit
+The [default ingestion volume rate limit](../service-limits.md#log-analytics-workspaces) for data sent from Azure resources using diagnostic settings is approximately 6 GB/min per workspace. This is an approximate value because the actual size can vary between data types, depending on the log length and its compression ratio. This limit doesn't apply to data that's sent from agents or the [Logs ingestion API](logs-ingestion-api-overview.md). 
 
-If you send data at a higher rate to a single workspace, some data is dropped, and an event is sent to the **Operation** table in your workspace every 6 hours while the threshold continues to be exceeded. If your ingestion volume continues to exceed the rate limit or you are expecting to reach it sometime soon, you can request an increase to your workspace by sending an email to [email protected] or by opening a support request. 
+If you send data at a higher rate to a single workspace, some data is dropped, and an event is sent to the **Operation** table in your workspace every six hours while the threshold continues to be exceeded. If your ingestion volume continues to exceed the rate limit or you are expecting to reach it sometime soon, you can request an increase to your workspace by sending an email to [email protected] or by opening a support request. 
 
-Use the following query to retrieve the record that indicates the data ingestion rate limit was reached.
+### Check whether your workspace reached its data ingestion rate limit
+
+Use this query to retrieve the record that indicates the data ingestion rate limit was reached.
 
 ```kusto
 Operation 
 | where OperationCategory == "Ingestion" 
 | where Detail startswith "The rate of data crossed the threshold"
 ```
 
+## Azure Monitor Agent is not sending data
+
+[Azure Monitor Agent](../agents/azure-monitor-agent-overview.md) collects data from virtual machines and sends the data to Azure Monitor. An agent might stop sending data to your Log Analytics workspace in various scenarios. For example, when [Azure Site Recovery](/azure/site-recovery/site-recovery-overview) recovers a virtual machine in a disaster recovery scenario, the resource ID of the machine changes, requiring reinstallation of Azure Monitor Agent on the machine.
+
+### Check the health of agents sending data to your workspace
+
+Azure Monitor Agent instances installed on all virtual machines that send data to your Log Analytics workspace send a heartbeat to the [Heartbeat table](/azure/azure-monitor/reference/tables/heartbeat) every minute.
+
+Run this query to list VMs that have not reported a heartbeat in the last five minutes:
+
+```kusto
+Heartbeat 
+| where TimeGenerated > ago(24h)
+| summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
+| where LastCall < ago(5m)
+```
+
 ## Azure subscription is in a suspended state 
 Your Azure subscription could be in a suspended state for one of the following reasons:
 
 - Free trial ended
 - Azure pass expired
 - Monthly spending limit reached (such as on an MSDN or Visual Studio subscription)
 
-
 ## Other Log Analytics workspace limitations
 
 There are other Log Analytics limits, some of which depend on the Log Analytics pricing tier. These are documented at [Azure subscription and service limits, quotas, and constraints](../service-limits.md#log-analytics-workspaces).