Azure Data Collection Rule (DCR) – Complete Step-by-Step Practical Guide

In this tutorial, we will create an Azure Data Collection Rule (DCR), associate it with an Azure Virtual Machine, collect Windows Event Logs and performance counters, send them to a Log Analytics Workspace, and verify the collected data using KQL.

We will use the Azure Portal and cover the complete process, including prerequisites, configuration, verification, troubleshooting, and cleanup.

1. What we are going to build

Our practical example uses a Windows Server Virtual Machine running in Azure.

Resources required

Prerequisite: You need an Azure subscription, permissions to create and associate monitoring resources, and a running Azure Windows VM. You can reuse an existing VM and resource group instead of creating new ones.

The instructions below assume that the VM and Log Analytics Workspace are in a compatible Azure region.

2. Create a Log Analytics Workspace

A Log Analytics Workspace is the destination where we will store and query the VM's collected monitoring data.

Step 1: Sign in to Azure Portal

Open portal.azure.com and sign in.

Step 2: Search for Log Analytics Workspaces

In the Azure Portal search bar, enter Log Analytics workspaces and select the service.

Step 3: Click Create

On the Log Analytics workspaces page, select Create.

Step 4: Enter workspace details

Use the following example:

Step 5: Deploy the workspace

Select Review + Create, wait for validation, and click Create.

After deployment succeeds, click Go to resource.

Step 6: Verify the workspace

Open the workspace's Overview page and confirm its name, subscription, resource group, and region.

You now have a destination for collected VM logs.

3. Create the Data Collection Rule

Microsoft's current Azure Portal experience provides a guided DCR creation workflow. Some screens differ between the default and classic experiences.

The screenshots below are illustrative Microsoft documentation images, not screenshots captured from your subscription.

Step 1: Open Data Collection Rules

Navigate to:

Azure Portal → Monitor → Data Collection Rules

 

 

 

learn.microsoft.com

Step 2: Select Create

Click Create to open the DCR configuration wizard.

Step 3: Configure the Basics tab

 

 

 

help.thorntech.com

Enter the following values:

Select the option for collecting VM guest logs and performance data, rather than the separate platform-metrics export workflow.

Important: Create the DCR in the same region as the destination Log Analytics Workspace. The monitored VM may be in another region, subject to the applicable endpoint and connectivity requirements.

Microsoft Learn

+1

4. Associate the Azure VM with the DCR

Step 1: Open the Resources tab

Click Next: Resources.

 

 

 

learn.microsoft.com

Step 2: Add your VM

Click Add resources, select the subscription and resource group, and choose:

vm-monitor-demo

Click Apply.

Step 3: Configure the collection endpoint if requested

For supported public-network VM monitoring scenarios, Azure Monitor can use its default endpoints. If the wizard requires a Data Collection Endpoint (DCE), or your deployment uses Azure Monitor Private Link, select or create a compatible endpoint.

Step 4: Understand the agent installation

When you create the DCR and associate it with the VM, Azure can automatically install the Azure Monitor Agent if necessary.

The agent is responsible for collecting the selected guest operating system data.

Step 5: Continue

Click Next: Collect and deliver, or Next: Collect and deliver / Data sources, depending on the wizard version.

Microsoft Learn

+1

5. Configure Windows Event Logs

Now we will define exactly which Windows events to collect.

Step 1: Add a data source

Select Add data source or Add new datasource.

 

 

 

learn.microsoft.com

Step 2: Choose Windows Event Logs

Set:

Data source type = Windows Event Logs

Step 3: Select log types and severity

For our demonstration, configure:

This will collect matching Application and System errors, rather than every event.

For initial testing, you may also enable Warning events to increase the chance of receiving sample data.

Step 4: Understand the Custom option

The Custom option allows you to define XPath queries to select events.

For example:

Application!*[System[(Level=1 or Level=2)]]
System!*[System[(Level=1 or Level=2)]]

Windows event levels:

The example collects Critical and Error events from the Application and System logs.

For beginners, the Basic selection is easier to configure.

Step 5: Set the destination

Choose Azure Monitor Logs and select the Log Analytics Workspace:

law-monitor-demo

In the current wizard, the destination may be configured within the data-source workflow or in a separate Destinations step.

Save the data-source configuration.

The collected Windows events will be stored in the Event table.

Microsoft Learn

+1

6. Configure Performance Counters

Next, collect performance measurements from the same VM.

Step 1: Add another data source

On the Collect and deliver page, click Add data source again.

Step 2: Choose Performance Counters

Select:

Data source type = Performance Counters

 

 

 

docs.azure.cn

Step 3: Select performance counters

For this example, use the Basic selection where available, or Custom to specify the counters below.

Step 4: Configure the sampling rate

Set the sampling frequency to 60 seconds.

This means the agent attempts to collect the configured counter values once per minute.

A shorter sampling interval provides more detailed measurements but can increase data volume.

Step 5: Choose the destination

Select Azure Monitor Logs and choose:

law-monitor-demo

Save the performance-counter data source.

The selected counters will be available in the Perf table in Log Analytics.

Microsoft Learn

7. Review and create the DCR

Step 1: Review all configurations

Confirm that your rule contains the following settings:

Step 2: Create the rule

Select Review + Create, then Create.

Step 3: Wait for deployment

Azure will create the DCR and its resource association and install the agent if required.

The agent then begins collecting the configured data.

8. Verify Azure Monitor Agent installation

Once deployment is complete, check the agent on your VM.

Step 1: Open the VM

Navigate to:

Azure Portal → Virtual Machines → vm-monitor-demo

Step 2: Open Extensions + applications

Look for:

AzureMonitorWindowsAgent

Step 3: Verify provisioning status

The extension should show a successful provisioning state.

