Skip to content

Commit 1c082cf

Browse files
ttorblettorble
authored
Merge pull request #266783 from v-thepet/vms-monitor
Azure Monitor horizontals - Azure Virtual Machines
2 parents 0bce58b + ba5e081 commit 1c082cf

File tree

3 files changed

+186
-109
lines changed

3 files changed

+186
-109
lines changed

‎articles/virtual-machines/TOC.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1946,9 +1946,9 @@
19461946
href: ./windows/tutorial-config-management.md
19471947
- name: Monitoring
19481948
items:
1949-
- name: Monitor virtual machines
1949+
- name: Monitor
19501950
href: monitor-vm.md?toc=/azure/virtual-machines/toc.json
1951-
- name: Monitor virtual machine reference
1951+
- name: Monitoring data reference
19521952
href: monitor-vm-reference.md?toc=/azure/virtual-machines/toc.json
19531953
- name: Availability with Resource Graph
19541954
href: resource-graph-availability.md

‎articles/virtual-machines/monitor-vm-reference.md

Lines changed: 76 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,92 @@
11
---
2-
title: 'Reference: Monitoring Azure virtual machine data'
3-
description: This article covers important reference material for monitoring Azure virtual machines.
4-
ms.service: virtual-machines
5-
ms.custom: subject-monitoring
6-
ms.date: 12/03/2022
2+
title: Monitoring data reference for Azure Virtual Machines
3+
description: This article contains important reference material you need when you monitor Azure Virtual Machines.
4+
ms.date: 03/27/2024
5+
ms.custom: horz-monitor
76
ms.topic: reference
7+
ms.service: virtual-machines
88
---
99

10-
# Reference: Monitoring Azure virtual machine data
11-
12-
For more information about collecting and analyzing monitoring data for Azure virtual machines (VMs), see [Monitoring Azure virtual machines](monitor-vm.md).
13-
14-
## Metrics
10+
# Azure Virtual Machines monitoring data reference
1511

16-
This section lists the platform metrics that are collected for Azure virtual machines and Virtual Machine Scale Sets.
12+
[!INCLUDE [horz-monitor-ref-intro](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-intro.md)]
1713

18-
| Metric type | Resource provider / type namespace<br/> and link to individual metrics |
19-
|-------|-----|
20-
| Virtual machines | [Microsoft.Compute/virtualMachines](../azure-monitor/essentials/metrics-supported.md#microsoftcomputevirtualmachines) |
21-
| Virtual Machine Scale Sets | [Microsoft.Compute/virtualMachineScaleSets](../azure-monitor/essentials/metrics-supported.md#microsoftcomputevirtualmachinescalesets)|
22-
| Virtual Machine Scale Sets and virtual machines | [Microsoft.Compute/virtualMachineScaleSets/virtualMachines](../azure-monitor/essentials/metrics-supported.md#microsoftcomputevirtualmachinescalesetsvirtualmachines)|
14+
See [Monitor Azure Virtual Machines](monitor-vm.md) for details on the data you can collect for Azure Virtual Machines and how to use it.
2315

24-
For more information, see a list of [platform metrics that are supported in Azure Monitor](/azure/azure-monitor/platform/metrics-supported).
16+
[!INCLUDE [horz-monitor-ref-metrics-intro](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-metrics-intro.md)]
2517

26-
## Metric dimensions
18+
>[!IMPORTANT]
19+
>Metrics for the guest operating system (guest OS) that runs in a virtual machine (VM) aren't listed here. Guest OS metrics must be collected through one or more agents that run on or as part of the guest operating system. Guest OS metrics include performance counters that track guest CPU percentage or memory usage, both of which are frequently used for autoscaling or alerting.
20+
>
21+
>Host OS metrics are available and listed in the following tables. Host OS metrics relate to the Hyper-V session that's hosting your guest OS session. For more information, see [Guest OS and host OS metrics](/azure/azure-monitor/reference/supported-metrics/metrics-index#guest-os-and-host-os-metrics).
2722
28-
For more information about metric dimensions, see [Multi-dimensional metrics](../azure-monitor/essentials/data-platform-metrics.md#multi-dimensional-metrics).
23+
### Supported metrics for Microsoft.Compute/virtualMachines
24+
The following table lists the metrics available for the Microsoft.Compute/virtualMachines resource type.
2925

30-
Azure virtual machines and Virtual Machine Scale Sets have the following dimensions that are associated with their metrics.
26+
[!INCLUDE [horz-monitor-ref-metrics-tableheader](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-metrics-tableheader.md)]
27+
[!INCLUDE [Microsoft.Compute/virtualMachines](~/azure-reference-other-repo/azure-monitor-ref/supported-metrics/includes/microsoft-compute-virtualmachines-metrics-include.md)]
3128

