Forum Discussion
Logging and Log Analytics, Pretty confusing.
Lets break this down a little. A workspace is created in a Resource Group / Azure Region (ideally the same region as your Windows Servers). The workspace is the storage (essentially it's a cloud database) for logs and other data types.
You then install the Microsoft Monitoring Agent (MMA) in your Server (Azure market place images have the extension built-in). For non IaaS resources you typically use the Diagnostic blade to send logs to Storage, EventHubs or Log Analytics (so if you select Storage you will need a storage account), if you just select Log Analytics you can use your workspace.
The agent (MMA) when installed or activated will send Heartbeat data to Log Analytics. For any other data like Perf you have to go to the [Advanced Settings] in Log Analytics and select the Perf counters (or Event logs, Syslogs etc...) you wish to collect from any server with the MMA on it (its managed centrally).
Please read:
Official docs: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/design-logs-deployment
How to run a POC and design: https://techcommunity.microsoft.com/t5/Azure-Sentinel/Best-practices-for-designing-an-Azure-Sentinel-or-Azure-Security/ba-p/832574
----------------------------
Azure Monitor (the product group in Microsoft that runs Logging, Metrics, Alerts...) also has a Metrics technology alongside the Logs (it collects a subset of perf counters) that are stored on your behalf. See Azure Monitor Metrics (in the diagram) - these don't require an agent if your servers are in Azure.