Azure Monitor is an analytics and insights tool that monitors the operational health of your applications and provides system-wide visibility of your Network Security deployment. Azure Monitor collects metrics and logs data for your Network Security virtual appliance (NSVA) by monitoring IPS and inspection events. Learn more about Microsoft's Azure Monitor.

Azure Monitor Agent Parent topic

Use the following steps to start using Azure Monitor Agent for Azure Monitor. Learn more about migrating to Azure Monitor Agent from Log Analytics agent in Azure.
Note
Note
Azure Monitor Agent is available in releases on or after August 1st, 2024. For users with NSVAs older than 2024.7, upgrade your Network Security virtual appliance to the latest version, and use the log commands below to disable the previous version of Azure Monitor.

Procedure

  1. Create the Log Workspace if you have not already.
    1. Navigate to Log analytics workspace → + Add.
    2. Fill in the Basics, Pricing tier, and Tags tabs.
    3. Click Review + Create → Create.
  2. Configure your data collection rules. Learn more.
  3. Verify your logs from the Azure Portal by following the steps below.
    1. Select your workspace.
    2. Select Logs → LogManagement → Syslog.
    3. Hover your mouse over Syslog, then click the eye icon. A preview of the data will appear.
    4. Click See in query editor.
      Log commands for Azure Monitor
      Action
      CLI Command
      Enable or disable IPS event logging
      edit > log > azuremonitor ips-event [enable][disable]
      Enable or disable inspection event logging
      edit > log > azuremonitor inspection-event [enable][disable]
      Commit the changes
      commit
      Exit
      exit
      Save the changes
      save-config -y