32-
| Dimension name | Description |
33-
| ------------------- | ----------------- |
34-
| LUN | Logical unit number |
35-
| VMName | Used with Virtual Machine Scale Sets |
36-
37-
## VM availability metric (preview)
29+
### VM availability metric (preview)
3830
The VM availability metric is currently in public preview. This metric value indicates whether a machine is currently running and available. You can use the metric to trend availability over time and to alert if the machine is stopped. VM availability has the values in the following table.
3931

4032
| Value | Description |
4133
|:---|:---|
4234
| 1 | VM is running and available. |
43-
| 0 | VM is unavailable. The VM could be stopped or rebooting. If you shutdown a VM from within the VM, it will emit this value. |
44-
| Null | State of the VM is unknown. If you stop a VM from the Azure portal, CLI, or PowerShell, it will immediately stop emitting the availability metric, and you will see null values. |
45-
46-
47-
## Azure Monitor Logs tables
48-
49-
This section refers to all the Azure Monitor Logs tables that are relevant to virtual machines and Virtual Machine Scale Sets and available for query by Log Analytics.
50-
51-
|Resource type | Notes |
52-
|-------|-----|
53-
| [Virtual machines](/azure/azure-monitor/reference/tables/tables-resourcetype#virtual-machines) | |
54-
| [Virtual Machine Scale Sets](/azure/azure-monitor/reference/tables/tables-resourcetype#virtual-machine-scale-sets) | |
55-
56-
For reference documentation about Azure Monitor Logs and Log Analytics tables, see the [Azure Monitor Logs table reference](/azure/azure-monitor/reference/tables/tables-resourcetype).
57-
58-
## Activity log
59-
60-
The following table lists a few example operations that relate to creating virtual machines in the activity log. For a complete list of possible log entries, see [Microsoft.Compute Resource Provider options](../role-based-access-control/resource-provider-operations.md#compute).
35+
| 0 | VM is unavailable. The VM could be stopped or rebooting. If you shut down a VM from within the VM, it emits this value. |
36+
| Null | State of the VM is unknown. If you stop a VM from the Azure portal, CLI, or PowerShell, it immediately stops emitting the availability metric, and you see null values. |
37+
38+
[!INCLUDE [horz-monitor-ref-metrics-dimensions-intro](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-metrics-dimensions-intro.md)]
39+
40+
The dimension Logical Unit Number (`LUN`) is associated with some of the preceding metrics.
41+
42+
[!INCLUDE [horz-monitor-ref-resource-logs](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-resource-logs.md)]
43+
44+
### Supported resource logs for Microsoft.Compute/virtualMachines
45+
[!INCLUDE [Microsoft.Compute/virtualMachines](~/azure-reference-other-repo/azure-monitor-ref/supported-logs/includes/microsoft-compute-virtualmachines-logs-include.md)]
46+
47+
> [!IMPORTANT]
48+
> For Azure VMs, all the important data is collected by the Azure Monitor agent. The resource log categories available for Azure VMs aren't important and aren't available for collection from the Azure portal. For detailed information about how the Azure Monitor agent collects VM log data, see [Monitor virtual machines with Azure Monitor: Collect data](/azure/azure-monitor/vm/monitor-virtual-machine-data-collection).
49+
50+
[!INCLUDE [horz-monitor-ref-logs-tables](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-logs-tables.md)]
51+
52+
| Table | Categories | Solutions|[Supports basic log plan](/azure/azure-monitor/logs/basic-logs-configure?tabs=portal-1#compare-the-basic-and-analytics-log-data-plans)| Queries|
53+
|---|---|---|---|---|
54+
| [ADAssessmentRecommendation](/azure/azure-monitor/reference/tables/ADAssessmentRecommendation)<br>Recommendations generated by AD assessments that are started through a scheduled task. When you schedule the assessment it runs by default every seven days and uploads the data into Azure Log Analytics. | workloads | ADAssessment, ADAssessmentPlus, AzureResources | No| [Yes](/azure/azure-monitor/reference/queries/adassessmentrecommendation)|
55+
| [ADReplicationResult](/azure/azure-monitor/reference/tables/ADReplicationResult)<br>The AD Replication Status solution regularly monitors your Active Directory environment for any replication failures. | workloads | ADReplication, AzureResources | No| -|
56+
| [AzureActivity](/azure/azure-monitor/reference/tables/AzureActivity)<br>Entries from the Azure Activity log that provides insight into any subscription-level or management group level events that have occurred in Azure. | resources, audit, security | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/azureactivity)|
