When logs fail to appear in a Log Analytics Workspace after configuring a Data Collection Rule (DCR), the root cause typically falls into one of four categories: missing resource association, agent/extension issues, network connectivity blocks, or RBAC/schema mismatches.

Follow these sequential steps to diagnose and isolate where the ingestion pipeline is breaking:

1.Verify Data Collection Rule Association (DCRA):1-2 minutes.

A DCR does not collect logs from a resource unless an explicit association exists.

1. Go to Azure Monitor > Data Collection Rules and open your DCR.
2. Click Resources under Configuration.
3. Verify that your target Virtual Machine, Arc Server, or resource is listed.

Verification: If missing, click + Add and associate the resource. Wait 5 minutes for the DCR deployment payload to push down to the agent.

2.Check Agent Extension Status & Managed Identity:3-5 minutes.

For Azure Monitor Agent (AMA), the extension must be healthy and the VM’s Managed Identity active.

1. Navigate to your target VM > Extensions + applications.
2. Confirm that AzureMonitorWindowsAgent or AzureMonitorLinuxAgent is installed and shows Provisioning Succeeded.
3. Ensure the VM has an active System-Assigned or User-Assigned Managed Identity enabled.

Verification: Run a KQL query in your Log Analytics workspace to check if heartbeats are arriving:

kql

Heartbeat
| where Computer == "YourComputerName"
| where Category == "Azure Monitor Agent"

If no heartbeat appears, the agent is either offline or blocked by local runtime errors.

3.Test Network & Data Collection Endpoint (DCE) Connectivity:5-10 minutes.

If the VM is behind a firewall, Network Security Group (NSG), or Private Link, the agent will fail to transmit data.

1. Ensure the VM can reach the required Azure Monitor endpoints on port 443:
   • *.handler.control.monitor.azure.com
   • *.ingest.monitor.azure.com
2. If using Azure Private Link, ensure a Data Collection Endpoint (DCE) is linked to both the DCR and your Private Link Scope (AMPLS).

Verification: Run a connectivity test directly from the VM:

PowerShell

# Windows PowerShell
Test-NetConnection -ComputerName "your-dce-endpoint.ingest.monitor.azure.com" -Port 443

Bash

# Linux Terminal
curl -v https://your-dce-endpoint.ingest.monitor.azure.com

4.Verify RBAC Permissions & Schema for Custom Logs/APIs:Custom Ingestion Checks.

If ingesting logs via the Logs Ingestion API or a custom table:

1. Role Assignment: Ensure the sending application or service principal is assigned the Monitoring Metrics Publisher role on the DCR itself.
2. Table Schema: Ensure the destination custom table (ending in _CL) exists in the Log Analytics workspace and matching fields are properly defined.
3. Ingestion Time Lag: New custom tables or first-time DCR associations can take up to 15 minutes to process initial schemas and show output.

Verification: Query the _CL custom table directly or check the Azure Activity Log for 403 (Forbidden) authorization failures.

5.Run the On-Host AMA Troubleshooter Tool:Diagnostics.

If heartbeats and networking pass but specific event logs/syslogs still fail to appear, run the native troubleshooter script on the host machine:

• Windows (PowerShell as Admin):

PowerShell

C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent\<version>\Troubleshooter\AgentTroubleshooter.exe --ama

• Linux (Terminal as root):

Bash

sudo sh /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-<version>/ama_tst/ama_troubleshooter.sh

Verification: The script checks local configuration files, parses cached DCR JSON schemas, and outputs actionable failure codes (e.g., invalid XPath stream or corrupted datastore).
Azure Monitor Agent NOT Ingesting Logs & No Heartbeat? REAL FIX!

This video provides a practical, hands-on walkthrough for diagnosing Azure Monitor Agent log ingestion failures, verifying agent heartbeats, and resolving common DCR configuration issues.