Forum Discussion
Limit what data in Log Analytics to be passed on to Sentinel?
Ok; that's too bad. I dug a little deeper into the increased log volumes and realized that the bulk of the records/sources are not visible under Data Connections.
Previously; before we upgraded the Workspace to onboard "Azure Monitor for VM:s" I was manually pulling a number of selected perfmon counters (CPU, RAM and so on). I did this at a 5 min interval to give me an overview without causing too much data in OMS. But after enabling Azure Monitor for VM:s, a huge number of new counters has been enabled and the resolution is much higher. Over the last 24h I've recieved ~300k datapoints for the 4 VMs I'm monitoring:
| Computer | 11,499 | ||
| LogicalDisk | 205,315 | ||
| Memory | 5,744 | ||
| Processor | 5,744 | ||
| Network | 14,360 |
None of these namespaces are visible under Data Sources in Log Analytics.
It would be great to be able to lower the resolution/interval, but I can't seem to find anywhere to limit the interval on these logs?
I realize that this is now more of an "Azure Monitor for VM:s" question than a Sentinel question.
Magnus Tjerneld Did you check under the "Windows Performance Counters" in the "Data" section?
GaryBushey Yes; only the manual counters that I had set up before I enabled "Azure monitor for VMs" are visible there. AMFVM seems to set up it's own data collection that you don't seem to be able to edit.
Please see the GA release info
https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq
Thanks CliveWatson. I read this before and have now read it again; and I realize that I can delete my old perfmon counters. However, I do not find any information regarding:
- Can I limit the "resolution" of data performance data sent to Log Analytics after upgrading to Azure Monitor for VMs? In the old solution, I could set intervals in seconds.- Can I choose not to collect data for a specific namespace? For us, Disk-metrics make up 90% of logs ingested and causes a lot of extra costs in Sentinel. If possible, I'd opt out.
And my wish would be to be able to exclude all performance counters from ingestion into Sentinel. This only results in added cost and no added value.