If it failed, open the extension details to inspect the reported error.

Step 4: Verify DCR association

Navigate to:

Monitor → Data Collection Rules → dcr-windows-monitoring → Resources

Confirm that vm-monitor-demo appears in the associated resources.

Note: A successfully provisioned extension does not by itself guarantee successful data ingestion. We must verify the Heartbeat and collected data in Log Analytics.

9. Verify data collection using KQL

Microsoft indicates that data can take up to approximately five minutes to arrive after DCR creation. In some situations, allow additional time for agent provisioning and configuration propagation.

Microsoft Learn

Navigate to:

Azure Portal → Log Analytics workspaces → law-monitor-demo → Logs

 

 

 

learn.microsoft.com

Step 1: Verify agent communication

Run this query:

Heartbeat
| where TimeGenerated > ago(30m)
| where Computer contains "vm-monitor-demo"
| project TimeGenerated, Computer, OSType
| order by TimeGenerated desc

Expected result: Recent heartbeat records from your VM. An operational agent normally sends a heartbeat approximately every minute.

Step 2: Verify Windows Event Logs

Event
| where TimeGenerated > ago(1h)
| where Computer contains "vm-monitor-demo"
| where EventLevelName in ("Error", "Critical")
| project TimeGenerated,
          Computer,
          EventLog,
          EventID,
          EventLevelName,
          RenderedDescription
| order by TimeGenerated desc

This query retrieves the collected Windows Error and Critical events.

If no events appear, your VM may not have generated any matching events during the selected period.

Step 3: Verify CPU performance

Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "Processor"
| where CounterName == "% Processor Time"
| where InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue)
    by bin(TimeGenerated, 5m), Computer
| render timechart

This displays average CPU usage over five-minute intervals.

Step 4: Verify memory performance

Perf
| where TimeGenerated > ago(1h)
| where CounterName == "Available MBytes"
| project TimeGenerated, Computer, CounterValue
| order by TimeGenerated desc

This displays the available memory reported by the VM.

Step 5: Verify all collected performance counters

Perf
| where TimeGenerated > ago(1h)
| summarize Records = count()
    by ObjectName, CounterName
| order by Records desc

This helps verify which performance counters are actually being received.

10. Create a test Windows event

If your Windows Event Logs query returns no results, you can generate a test event on the VM.

Connect to the Windows VM using RDP and open PowerShell as Administrator.

Execute:

New-EventLog -LogName Application `
    -Source "DCRDemo"

Then write an Error event:

Write-EventLog `
    -LogName Application `
    -Source "DCRDemo" `
    -EventId 1001 `
    -EntryType Error `
    -Message "Test error generated for Azure DCR monitoring."

Return to Log Analytics and run:

Event
| where TimeGenerated > ago(30m)
| where EventID == 1001
| where Source == "DCRDemo"
| project TimeGenerated,
          Computer,
          EventID,
          RenderedDescription

If the event appears, you have verified the full collection path from Windows Event Log through AMA and DCR to Log Analytics.

11. Troubleshooting common DCR issues

For more detailed troubleshooting, refer to Microsoft's Azure Monitor Agent troubleshooting guide.

12. Monitor multiple VMs using one DCR

Once the first VM works, you can associate additional Windows VMs with the same rule.

  VM-01         VM-02         VM-03
    |             |             |
   AMA           AMA           AMA
    |             |             |
    +-------------+-------------+
                  |
                  v
       dcr-windows-monitoring
                  |
                  v
         law-monitor-demo
                  |
          +-------+-------+
          |               |
          v               v
      Event Table      Perf Table
          |               |
          +-------+-------+
                  |
                  v
             KQL Queries

Navigate to:

Monitor → Data Collection Rules → dcr-windows-monitoring → Resources → Add

Select the additional VMs and apply the association.

You do not need to create a separate DCR for every VM when they share the same collection requirements.

13. Monitor ingestion volume and costs

Log Analytics ingestion can incur charges depending on your workspace pricing and data volume.

Use this KQL query to review recent billable ingestion by data type:

Usage
| where TimeGenerated > ago(24h)
| where IsBillable == true
| summarize TotalGB = sum(Quantity) / 1000
    by DataType
| order by TotalGB desc

The Usage table provides ingestion accounting information; its values are not necessarily identical to final invoice amounts.

For cost optimization, collect only necessary logs, avoid unnecessary high-frequency counters, and configure appropriate workspace retention.

14. Clean up the demo resources

If you created these resources only for learning, remove them when you finish.

If rg-monitoring-demo contains only disposable demo resources, you can delete the entire resource group.

Navigate to:

Resource groups → rg-monitoring-demo → Delete resource group

Warning: Deleting a resource group permanently removes its contained resources, including the VM and Log Analytics Workspace. Do not delete a shared or production resource group.

15. Official Microsoft screenshots and references

The following Microsoft Learn articles provide the current portal workflow and embedded screenshots:

 

 

 

Collect guest log data from virtual machines

Main practical tutorial covering DCR creation, data sources, resources, destinations, and verification.

 

 

 

 

Collect Windows Event Logs

Portal screenshots and instructions for Windows Event Logs and XPath filtering.

 

 

 

 

Collect Performance Counters

Performance counter configuration, sampling frequency, destinations, and validation.

These official articles are the best references for exact portal screenshots because Azure periodically changes its interface.

16. Final verification checklist

Final outcome: Your Windows VM sends the selected Event Logs and performance counters through Azure Monitor Agent using a DCR to a Log Analytics Workspace. You can now analyze the data using KQL and create alerts based on collected events or performance thresholds.