Skip to content

CLZ-360 - Azure Monitor and Log Analytics

Azure Monitor and Log Analytics architecture
Service or workflow illustration. The lesson defines the exact resource settings. Open at full size.

Goal

Create the operations foundation for centralized logs and notifications, then distinguish a provisioned workspace from a workload that is actually sending data.

CLZ-360 learning sequence
Arrows show the learning sequence, not service traffic. Azure deployment. Open at full size.

Prerequisites

  • Complete CLZ-120.
  • Permission to create Log Analytics workspaces and action groups.
  • Choose nonproduction notification details before enabling real receivers.

Architecture

CLZ-360 — The lesson provisions a 30-day Log Analytics workspace and an enabled action group with no receivers. Dashed collection and alert connections are future additions; no agent, data collection rule, alert rule, or notification receiver is configured.
Lesson-specific teaching diagram. Read the arrow legend and the accompanying architecture explanation. Azure deployment. On narrow screens, scroll the diagram horizontally. Open at full size.

A Log Analytics workspace provides the query/data boundary and retention setting. An Azure Monitor action group supplies an operations notification target. No VM diagnostic setting or data-collection rule is attached, so an empty workspace is expected immediately after deployment.

Resources And Cost

Relative cost: Low. Log ingestion and retention drive cost; the empty workspace/action group are inexpensive.

Component Purpose and principal cost driver
Log Analytics workspace Analytics store and query scope; ingestion/retention are the principal drivers.
Monitor action group Reusable notification target; receiver services may have separate limits/costs.
Resource group Owns the operations foundation.

Inputs

Input Required substitution or decision
subscription_id Required for Azure plan, apply, and destroy; use the exact subscription GUID.
environment Keep dev for an ephemeral lab unless testing another environment boundary.
location Choose a supported region with sufficient quota.
name_prefix Use a short lowercase prefix for derived names.

Keep real subscription IDs, CIDRs, endpoint names, and secrets in untracked local files or protected repository settings.

Deploy

Review the plan and lesson-specific gates before deliberate execution. Local-only and read-only lessons create no Azure resources.
Review the plan and lesson-specific gates before deliberate execution. Local-only and read-only lessons create no Azure resources. Open at full size.

Run from the repository root in PowerShell 7:

Set-Location CLZ-360-azure-monitor-log-analytics
if (-not (Test-Path terraform.tfvars)) {
  Copy-Item terraform.tfvars.example terraform.tfvars
}
$subscriptionId = az account show --query id --output tsv
terraform init -lockfile=readonly
terraform fmt -check
terraform validate
terraform plan -var "subscription_id=$subscriptionId" -out tfplan
terraform show tfplan
terraform apply tfplan

Validate

$resourceGroup = terraform output -raw resource_group_name
$workspaceId = terraform output -raw log_analytics_workspace_id
az monitor log-analytics workspace show --ids $workspaceId --query '{name:name,state:provisioningState,retention:retentionInDays}' --output table
az monitor action-group list --resource-group $resourceGroup --query '[].{name:name,enabled:enabled}' --output table
$workspaceGuid = az monitor log-analytics workspace show --ids $workspaceId --query customerId --output tsv
az monitor log-analytics query --workspace $workspaceGuid --analytics-query 'Heartbeat | take 5' --output table

Expected result:

  • The workspace is Succeeded with the configured retention.
  • The action group exists and is enabled.
  • The query uses the workspace GUID (customerId), while workspace show --ids uses the ARM resource ID.
  • The Heartbeat query may return no rows or report that the table does not exist because this lesson deliberately attaches no data source.

Troubleshooting

Gather evidence, repair the cause, and rerun verification.
Gather evidence, repair the cause, and rerun verification. Open at full size.
Symptom Resolution
The query is empty or Heartbeat is unavailable Expected until a VM/agent and data-collection rule send data; provisioning alone does not create telemetry or its tables.
Log query returns authorization failure Verify workspace query/read roles and the selected tenant.
Notifications do not arrive An action group alone does nothing; connect it to an alert rule and verify receiver configuration.

Cleanup

Use the lesson state and cleanup instructions. Preserve remote-state dependencies until consumers are removed.
Use the lesson state and cleanup instructions. Preserve remote-state dependencies until consumers are removed. Open at full size.
$resourceGroup = terraform output -raw resource_group_name
terraform destroy -var "subscription_id=$subscriptionId"
az group exists --name $resourceGroup

Workspace and action group are removed; consider workspace soft-delete/recovery behavior if names are reused.

Production Delta

  • Define data-collection rules, diagnostic settings, retention/archive, daily caps, alert rules, workbooks, RBAC, and incident ownership.
  • Treat alert delivery as a tested service with severity, deduplication, escalation, and maintenance controls.

Exercises

  1. Write a KQL query that would summarize Heartbeat by computer once a source is attached.
  2. Design one actionable alert and identify its signal, threshold, window, receiver, and runbook.

← CLZ-350 - Private Endpoint for Storage | Curriculum | CLZ-370 - GitHub Actions for Terraform →