57+
| [AzureMetrics](/azure/azure-monitor/reference/tables/AzureMetrics)<br>Metric data emitted by Azure services that measure their health and performance. | resources | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/azuremetrics)|
58+
| [CommonSecurityLog](/azure/azure-monitor/reference/tables/CommonSecurityLog)<br>This table is for collecting events in the Common Event Format, that are most often sent from different security appliances such as Check Point, Palo Alto and more. | security | Security, SecurityInsights | No| [Yes](/azure/azure-monitor/reference/queries/commonsecuritylog)|
59+
| [ComputerGroup](/azure/azure-monitor/reference/tables/ComputerGroup)<br>Computer groups that can be used to scope log queries to a set of computers. Includes the computers in each group. | monitor, virtualmachines, management | LogManagement | No| -|
60+
| [ConfigurationChange](/azure/azure-monitor/reference/tables/ConfigurationChange)<br>View changes to in-guest configuration data such as Files Software Registry Keys Windows Services and Linux Daemons | management | ChangeTracking | No| [Yes](/azure/azure-monitor/reference/queries/configurationchange)|
61+
| [ConfigurationData](/azure/azure-monitor/reference/tables/ConfigurationData)<br>View the last reported state for in-guest configuration data such as Files Software Registry Keys Windows Services and Linux Daemons | management | ChangeTracking | No| [Yes](/azure/azure-monitor/reference/queries/configurationdata)|
62+
| [ContainerLog](/azure/azure-monitor/reference/tables/ContainerLog)<br>Log lines collected from stdout and stderr streams for containers. | container, applications | AzureResources, ContainerInsights, Containers | No| [Yes](/azure/azure-monitor/reference/queries/containerlog)|
63+
| [DnsEvents](/azure/azure-monitor/reference/tables/DnsEvents) | network | DnsAnalytics, SecurityInsights | No| [Yes](/azure/azure-monitor/reference/queries/dnsevents)|
64+
| [DnsInventory](/azure/azure-monitor/reference/tables/DnsInventory) | network | DnsAnalytics, SecurityInsights | No| -|
65+
| [Event](/azure/azure-monitor/reference/tables/Event)<br>Events from Windows Event Log on Windows computers using the Log Analytics agent. | virtualmachines | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/event)|
66+
| [HealthStateChangeEvent](/azure/azure-monitor/reference/tables/HealthStateChangeEvent)<br>Workload Monitor Health. This data represents state transitions of a health monitor. | undefined | AzureResources, VMInsights | No| -|
67+
| [Heartbeat](/azure/azure-monitor/reference/tables/Heartbeat)<br>Records logged by Log Analytics agents once per minute to report on agent health. | virtualmachines, container, management | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/heartbeat)|
68+
| [InsightsMetrics](/azure/azure-monitor/reference/tables/InsightsMetrics)<br>Table that stores metrics. 'Perf' table also stores many metrics and over time they all will converge to InsightsMetrics for Azure Monitor Solutions | virtualmachines, container, resources | AzureResources, ContainerInsights, InfrastructureInsights, LogManagement, ServiceMap, VMInsights | No| [Yes](/azure/azure-monitor/reference/queries/insightsmetrics)|
69+
| [Perf](/azure/azure-monitor/reference/tables/Perf)<br>Performance counters from Windows and Linux agents that provide insight into the performance of hardware components operating systems and applications. | virtualmachines, container | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/perf)|
70+
| [ProtectionStatus](/azure/azure-monitor/reference/tables/ProtectionStatus)<br>Antimalware installation info and security health status of the machine: | security | AntiMalware, Security, SecurityCenter, SecurityCenterFree | No| [Yes](/azure/azure-monitor/reference/queries/protectionstatus)|
71+
| [SQLAssessmentRecommendation](/azure/azure-monitor/reference/tables/SQLAssessmentRecommendation)<br>Recommendations generated by SQL assessments that are started through a scheduled task. When you schedule the assessment it runs by default every seven days and uploads the data into Azure Log Analytics. | workloads | AzureResources, SQLAssessment, SQLAssessmentPlus | No| [Yes](/azure/azure-monitor/reference/queries/sqlassessmentrecommendation)|
72+
| [SecurityBaseline](/azure/azure-monitor/reference/tables/SecurityBaseline) | security | Security, SecurityCenter, SecurityCenterFree | No| -|
73+
| [SecurityBaselineSummary](/azure/azure-monitor/reference/tables/SecurityBaselineSummary) | security | Security, SecurityCenter, SecurityCenterFree | No| -|
