Skip to main content
Version: Next

Task 01: Configure Log Analytics Workspace

Runbook Azure

DOCUMENT CATEGORY: Runbook SCOPE: Log Analytics workspace configuration PURPOSE: Create the foundational workspace for all monitoring data collection MASTER REFERENCE: Microsoft Learn - Log Analytics Workspace

Status: Active

The Log Analytics workspace is the foundation for all Azure Local monitoring. It stores performance metrics, event logs, security data, and custom logs from cluster nodes, network devices, and Arc-enabled resources. This workspace must be created before enabling HCI Insights, Azure Monitor Agent, or any alerting.

Prerequisites​

RequirementDescriptionValidation
Azure SubscriptionActive subscription with billingPortal access confirmed
Resource Group{{AZURE_RESOURCE_GROUP}} existsaz group show
RBAC PermissionsContributor or Owner on resource groupRole assignment verified
Region SelectionSame region as Azure Local clusterLatency considerations

Variables from variables.yml​

VariableConfig PathExample
AZURE_SUBSCRIPTION_IDazure.subscription.id00000000-0000-0000-0000-000000000000
AZURE_SUBSCRIPTION_NAMEazure.subscription.nameAzure Local Production
AZURE_RESOURCE_GROUPazure.resource_group.namerg-azurelocal-prod-eus2
AZURE_REGIONazure.resource_group.locationeastus2
LOG_ANALYTICS_WORKSPACE_NAMEmonitoring.log_analytics.workspace_namelaw-azl-DAL-prod-01
SITE_CODEsite.codeDAL

Overview​

flowchart LR
 subgraph "Data Sources"
 A[Cluster Nodes]
 B[Arc Servers]
 C[Network Devices]
 D[Azure Resources]
 end
 
 subgraph "Collection"
 E[Azure Monitor Agent]
 F[Data Collection Rules]
 G[Syslog Forwarder]
 end
 
 subgraph "Log Analytics"
 H[Workspace]
 I[Tables]
 J[Queries]
 end
 
 A --> E --> F --> H
 B --> E
 C --> G --> H
 D --> H
 H --> I --> J

Configuration Options​

Step 1.1: Create Log Analytics Workspace​

  1. Navigate to Azure Portal → Log Analytics workspaces
  2. Click + Create
  3. Configure workspace settings:
SettingValueNotes
Subscription{{AZURE_SUBSCRIPTION_NAME}}Select target subscription
Resource Group{{AZURE_RESOURCE_GROUP}}Use existing monitoring RG
Name{{LOG_ANALYTICS_WORKSPACE_NAME}}e.g., law-azl-{{SITE_CODE}}-prod-01
Region{{AZURE_REGION}}Same as cluster resources
  1. Click Review + Create → Create

Step 1.2: Configure Data Retention​

  1. Open the workspace → Settings → Usage and estimated costs
  2. Click Data Retention
  3. Set retention period:
  • Default: 30 days (free)
  • Recommended: 90 days for operational data
  • Compliance: 365+ days for audit requirements

Step 1.3: Configure Access Control​

  1. Navigate to workspace → Access control (IAM)
  2. Add role assignments:
RolePrincipalPurpose
Log Analytics ContributorAzure Local Cloud Admin GroupFull management
Log Analytics ReaderOperations TeamView logs and queries
Monitoring ContributorAutomation AccountDCR management

Configure Data Sources​

After creating the workspace, configure the data sources that will send data:

Windows Event Logs​

Navigate to Workspace → Settings → Agents → Windows event logs:

Log NameEvent Levels
Microsoft-Windows-Health/OperationalError, Warning, Information
Microsoft-Windows-SDDC-Management/OperationalError, Warning, Information
SystemError, Warning
ApplicationError, Warning
Microsoft-Windows-Hyper-V-VMMS-AdminError, Warning

Performance Counters​

Configure performance counters for HCI Insights compatibility:

CounterSample Interval
Memory(*)\Available Bytes60 seconds
Network Interface(*)\Bytes Total/sec60 seconds
Processor(_Total)\% Processor Time60 seconds
RDMA Activity(*)\RDMA Inbound Bytes/sec60 seconds
RDMA Activity(*)\RDMA Outbound Bytes/sec60 seconds
Cluster CSV File System(*)\Read Latency60 seconds
Cluster CSV File System(*)\Write Latency60 seconds

Data Collection Endpoint (DCE)​

For Azure Monitor Agent to send data, create a Data Collection Endpoint:

# Create Data Collection Endpoint
$dce = New-AzDataCollectionEndpoint `
 -ResourceGroupName $ResourceGroup `
 -Name "dce-{{SITE_CODE}}-azl-01" `
 -Location $Location `
 -NetworkAclsPublicNetworkAccess "Enabled"

Write-Host "DCE Resource ID: $($dce.Id)"

Important: Keep the DCE in the same region as the Log Analytics workspace to avoid data ingestion issues.

Validation​

Verify Workspace Creation​

# Verify workspace exists and is accessible
$workspace = Get-AzOperationalInsightsWorkspace `
 -ResourceGroupName "{{AZURE_RESOURCE_GROUP}}" `
 -Name "{{LOG_ANALYTICS_WORKSPACE_NAME}}"

if ($workspace.ProvisioningState -eq "Succeeded") {
 Write-Host "✅ Workspace created successfully" -ForegroundColor Green
 Write-Host " Resource ID: $($workspace.ResourceId)"
 Write-Host " Customer ID: $($workspace.CustomerId)"
 Write-Host " Retention: $($workspace.RetentionInDays) days"
} else {
 Write-Host "❌ Workspace creation failed: $($workspace.ProvisioningState)" -ForegroundColor Red
}

Test Query Capability​

# Run a simple query to verify connectivity
$query = "Heartbeat | take 5"
$result = Invoke-AzOperationalInsightsQuery `
 -WorkspaceId $workspace.CustomerId `
 -Query $query

Write-Host "Query executed successfully. Results: $($result.Results.Count)"

Troubleshooting​

IssuePossible CauseResolution
Workspace creation failsInsufficient permissionsVerify Contributor role on resource group
No data appearingDCR not configuredComplete Step 2 (Azure Monitor Agent)
Query timeoutLarge data volumeNarrow time range or add filters
Region mismatch errorsDCE in different regionCreate DCE in same region as workspace

Variables Reference​

VariableDescriptionExample
{{AZURE_SUBSCRIPTION_ID}}Target subscription ID12345678-1234-...
{{AZURE_RESOURCE_GROUP}}Monitoring resource grouprg-azl-prod-monitoring
{{LOG_ANALYTICS_WORKSPACE_NAME}}Workspace namelaw-azl-dal-prod-01
{{AZURE_REGION}}Azure regioneastus2
{{SITE_CODE}}Site identifierdal

Next Steps​

After configuring the Log Analytics workspace:

  1. ➡️ Task 2: Configure Azure Monitor Agent — Deploy AMA to cluster nodes
  2. Enable data collection rules for performance and event data
  3. Verify data is flowing to the workspace before enabling Insights
PreviousUpNext
← Phase 01: SDN DeploymentPhase 02: Monitoring & ObservabilityTask 02: Azure Monitor Agent →
VersionDateAuthorChanges
1.0.02026-03-24Azure Local Cloudnology TeamInitial release