What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Azure Monitor does not alert on guest Windows event logs merely because VM monitoring is enabled. Configure Azure Monitor Agent (AMA) to collect selected events with a Data Collection Rule (DCR), send them to a Log Analytics workspace, and create a log search alert rule that evaluates a KQL query against that data. An action group can then send notifications when the alert fires.
This guide shows how to configure that path for Azure VMs, verify event ingestion, and create an alert for a matching event.
Before you start
You need the following:
- A Windows Azure VM whose events you want to monitor.
- A Log Analytics workspace.
- Permission to configure data collection and access the workspace. Collection configuration requires suitable contributor permissions on the workspace and permission to create DCR resources.
- Permission to read the VM or workspace used as the alert scope and permission to write to the resource group where the alert rule will be created.
Use Azure Monitor Agent, not the retired Microsoft Monitoring Agent (MMA), also known as the Log Analytics or OMS agent. MMA was retired on August 31, 2024.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe DCR subscription, resource group, and region do not need to match the VM. Choose locations that fit your resource-management standards, while selecting the correct VM and workspace in the later steps.
#1 Best Overall
- Compatible with Nintendo Switch 2’s new GameChat mode
- Auto-Light Balance: RightLight boosts brightness by up to 50%, reducing shadows so you look your best—compared to previous-generation Logitech webcams (1)
- Privacy with a Slide: The integrated webcam cover makes it easy to get total, reliable privacy when you're not on a video call
- Built-In Mic: The built-in microphone lets others hear you clearly during video calls
- Easy Plug-And-Play: The Brio 101 works with most video calling platforms, including Microsoft Teams, Zoom and Google Meet—no hassle; it just works
1. Create a Windows event-log DCR
- In the Azure portal, select Monitor.
- Select Data Collection Rules.
- Select Create.
Configure the Basics tab
Enter a rule name, subscription, resource group, and region. For Platform Type, choose:
- Windows if this DCR will be associated only with Windows resources.
- Linux if it will be associated only with Linux resources.
- Custom if the same DCR will be associated with both Windows and Linux resources.
For this article, select Windows.
Add the VM on the Resources tab
- Open the Resources tab.
- Select Add resources.
- Select the Windows VM.
- Add more VMs if they should use exactly the same event-log configuration.
The DCR applies to every VM selected here. If you add a VM later, edit the DCR and add it as an associated resource. The portal can install AMA automatically when the DCR is created and associated with selected VMs.
Select event channels and severities
- Open the Data source or data source configuration section.
- Select Add data source.
- Set Data source type to Windows Event Logs.
- Select the channels to collect, such as Application and System.
- Select the required severity levels, such as Critical, Error, and Warning.
Only the severity levels selected for each channel are sent to Azure Monitor. Selecting only Error, for example, will not collect warnings from that channel.
For a focused rule, select Custom rather than collecting every event in a channel. Custom XPath filtering is useful when an event ID identifies the condition you care about.
Use custom XPath filters
DCR XPath entries must include the channel name, an exclamation mark, and the XPath query, in this form: LogName!XPathQuery.
To collect Application event ID 1035, use Application!*[System[EventID=1035]].
To collect System events with IDs 1, 2, or 3, use System!*[System[(EventID=1 or EventID=2 or EventID=3)]].
Recommended Free Tools
Rank #2
- Compatible with Nintendo Switch 2’s new GameChat mode
- Crisp HD 720p/30 fps video calls with diagonal 55° field of view and auto light correction. Compatible with popular platforms including Skype and Zoom.
- The built-in noise-reducing mic makes sure your voice comes across clearly up to 1.5 meters away, even if you’re in busy surroundings.
- C270’s RightLight 2 feature adjusts to lighting conditions, producing brighter, contrasted images to help you look good in all your conference calls.
- The adjustable universal clip lets you attach the camera securely to your screen or laptop, or fold the clip and set the webcam on a shelf. You’re always ready for your next video call.
The channel prefix and exclamation mark are required in the DCR. A common mistake is to enter only *[System[EventID=1035]]; that expression can be tested locally, but it is not the complete DCR entry.
Test an XPath expression on the VM before adding it to the DCR:
$XPath = ‘*[System[EventID=1035]]’
Get-WinEvent -LogName ‘Application’ -FilterXPath $XPath
Get-WinEvent accepts up to 23 XPath expressions in a query. A DCR supports up to 20 XPath entries. Windows Event Log XPath limitations also apply: functions such as position, Band, and timediff are supported, while starts-with and contains are not currently supported.
Set the destination
- Open the Destination tab.
- Set Destination type to Azure Monitor Logs.
- Under Account or namespace, select the Log Analytics workspace.
- Select Review + create, then create the DCR.
Windows event data collected by this DCR is stored in the workspace’s Event table. You can select multiple workspaces, but each workspace receives a duplicate copy and creates additional ingestion cost.
2. Confirm that events are reaching Log Analytics
Do not create the alert until the query returns the event you intend to detect. A new DCR can take several minutes to begin producing records, and the selected event must occur on the VM after collection is configured.
- Open the VM in the Azure portal.
- Select Logs from the VM menu.
- In Log Analytics, select the Tables button.
- Under Virtual machines, find Event and select Run.
Useful columns include Computer, EventLog, EventID, EventLevelName, Message, RenderedDescription, Source, TimeGenerated, and _ResourceId.
Rank #3
- 【Full HD 1080P Webcam】Powered by a 1080p FHD two-MP CMOS, the NexiGo N60 Webcam produces exceptionally sharp and clear videos at resolutions up to 1920 x 1080 with 30fps. The 3.6mm glass lens provides a crisp image at fixed distances and is optimized between 19.6 inches to 13 feet, making it ideal for almost any indoor use.
- 【Wide Compatibility】Works with USB 2.0/3.0, no additional drivers required. Ready to use in approximately one minute or less on any compatible device. Compatible with Mac OS X 10.7 and higher / Windows 7, 8, 10 & 11 / Android 4.0 or higher / Linux 2.6.24 / Chrome OS 29.0.1547 / Ubuntu Version 10.04 or above. Not compatible with XBOX/PS4/PS5.
- 【Built-in Noise-Cancelling Microphone】The built-in noise-canceling microphone reduces ambient noise to enhance the sound quality of your video. Great for Zoom / Facetime / Video Calling / OBS / Twitch / Facebook / YouTube / Conferencing / Gaming / Streaming / Recording / Online School.
- 【USB Webcam with Privacy Protection Cover】The privacy cover blocks the lens when the webcam is not in use. It's perfect to help provide security and peace of mind to anyone, from individuals to large companies. 【Note:】Please contact our support for firmware update if you have noticed any audio delays.
- 【Wide Compatibility】Works with USB 2.0/3.0, no additional drivers required. Ready to use in approximately one minute or less on any compatible device. Compatible with Mac OS X 10.7 and higher / Windows 7, 10 & 11, Pro / Android 4.0 or higher / Linux 2.6.24 / Chrome OS 29.0.1547 / Ubuntu Version 10.04 or above. Not compatible with XBOX/PS4/PS5.
For a specific event ID, run: Event | where EventID == 1035.
For errors, run: Event | where EventLevelName == “Error”.
For a result that exposes useful notification dimensions, run: Event | where EventLevelName == “Error” | project TimeGenerated, Computer, EventLog, EventID, EventLevelName, RenderedDescription, _ResourceId.
If the result is empty, check that AMA is installed and running, the VM is associated with the DCR, the correct channel and severity were selected, and the event actually occurred after the DCR was deployed. Also check that the event log is stored on a local disk. Event logs on network shares or UNC paths are unsupported. AMA cannot collect Analytic or Debug channels because Windows does not permit the required event subscription for those channels.
3. Create the log search alert
Once the query returns the desired records:
- From the VM’s Logs page, leave the validated query in the editor.
- Select New alert rule.
- Review the Scope. When created from the VM’s Logs page, it is initially set to the current resource.
Choose the alert condition
The query appears in the Condition tab. For a query such as Event | where EventID == 1035, the measurement is normally Count the number of Table rows. Configure the condition as follows:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Setting | Example | Purpose |
|---|---|---|
| Measurement | Count the number of Table rows | Counts matching events returned by the query. |
| Aggregation granularity | 5 minutes | The time window used to aggregate matching records. |
| Operator | Greater than | Fires when the count exceeds the threshold. |
| Threshold value | 0 | Means at least one matching event triggers the condition. |
| Frequency of evaluation | 5 minutes | How often Azure Monitor runs the query. |
Do not append | count merely to make this query alertable. When row count is selected, the alert engine performs the counting. If the query already returns a count value, the alert can count that single result and remain at 1 even when no matching events exist in the intended time window.
Lower evaluation frequency can increase alert-rule cost. Choose a frequency that matches the operational need instead of defaulting to the shortest available interval.
Rank #4
- 1080P Webcam with Cover for Video Calls - EMEET computer webcam provides design and Optimization for professional video streaming. Realistic 1920 x 1080p video, 5-layer anti-glare lens, providing smooth video. C960 computer camera delivers 1920x1080 video with fixed focus (11.8–118.1 inches), so as to provide a clearer image. C960 USB webcam has a cover and can be removed automatically to meet your needs for privacy. For optimal image performance, use the webcam in a well-lit environment.
- Built-in 2 Omnidirectional Mics - EMEET webcam with microphone for desktop features 2 built-in omnidirectional microphones, picking up your voice to create clear audio for communication. When installing the webcam, select EMEET C960 as the default microphone input device in your computer and video applications and select C960 as the default device in Zoom/Teams and ensure microphone permissions are enabled for proper use. Please note that C960 does not include built-in speakers.
- Automatic Light Adjustment - Automatic exposure adjustment is applied in EMEET HD webcam 1080p so that the streaming webcam can deliver stable image performance. EMEET C960 camera for computer also features color adjustment and exposure optimization to help you look your best. For optimal video quality, it is recommended to use the webcam in normal or well-lit environments and select suitable video settings in your application. Proper lighting helps achieve a clearer and more balanced image.
- Plug-and-Play & Upgraded USB Connectivity - New C960 webcam features both USB Type-A & A-to-C adapter connections for wider compatibility. For stable performance, connect the webcam directly to the computer's main USB port and ensure the device is recognized correctly. If a hub or docking station is used, please ensure it provides sufficient power and stable data transmission, as limited ports may affect performance. 90° wide-angle lens captures more participants without frequent adjustments.
- High Compatibility & Multi Application - C960 webcam for laptop is compatible with Windows 10/11, macOS 10.14+, and Android TV 7.0+. Not supported: Windows Hello, TVs, tablets, or game consoles. It works with Zoom, Teams, Facetime, Google Meet, YouTube and more. Please select C960 webcam as the default camera and microphone device in your application and ensure camera/microphone permissions are enabled, especially on macOS. (Tips: Incompatible with Windows Hello)
Split alerts by VM or computer
A VM-scoped alert is limited to that VM, but it requires a separate rule for each VM. To monitor many VMs with one workspace-scoped rule:
- Change the scope to the Log Analytics workspace.
- Use a query that returns the event records.
- Project _ResourceId and, if useful, Computer.
- In Dimensions, select _ResourceId as the resource dimension to create a separate alert instance per VM.
- Select Computer as another dimension if the computer name should appear in alert context.
A dimension must be present in the query result before it appears in the Dimension name list. Select Include all future values when newly appearing VMs or computer names should automatically be included.
For example: Event | where EventLevelName == “Error” | project TimeGenerated, Computer, EventLog, EventID, EventLevelName, RenderedDescription, _ResourceId.
Attach an action group
- Open the Actions tab.
- Select Select action groups.
- Select an existing action group, or select Create action group.
- For a new group, specify its subscription, resource group, action group name, and display name.
- Open the Notifications tab and add the required notification method, such as email or SMS.
Reuse an existing action group when the recipients and escalation behavior are already appropriate. Avoid adding unnecessary action groups because alert-rule properties have a combined serialized-size limit of 64 KB.
Finish the alert rule
- Open the Details tab.
- Enter the alert rule name and description.
- Select the subscription and resource group for the alert rule.
