Create an Alert in Microsoft Azure Log Analytics

By:   |   Comments   |   Related: > Azure


You want to create an alert in Log Analytics to monitor Performance Monitor counters and / or Event Logs and need a quick way to jump in and get familiar with it.


Log Analytics is a service in Operations Management Suite (OMS) that monitors your cloud and on-premises environments to maintain their availability and performance. It collects data generated by resources in your cloud and on-premises environments and from other monitoring tools to provide analysis across multiple sources. (Source:

Digging deeply into this service is out of scope for this tip. However, diving in and creating a simple alert is a great place to get started. 

We’ll walk through the following:

  • Creating a Workspace - A workspace is the basic organizational unit for Log Analytics.
  • Installing and configuring the Microsoft Monitoring Agent - The agent is the conduit from Windows and / or Linux monitored machines back to Log Analytics.
  • Creating an alert - We can create alerts based on Windows Event Logs, Windows Performance Counters, Linux Performance Counters, IIS Logs, Custom Fields, Custom Logs and Syslog. In our example, we’ll keep it simple and get started with an alert based on the ‘% Processor Time’ Windows Performance Counter. 

We’ll have a functioning Log Analytics alert when we’re done.

Creating a Workspace

Let’s get started.

Login to the Microsoft Azure Portal at

Start typing Log Analytics in the search box (as shown below) and click on Log Analytics when it comes up in the results.

microsoft azure dashboard

Then click on Add.

log analytics
  • Name your new, uniquely named OMS Workspace
  • Choose your Subscription
  • Create a new or use an existing Resource Group
  • Choose Location
  • Choose Pricing Tier
oms workspace

Then click OK.

Wait for the deployment to complete and click Refresh.

log analytics

You will now see the new Workspace we just created. Go ahead and click on it.

Click on OMS Portal (it will open in another tab).

oms workspace

Click on the Settings icon in the upper right hand section of the OMS Portal.

oms settings

Installing the Microsoft Monitoring Agent

At this point we are not monitoring any machines and need to install the Microsoft Monitoring Agent on any machines we want to collect data from.

Choose Connected Sources > Windows Servers.

Click on ‘Download Windows Agent (64 bit)’ (presuming you’re installing on a 64 bit machine) to download the installer to your machine.

connect server to oms

Go to the desktop of the Windows machine you want to install the agent on and run MMASetup-AMD64.exe from the location you saved it.

Click through until you get to the Agent Setup Options screen and check ‘Connect the Agent to Azure Log Analytics (OMS)’.

install oms agent

Then click Next.

On the Azure Log Analytics (OMS) tab, click Add.

install oms agent

Copy and paste the Workspace ID and Key from Windows Server window in the OMS Portal, then click Next.

install oms agent

Then click Install and then Finish.

install oms agent

The agent is installed. Repeat for other machines. This process can be automated and installed on multiple machines, but that’s a topic for another tip and day.

Creating an Alert

Now we can go back the OMS Portal.

Let’s create an alert to tell us when CPU goes over a threshold of 90% on a machine we are monitoring.

On the left side of the screen, click on the Log Search icon and this opens the Log Search window.

(1) Paste the following in the search window (Note: this is based on the new Log Analytics Query Language):

| where ObjectName == "Processor"
| where CounterName == "% Processor Time"
| where InstanceName == "_Total"
| where CounterValue > 90

(2) Click on the Search button on the right to see if there are any records. In this case we have no values over 90%, so there are no records returned in the results section.

log search

(3) To turn this query into an alert, click on the Alert icon in the upper left as shown above and the window below will open.

Enter values for:

  1. Name
  2. Description
  3. Severity
  4. Time window
  5. Alert frequency
  6. Number of results
  7. Subject
  8. Recipients
  9. and the click Save to save the alert.
create alert

After saving the Alert, you will get this window.

alert completion

When we look at the alerts that were setup, we can see them as shown below.

oms alerts

And we’re done.

Next Steps

sql server categories

sql server webinars

subscribe to mssqltips

sql server tutorials

sql server white papers

next tip

About the author
MSSQLTips author Joe Gavin Joe Gavin is from the Greater Boston area. He started working with SQL Server and Sybase in 1998 in the financial services industry and has been a SQL Server Database Administrator for a dairy cooperative since 2011. He graduated from Northeastern University in Boston with a Bachelor of Science in Engineering Technology (BSET) degree in Computer Technology. Joe has spoken at the Boston and Providence SQL Saturday events.

This author pledges the content of this article is based on professional experience and not AI generated.

View all my tips

Comments For This Article

get free sql tips
agree to terms