[Autogenerated] now I had mentioned with Azure arc that you
need the connected machine agent and then I mentioned
something called the log analytics agent.
The onboard.
An Azure VM or non Azure VM for monitoring within Azure and also to use
some of the Azure based configuration management products.
Well this is a bit confusing unfortunately Microsoft has a penchant for
naming and renaming and re re naming their products.
So honestly on your exam your A C 801 I'm not sure what
nomenclature you'll actually see.
So let me give it all to you, the Microsoft monitoring agent or Emma for short,
also called the Azure Monitor Agent also called the log analytics agent.
Also called the M.
S.
Agents are all synonyms for an MSI Windows installer package that on
boards that Azure or non Azure machine to work with the log analytics
platform and log analytics is the main telemetry log aggregation
monitoring platform in Microsoft.
Azure Okay, now if you've worked with Azure VMS for awhile,
particularly since before log analytics came around,
there was the Azure diagnostics extension that you would
enable on your Azure VMS to gain access to the event logs
and performance monitor counters.
Well,
that's really the Azure diagnostics extension really isn't
necessary nowadays in the Azure world because we can capture just
about anything you want from the VM using the Microsoft monitoring
agent but it is still available.
It's called guest os diagnostics.
Can you enable both the log analytics agent and the Azure diagnostics extension?
Yes you can I talk to Microsoft about that a couple of years ago and
they claim that neither agent is particularly resource intensive but
they did admit that there's going to be some overlapping duties if you
have both extensions installed.
I created this conceptual diagram of Azure log analytics using lucid chart.
My favorite diagramming tool and the promise of log
analytics is to give you a single pane of glass,
so to speak for your monitoring.
So we've got an Azure other clouds, your local data center enterprise,
you've got resources that are emitting log data,
what is logged data.
Well normally a log is going to record events and windows,
you've got your event log and then you also have time sampled metric data.
Think of performance monitor counters.
Now those are also persisted in logs.
Those logs maybe in any number of different data representation formats.
XML CSV proprietary Doesn't matter though because the bottom line
is if you can get those resources to send their logs into log
analytics which is an Azure resource that can be looked at as a
massively scalable data warehouse.
Log analytics can ingest those logs from the various sources and convert
them into what look and act like database tables with columns and rows
and yes there is a custom log model where you for instance can have your
line of business application logs ingest those into log analytics as well
and you can structure the resulting log analytics virtual table check the
exercise files because I give you a link to that if you're interested.
So the idea is that once you've got your resources
sending their log data into log analytics,
you have this query language Microsoft developed called Cousteau Query
language Kustok QL that is reminiscent of structured query language SQL it's
reminiscent of the Splunk search language where you can write queries against
any combination of those tables you will seek que que el on most of the Azure
exams including potentially a C 801 so I'll make sure to do a bit more with
cake ul in my demos.
But the great promise here is that once you've learned cake
ulu then can unlock rich reporting and alerting across your
hybrid cloud infrastructure.
It's a very nice thing and you'll also find in the Azure ecosystem
that cake ul crops up in other related contexts.
For example, there's application insights,
that's the Azure application performance monitoring or a
PM tool and you use cake well in there, if you're familiar with Azure sentinel,
the security platform threat hunting capability and Azure sentinel is
powered by cake within Azure resource manager itself,
there's the resource graph that's responsible for
indexing all of your resources.
Again, que que el to the rescue.
So this is a query language that you definitely want to learn even if you weren't a Microsoft certification candidate