Designing Azure Logging Solutions with AMA and Log Analytics
Short answer
VM1: Azure Monitor Agent; VM2: Log Analytics workspace
Question
You have an Azure subscription that contains the virtual machines shown in the following table.
You need to recommend a logging solution for the virtual machines. The solution must meet the following requirements:
• Operating system logs from VM1 must be collected and stored in a Log Analytics workspace.
• Syslog data logs from VM2 must be archived to a storage account.
What solution should you include in the recommendation for each virtual machine? To answer, drag the appropriate solutions to the correct virtual machines. Each solution may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Key Takeaways
The trap is confusing the collector (Agent) with the destination/hub (Workspace); the Agent is mandatory for guest OS logs, while the Workspace is required to enable data export rules for archival.
Learn how to assign the Azure Monitor Agent to VM1 for OS log collection and the Log Analytics workspace to VM2 for syslog archiving to storage.
Common mistake: Selecting only the Agent for both or using legacy Diagnostic Settings instead of AMA. Legacy settings are deprecated for new deployments and do not support the same granular data export features as the modern AMA + Workspace model.
Expert Analysis
The correct solution for VM1 is the Azure Monitor Agent (AMA). This agent is required to collect guest-level operating system logs (such as Windows Event Logs) and forward them to a Log Analytics workspace. Without the AMA, Azure cannot ingest these specific OS logs from the virtual machine.
For VM2, the requirement is to archive syslog data to a storage account. The appropriate component to include in the recommendation is the Log Analytics workspace. Syslog data is collected by the AMA into the Log Analytics workspace. To meet the archival requirement, you configure a Data Export rule within that workspace to send the data to Azure Blob Storage. While the AMA collects the data, the workspace acts as the central hub that enables the archiving mechanism. Therefore, the workspace is the critical infrastructure component needed to facilitate the storage account destination.
Official Reference
- https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agent-windows
- https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-export
These links open the official vendor documentation in a new tab.
Exam Strategy
When designing logging solutions, always distinguish between the data source (Guest OS), the collector (Azure Monitor Agent), and the destination/handler (Log Analytics Workspace). For any requirement involving 'archiving' or 'export' from logs, the Log Analytics Workspace is the primary enabler via its Data Export feature, while the Agent is the prerequisite for collecting guest-level telemetry.
Frequently Asked Questions
Why can't I use Diagnostic Settings for VM1?
Does the Log Analytics workspace collect data itself?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
AllanHouston 👍 1VM1: Azure Monitor Agent VM2: Azure Monitor Logs VM1 requires the Azure Monitor Agent to actually perform the guest-level collection of Windows operating-system logs. VM2 relies on Azure Monitor Logs because its core requirement is archiving to a storage account. This task handled is handled specifically by the Azure Monitor Logs data-export feature (via Log Analytics workspace) rather than the Azure Monitor Agent itself.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →