Create an Alert in Microsoft Azure Log Analytics

By:   |   Updated: 2018-01-17   |   Comments   |   Related: > Azure


You want to create an alert in Log Analytics to monitor Performance Monitor counters and / or Event Logs and need a quick way to jump in and get familiar with it.


Log Analytics is a service in Operations Management Suite (OMS) that monitors your cloud and on-premises environments to maintain their availability and performance. It collects data generated by resources in your cloud and on-premises environments and from other monitoring tools to provide analysis across multiple sources. (Source:

Digging deeply into this service is out of scope for this tip. However, diving in and creating a simple alert is a great place to get started. 

We’ll walk through the following:

  • Creating a Workspace - A workspace is the basic organizational unit for Log Analytics.
  • Installing and configuring the Microsoft Monitoring Agent - The agent is the conduit from Windows and / or Linux monitored machines back to Log Analytics.
  • Creating an alert - We can create alerts based on Windows Event Logs, Windows Performance Counters, Linux Performance Counters, IIS Logs, Custom Fields, Custom Logs and Syslog. In our example, we’ll keep it simple and get started with an alert based on the ‘% Processor Time’ Windows Performance Counter. 

We’ll have a functioning Log Analytics alert when we’re done.

Creating a Workspace

Let’s get started.

Login to the Microsoft Azure Portal at

Start typing Log Analytics in the search box (as shown below) and click on Log Analytics when it comes up in the results.

microsoft azure dashboard

Then click on Add.

log analytics
  • Name your new, uniquely named OMS Workspace
  • Choose your Subscription
  • Create a new or use an existing Resource Group
  • Choose Location
  • Choose Pricing Tier
oms workspace

Then click OK.

Wait for the deployment to complete and click Refresh.

log analytics

You will now see the new Workspace we just created. Go ahead and click on it.

Click on OMS Portal (it will open in another tab).

oms workspace

Click on the Settings icon in the upper right hand section of the OMS Portal.

oms settings

Installing the Microsoft Monitoring Agent

At this point we are not monitoring any machines and need to install the Microsoft Monitoring Agent on any machines we want to collect data from.

Choose Connected Sources > Windows Servers.

Click on ‘Download Windows Agent (64 bit)’ (presuming you’re installing on a 64 bit machine) to download the installer to your machine.

connect server to oms

Go to the desktop of the Windows machine you want to install the agent on and run MMASetup-AMD64.exe from the location you saved it.

Click through until you get to the Agent Setup Options screen and check ‘Connect the Agent to Azure Log Analytics (OMS)’.

install oms agent

Then click Next.

On the Azure Log Analytics (OMS) tab, click Add.

install oms agent

Copy and paste the Workspace ID and Key from Windows Server window in the OMS Portal, then click Next.

install oms agent

Then click Install and then Finish.

install oms agent

The agent is installed. Repeat for other machines. This process can be automated and installed on multiple machines, but that’s a topic for another tip and day.

Creating an Alert

Now we can go back the OMS Portal.

Let’s create an alert to tell us when CPU goes over a threshold of 90% on a machine we are monitoring.

On the left side of the screen, click on the Log Search icon and this opens the Log Search window.

(1) Paste the following in the search window (Note: this is based on the new Log Analytics Query Language):

| where ObjectName == "Processor"
| where CounterName == "% Processor Time"
| where InstanceName == "_Total"
| where CounterValue > 90

(2) Click on the Search button on the right to see if there are any records. In this case we have no values over 90%, so there are no records returned in the results section.

(3) To turn this query into an alert, click on the Alert icon in the upper left as shown above and the window below will open.

Enter values for:

  1. Name
  2. Description
  3. Severity
  4. Time window
  5. Alert frequency
  6. Number of results
  7. Subject
  8. Recipients
  9. and the click Save to save the alert.
create alert

After saving the Alert, you will get this window.

alert completion

When we look at the alerts that were setup, we can see them as shown below.

oms alerts

And we’re done.

Next Steps

get scripts

next tip button

About the author
MSSQLTips author Joe Gavin Joe Gavin is from Greater Boston. He has held many roles in IT and is currently a SQL Server Database Administrator.

View all my tips

Article Last Updated: 2018-01-17

Comments For This Article


get free sql tips
agree to terms