sca-monitoring

Install the Azure Monitor Agent (AMA) extension on the VM, then create a Data Collection Rule that selects performance counters and Windows event logs as data sources with your Log Analytics workspace as the destination. Data typically appears within 5-10 minutes.

Start with a table name like Perf, Heartbeat, or Event, then chain pipe operators: `where` filters rows, `project` selects columns, `summarize` aggregates with functions like count() or avg(), and `render timechart` visualizes time series. Operators are lowercase and table names are PascalCase.

The Azure Monitor Agent (AMA) replaces the legacy Microsoft Monitoring Agent (MMA/OMS), which Microsoft retired in August 2024. AMA collects nothing by default; Data Collection Rules define what data is gathered and where it is sent.

Use metric alerts for numeric signals like CPU percentage because they evaluate every minute at low cost. Use log alerts when you need KQL query logic, accepting slower 5-15 minute evaluation cadence and higher cost.

Check that the action group's email receiver address is correct and the message is not in spam. Also expect 7+ minutes of latency from metric ingestion lag, the evaluation window, and delivery time before the email arrives.

Set a daily ingestion cap with Set-AzOperationalInsightsWorkspace -DailyQuotaGb, keep retention at the included 31 days, and use the PerGB2018 pay-as-you-go tier. A small lab VM emitting 50-150 MB per day costs only a few dollars monthly.