Log Analytics
Log Analytics is an Azure Monitor service and data store for collecting, retaining, querying, and analyzing logs, telemetry, and related operational data.
Azure Security
A Log Analytics workspace is an Azure Monitor data store and query environment for collecting, retaining, and analyzing telemetry and security data.
- How it is used
- Centralizes Azure VM and Defender for Cloud security data for analysis, retention, and Sentinel-based collection.
- How deep it goes
- Explains workspace selection, data export, multihoming, tables, permissions, and agent prerequisites without detailing query construction.
- Examples
- Walks through exporting medium- and high-severity alerts and recommendations with streaming updates and weekly snapshots to a workspace.
- What you can do after
- Operate/configure a workspace destination for Defender for Cloud exports, Sentinel collection, and separated VM telemetry flows.
Microsoft Azure in Action
A Log Analytics workspace is an Azure data repository and management boundary in which log and telemetry data is collected, stored, and queried.
- How it is used
- Investigates virtual-machine problems by collecting logs centrally and querying them alongside monitoring signals.
- How deep it goes
- Works through a VM-restart investigation with KQL queries and cross-checks, without detailing workspace provisioning or retention settings.
- Examples
- Traces an unexpected VM restart through heartbeat gaps, Windows Event Logs or Linux syslog, and Azure Activity Log operations.
- What you can do after
- Diagnose/debug with it by querying heartbeat and reboot events, correlating Activity Log operations, and acting on patterns with alerts or dashboards.
Practical Automation with PowerShell: Effective scripting from the console to the cloud
Log Analytics is an Azure monitoring and data collection service that stores, searches, and analyzes diagnostic and metric data.
- How it is used
- Supports Azure Automation observability, diagnostic collection, querying, alerting, and hybrid runbook worker execution.
- How deep it goes
- Explains workspace setup, Automation integration, Kusto queries, alerts, and hybrid-worker prerequisites without detailing query syntax or agent internals.
- Examples
- Demonstrates PowerShell provisioning, Automation-solution installation, regional pairing, and logging runbook executions, outputs, errors, and failed jobs.
- What you can do after
- Operate/configure a workspace for Azure Automation logging, alerting, and hybrid runbook worker support.
Related concepts
- Kusto Query Languageuses · Kusto Query Language is a query language for interactively retrieving and analyzing telemetry, log, time-series, and other data in Azure and related Microsoft services.
- Log Analytics agentused by · The Log Analytics agent is Microsoft's legacy host agent for collecting machine telemetry and sending it to a Log Analytics workspace.
- data collection ruleconfigured by · A data collection rule is an Azure Monitor configuration that specifies data sources, transformations, and destinations for monitoring data.
- continuous exportused by · Continuous export is the ongoing transfer of selected security data from a source service to a configured destination as changes or scheduled snapshots occur.
- logused by · A log is a record of events, activity, or diagnostic information produced during the operation of a system or process, often ordered by time.
- data ingestionused by · Data ingestion is the process of acquiring or receiving data from one or more sources and bringing it into a system for storage or processing.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.