Logs record events and diagnostic details, helping explain why something happened; metrics show what is happening. They support troubleshooting, auditing, and understanding VM activity. section 3.7
Azure VM logs offer different views:
- Activity logs record control-plane actions, such as starting a VM or changing permissions. section 3.7
- Diagnostic logs capture data from within the VM, including system, application, and performance data when diagnostics are enabled. section 3.7
- Guest logs come from the operating system, such as Windows Event Logs or Linux syslog, and help investigate OS and application problems. section 3.7
Collect the logs you need, send them to a Log Analytics workspace, and use Kusto Query Language (KQL) to search and correlate records. Queries can support alerts, dashboards, or automated actions. For an unexpected VM restart, compare heartbeat gaps with OS events and Azure activity around the same time. section 3.7.1 section 3.6.2
Heartbeat | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) by Computer
This query finds each VM’s most recent heartbeat in the past 24 hours; a gap may indicate a restart. section 3.7.1
Logs can also preserve AI model provenance and explanatory details, letting teams investigate how a prediction or recommendation was produced. section 7.5.2