74+
| [SecurityEvent](/azure/azure-monitor/reference/tables/SecurityEvent)<br>Security events collected from windows machines by Azure Security Center or Azure Sentinel. | security | Security, SecurityInsights | No| [Yes](/azure/azure-monitor/reference/queries/securityevent)|
75+
| [Syslog](/azure/azure-monitor/reference/tables/Syslog)<br>Syslog events on Linux computers using the Log Analytics agent. | virtualmachines, security | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/syslog)|
76+
| [Update](/azure/azure-monitor/reference/tables/Update)<br>Details for update schedule run. Includes information such as which updates where available and which were installed. | management, security | Security, SecurityCenter, SecurityCenterFree, Updates | No| [Yes](/azure/azure-monitor/reference/queries/update)|
77+
| [UpdateRunProgress](/azure/azure-monitor/reference/tables/UpdateRunProgress)<br>Breaks down each run of your update schedule by the patches available at the time with details on the installation status of each patch. | management | Updates | No| [Yes](/azure/azure-monitor/reference/queries/updaterunprogress)|
78+
| [UpdateSummary](/azure/azure-monitor/reference/tables/UpdateSummary)<br>Summary for each update schedule run. Includes information such as how many updates weren't installed. | virtualmachines | Security, SecurityCenter, SecurityCenterFree, Updates | No| [Yes](/azure/azure-monitor/reference/queries/updatesummary)|
79+
| [VMBoundPort](/azure/azure-monitor/reference/tables/VMBoundPort)<br>Traffic for open server ports on the monitored machine. | virtualmachines | AzureResources, InfrastructureInsights, ServiceMap, VMInsights | No| -|
80+
| [VMComputer](/azure/azure-monitor/reference/tables/VMComputer)<br>Inventory data for servers collected by the Service Map and VM insights solutions using the Dependency agent and Log analytics agent. | virtualmachines | AzureResources, ServiceMap, VMInsights | No| -|
81+
| [VMConnection](/azure/azure-monitor/reference/tables/VMConnection)<br>Traffic for inbound and outbound connections to and from monitored computers. | virtualmachines | AzureResources, InfrastructureInsights, ServiceMap, VMInsights | No| -|
82+
| [VMProcess](/azure/azure-monitor/reference/tables/VMProcess)<br>Process data for servers collected by the Service Map and VM insights solutions using the Dependency agent and Log analytics agent. | virtualmachines | AzureResources, ServiceMap, VMInsights | No| -|
83+
| [W3CIISLog](/azure/azure-monitor/reference/tables/W3CIISLog)<br>Internet Information Server (IIS) log on Windows computers using the Log Analytics agent. | management, virtualmachines | LogManagement | No| [Yes](/azure/azure-monitor/reference/queries/w3ciislog)|
84+
| [WindowsFirewall](/azure/azure-monitor/reference/tables/WindowsFirewall) | security | Security, WindowsFirewall | No| -|
85+
| [WireData](/azure/azure-monitor/reference/tables/WireData)<br>Network data collected by the WireData solution using by the Dependency agent and Log analytics agent. | virtualmachines, security | WireData, WireData2 | No| [Yes](/azure/azure-monitor/reference/queries/wiredata)|
86+
87+
[!INCLUDE [horz-monitor-ref-activity-log](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-activity-log.md)]
88+
89+
The following table lists a few example operations that relate to creating VMs in the activity log. For a complete list of operations, see [Microsoft.Compute resource provider operations](/azure/role-based-access-control/resource-provider-operations#microsoftcompute).
6190

6291
| Operation | Description |
6392
|:---|:---|
@@ -68,9 +97,7 @@ The following table lists a few example operations that relate to creating virtu
6897
| Microsoft.Compute/virtualMachines/extensions/write | Creates a new virtual machine extension or updates an existing one |
6998
| Microsoft.Compute/virtualMachineScaleSets/write | Starts the instances of the virtual machine scale set |
7099

71-
For more information about the schema of activity log entries, see [Activity log schema](../azure-monitor/essentials/activity-log-schema.md).
72-
73-
74-
## See also
100+
## Related content
75101

76-
For a description of monitoring Azure virtual machines, see [Monitoring Azure virtual machines](../virtual-machines/monitor-vm.md).
102+
- See [Monitor Virtual Machines](monitor-vm.md) for a description of monitoring Virtual Machines.
103+
- See [Monitor Azure resources with Azure Monitor](/azure/azure-monitor/essentials/monitor-azure-resource) for details on monitoring Azure resources.

0 commit comments

Comments
 (0)