VM Insights - Not logging all running processes? - azure

Question

I was wondering why VM Insights doesn't log all running processes on a VM when using the Service MAP & Dependency options. I dump this information into a log analytic workspace and run the KQL:
VMProcess |
where UserName =~'admin_local'
It shows me only a few processes that are running, but not everything, e.g. 'notepad.exe', even though I have Notepad open & running in the VM.
How would one achieve this?
Many thanks in advance!

Answer 1

When you use service dependencies or enable Monitoring for Azure VM’s from Azure Monitor section, Not all processes are logged. As every process writes to a performance counter that is not collected by Azure monitor or device map dependencies. Notepad.exe falls under performance counter logs in Azure Log analytics. So you need to select the required process from the data-source to enable logging of all the processes you need.
I tried enabling Azure VM logging via Azure Monitor with Service Map or Dependency but did not receive logs on all the processes. But when I explicitly added Notepad as a data source in the Windows Performance counter, I got the required notepad process.
Notepad is not visible in the VMProcesses or Service Map :-
Deploy a Log Analytics Workspace and select Agents management > Data Collection Rules >
Click on Add resources and add your VM
Collect the notepad process and other required processes data that are needed to be logged.
As Notepad is part of performance counter and not an Event create a custom rule for notepad performance counter like below :-
Select other processes for Logs :-
And Added Data collection rules for both Performance Counters and Event Logs like below :-
My VM got connected to the Log analytics workspace like below :-
after 30 mins, the selected custom log data is visible in the Logs section in the Perf table :-
You can also enable Performance counter logs from your existing Data collection rule from Azure Monitor like below :-
In order to get logs of all the processes you need to enable Logs from Performance counter and add custom logs if required by adding those logs in Data collection rule.