Exam MD-102 topic 1 question 25 discussion

Answer id BCD: - A: No security-event loggings in LogAnalytics Agent (MMA) - B: the list of processes and their execution times: Yes, try it if you want in LogAnalytics: Perf | where ObjectName == "Process" and CounterName == "% Processor Time" You will see all processes of all the computers and their run time. - C: the average processor utilization: Yes, run: InsightsMetrics | where Origin == "vm.azm.ms" | where Namespace == "Processor" and Name == "UtilizationPercentage" D: Yes, Systemlogs are collected. E: Log files apart from Application and System logs are NOT collected. For sure not if they are text-based log files. Only Eventlogs. No textfiles.

The Log Analytics agent itself does not natively collect detailed process information, such as a list of processes and their execution times, without additional configuration. B is wrong.

C: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-performance-counters#log-queries-with-performance-records D: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog E: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-custom-logs

Security Log Events: Log Analytics can collect various types of events from the Security log, which includes failure events. This is useful for monitoring security-related incidents on your devices. Processor Utilization: Performance data, such as average processor utilization, can be collected to monitor the performance and health of your devices. System Log Events: Error events from the System log can be collected to help diagnose and troubleshoot issues on your devices. Options B and E are not correct because Log Analytics does not natively collect detailed process execution times or third-party application logs stored as text files without additional configuration or custom log collection setups. correct answers are: A, C, D

B. the list of processes and their execution times C. the average processor utilization E. third-party application logs stored as text files

The three types of data that you can collect from the computers using Azure Log Analytics are: B. the list of processes and their execution times: Log Analytics can collect process-related information, including details about running processes and their resource consumption. C. the average processor utilization: Log Analytics can capture performance-related data, such as CPU utilization metrics, which can include averages over time. D. error events from the System log: Log Analytics can gather events from Windows Event Logs, including error events from the System log, providing insights into system-level issues and errors. Therefore, the correct selections are: B. the list of processes and their execution times C. the average processor utilization D. error events from the System log

It's probably outdated and you won't see those exact answers on the exam. MMA is being replaced with AMA and it does collect custom text logs ( https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log?WT.mc_id=AZ-MVP-5000120&tabs=portal ).

See comment from HvD.

BCD List of processes and their execution times Average processor utilization (these are performance metrics and easily captured by Log Analytics) Error events from System log

BCD - I've set this up in a Log Analytics Workspace and tried it myself.

CDE Windows Event logs Information sent to the Windows event logging system Syslog Information sent to the Linux event logging system Performance Numerical values measuring performance of different aspects of operating system and workloads IIS logs Usage information for IIS websites running on the guest operating system Custom logs Events from text files on both Windows and Linux computers https://learn.microsoft.com/en-us/azure/azure-monitor/agents/log-analytics-agent

seems correct

not sure that 3rd party logs can be collected by default, you need SIEM integration / Sentinel Log Analytics documentation dont say much about 3rd party log collection i would go with BCD

1. Performance Data: This includes infomration like the average processor utilization, memory usage, disk performance, and network metrics. 2. Event Log: These logs contain information about system, security, and application events. This includes error events from the System log, failure events from the Security log, and other event logs captured by the operating system. 3. Custom Logs: You can also collect logs from third-arty applications or services. These could be stored as text files or in a specific format, enabling monitoring and analysis within the Log Analytics workspace. I think I will go with CDE.

Why B is not?

Personally I think I'd have to go with BDE

CDE it's a correct answers