Forum Discussion

Hauke_l's avatar
Hauke_l
Copper Contributor
Nov 13, 2023

Azure Monitoring Agent Virtual Machines not connecting to log analytics workspace

Hey there,

 

i tried to rollout monitoring for Azure Virtual Machines. For Testing i created a basic DCR to collect general Performance Counters of the associated VM's.

 

The DCR is in Terraform defined as following : 

 

resource "azurerm_monitor_data_collection_rule" "log" {
  name                        = "test_rule"
  location                    = azurerm_resource_group.test_group.location
  resource_group_name         = azurerm_resource_group.test_group.name
  kind = "Windows"

  destinations {
    log_analytics {
      workspace_resource_id = azurerm_log_analytics_workspace.default_workspace.id
      
      name                  = azurerm_log_analytics_workspace.default_workspace.name
    }
  }

  data_flow {
    streams = [ "Microsoft-Perf" ]
    destinations = [azurerm_log_analytics_workspace.default_workspace.name]
  }

  data_sources {

    performance_counter {
      streams                       = [ "Microsoft-Perf" ]
      sampling_frequency_in_seconds = 60
      counter_specifiers = [
        "\\Processor Information(_Total)\\% Processor Time",
        "\\Processor Information(_Total)\\% Privileged Time",
        "\\Processor Information(_Total)\\% User Time",
        "\\Processor Information(_Total)\\Processor Frequency",
        "\\System\\Processes",
        "\\Process(_Total)\\Thread Count",
        "\\Process(_Total)\\Handle Count",
        "\\System\\System Up Time",
        "\\System\\Context Switches/sec",
        "\\System\\Processor Queue Length",
        "\\Memory\\% Committed Bytes In Use",
        "\\Memory\\Available Bytes",
        "\\Memory\\Committed Bytes",
        "\\Memory\\Cache Bytes",
        "\\Memory\\Pool Paged Bytes",
        "\\Memory\\Pool Nonpaged Bytes",
        "\\Memory\\Pages/sec",
        "\\Memory\\Page Faults/sec",
        "\\Process(_Total)\\Working Set",
        "\\Process(_Total)\\Working Set - Private",
        "\\LogicalDisk(_Total)\\% Disk Time",
        "\\LogicalDisk(_Total)\\% Disk Read Time",
        "\\LogicalDisk(_Total)\\% Disk Write Time",
        "\\LogicalDisk(_Total)\\% Idle Time",
        "\\LogicalDisk(_Total)\\Disk Bytes/sec",
        "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
        "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
        "\\LogicalDisk(_Total)\\Disk Transfers/sec",
        "\\LogicalDisk(_Total)\\Disk Reads/sec",
        "\\LogicalDisk(_Total)\\Disk Writes/sec",
        "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
        "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
        "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
        "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
        "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
        "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
        "\\LogicalDisk(_Total)\\% Free Space",
        "\\LogicalDisk(_Total)\\Free Megabytes",
        "\\Network Interface(*)\\Bytes Total/sec",
        "\\Network Interface(*)\\Bytes Sent/sec",
        "\\Network Interface(*)\\Bytes Received/sec",
        "\\Network Interface(*)\\Packets/sec",
        "\\Network Interface(*)\\Packets Sent/sec",
        "\\Network Interface(*)\\Packets Received/sec",
        "\\Network Interface(*)\\Packets Outbound Errors",
        "\\Network Interface(*)\\Packets Received Errors"
      ]
      name = "datasourceperfcounter"
    }
  }

  description = "General data collection rule for collecting windows performance counter rules"
}

 

Also i created the association of the DCR and my Virtual Machine using either Terraform, Policies and Portal. The Monitor Agent and identity is assinged in all cases properly. But the Connection of the DCR / DCR Associations doesn't seem to work in case of terraform or policy enrollment. For some reason the log analytic namespace neither receive an Heartbeat of the agent nor creating the tables for the performance counters. If i recreate the association between DCR and vm in those cases it works again.

Is there any additional Step required when using the Policies or Terraform to setup the data collection rule or this a bug where some kind of required event is not raised properly ?

1 Reply

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Jan 28, 2026

    According to Microsoft’s official guidance, when deploying Data Collection Rules (DCRs) through Terraform or Azure Policy, it is essential to explicitly configure and apply the azurerm_monitor_data_collection_rule_association resource to the target virtual machine. Without this association, the Azure Monitor Agent will not transmit heartbeat signals or performance metrics to the Log Analytics workspace. Microsoft documentation further emphasizes that DCRs require a direct association with the intended resources, and in certain cases, automated deployments may fail to trigger the necessary agent refresh, necessitating a manual re‑application of the association.

     

    https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_data_collection_rule_association

     

    https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-rule-overview

Resources