- Set the alert severity.
- Under Advanced options, decide whether to enable the rule upon creation.
- Enable Automatically resolve alerts if the alert should become resolved when the query condition is no longer true.
- Select Create alert rule.
Optional: add the event-log data source with Azure CLI
The Windows Event Log DCR command is provided by the monitor-control-service Azure CLI extension and requires Azure CLI 2.61.0 or later. The extension installs automatically the first time the command is used.
After creating a DCR, add Application and System critical, error, and warning events with:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →az monitor data-collection rule windows-event-log add –rule-name myCollectionRule –resource-group myResourceGroup –name appTeam1AppEvents –streams Microsoft-WindowsEvent –x-path-queries “Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]” “System![System[(Level = 1 or Level = 2 or Level = 3)]]”
Best Value
- Compatible with Nintendo Switch 2’s new GameChat mode
- HD lighting adjustment and autofocus: The Logitech webcam automatically fine-tunes the lighting, producing bright, razor-sharp images even in low-light settings. This makes it a great webcam for streaming and an ideal web camera for laptop use
- Advanced capture software: Easily create and share video content with this Logitech camera that is suitable for use as a desktop computer camera or a monitor webcam
- Stereo audio with dual mics: Capture natural sound during calls and recorded videos with this 1080p webcam, great as a video conference camera or a computer webcam
- Full HD 1080p video calling and recording at 30 fps. You'll make a strong impression with this PC webcam that features crisp, clearly detailed, and vibrantly colored video
The required arguments identify the DCR, data source, and resource group. –streams identifies the destination stream/schema, while –x-path-queries contains the channel-qualified XPath filters.
Important query and scope limitations
- Start a log alert query with a table such as Event. Avoid search and union for ordinary log search alerts; they add overhead and reduce query optimization. The portal does not support creating or modifying ordinary log search alert rules using those operators, except for supported cross-resource queries.
- Avoid take and limit in alert queries unless they are required. Their changing results can increase latency and load.
- Cross-resource queries use the current Scheduled Query Rules API; the legacy Log Analytics Alert API does not support them.
- Collecting the Windows Security channel with this DCR sends the events to Event. The SecurityEvent table is used when Microsoft Sentinel’s Windows Security Events via AMA connector is enabled instead.
- Recommended Azure VM alerts cover host metrics, not guest event logs. Guest event-log alerting still requires AMA, a DCR, a workspace, and a log alert.
FAQ
Why is my Azure VM event-log alert not firing?
First query the workspace’s Event table directly. If no rows appear, the problem is collection rather than alerting: verify AMA, the DCR association, the selected channel and severity, and that a matching event occurred after deployment. If rows appear, run the exact query used by the rule and check its aggregation window, threshold, evaluation frequency, scope, and action group.
Should I query Event or SecurityEvent?
For Windows events collected through a standard AMA Windows Event Logs data source in a DCR, query Event. Use SecurityEvent for the Microsoft Sentinel Windows Security Events via AMA connector path.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDo I need to add | count to an Azure Monitor log alert query?
No. For a row-based condition, select Count the number of Table rows in the alert condition. Azure Monitor supplies that count. Adding | count can cause the alert to count a single aggregate result instead of the matching event rows.
Can one alert monitor several Azure VMs?
Yes. Scope the rule to the Log Analytics workspace and query the shared Event table. Project _ResourceId and select it as a dimension to create separate alert instances for each VM. A VM-scoped rule monitors only one VM.
Why can I not collect an Analytic or Debug event channel?
AMA cannot collect Windows Event Log channels of type Analytic or Debug because Windows does not allow the EvtSubscribe API subscription required for those channels.
How quickly does a new DCR start producing events?
Allow several minutes for deployment and ingestion. The event must also occur on the VM after collection is active; creating the DCR does not backfill every event that was already in the local log.
The Bottom Line
The dependable configuration is AMA → DCR → Log Analytics Event table → KQL log alert → action group. Validate ingestion before creating the rule, use a simple table-first query such as Event | where EventID == 1035, and use _ResourceId as a dimension when one workspace-scoped alert needs to identify individual VMs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
