Troubleshooting Azure Log Ingestion

Last updated - 29 October, 2025

When integrating Azure with LogicMonitor, you may encounter situations such as log data not displaying in LM Logs as expected. Azure log ingestion issues can result from configuration errors, connectivity problems, or deployment changes within the integration environment.

Logs Do Not Display in LM Logs

If you set up your LogicMonitor environment to ingest logs from Azure, logs may not display on your LM Logs page. There are several reasons logs you ingest from Azure may not display, including unprovisioned Azure resources, logs not being sent to the Event Hub, the Azure function not forwarding logs, or templates that need to be updated. You can also enable debug logging to aid in troubleshooting.

Requirements for Resolving Logs Do Not Display in LM Logs

To resolve the issue with logs not displaying in LM Logs, you need the following:

• An Azure Cloud account created in your LogicMonitor portal 
• A User Administrator role in Azure to manage the Event Hub and Azure function

Resolving Logs Do Not Display in LM Logs

• Confirm that Azure provisioned all the following required resources:
  • Event Hub
  • Resource group
  • Storage account
  • Azure Function
• Confirm that longs are sent to the Event Hub by doing the following:
  • Navigate to your Event Hub in the Azure portal and verify that the Incoming Messages count is greater than zero
  • Verify specific agents or applications by looking in their Azure Logs folder
    For example, if you are running a Windows VM with an IaaSDiagnostics extension, the Azure logs are in the following Azure Logs directory:
    C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Diagnostics.IaaSDiagnostics<VERSION><WADID>\Configuration
• Confirm the Azure Function forwards logs to LogicMonitor by doing the following:
  • If the Function App is running and receiving logs, but you are not seeing the logs in LogicMonitor, confirm that the LM_Access_Key or LM_Access_Id provided is correct.
  • If the Function App is not running, but logs are sent to the Event Hub, try to run the Azure function locally and verify if it receives any log messages by doing one of the following:
    • If the local function receives logs, stop and run the function on the Azure Portal. You can verify logs using the Azure CLI.
    • If the local function does not receive logs, verify its connection string and the shared access policy of the Event Hub.
• Use PowerShell to send a test event from the log-enabled VM by doing the following:
  • On the configured resource, enter the PowerShell prompt and run the following command: 
    eventcreate /Id 500 /D "test error event for windows" /T ERROR /L Application
    After the command runs, the event will display LM Logs.
• Update the template
  • You may need to update the template after deployment if there are changes to credentials or parameters. After you complete the update, redeploy the template. For more information, see Quickstart: Create and deploy ARM templates by using the Azure portal from Microsoft.
• Verify that the Function App receives logs
  • Verify the Function App is receiving logs by enabling Application Insights. For more information, see Enable streaming execution logs from Microsoft.
  • You can configure the application logging type and level using the Azure CLI webapp log config command. For more information, see az webapp log from Microsoft.
  • After configuring application logging, you can see the logs using Azure CLI webapp log tail. For more information, see az webapp log tail from Microsoft.
• Remove the LM Logs integration to stop the flow of data and associated costs by doing the following:
  1. Before removing the Azure resource group for LM Logs, ensure you have not added other non-LM Logs items into the resource group.
  2. In your Azure portal, navigate to the monitored VM > Activity log > Diagnostic settings > Edit setting (for the Logs Event Hub) and select Delete.
  3. Delete the Event Hub which has the name and region name that you created during setup. This cuts off the logs flow from Azure to LM Logs.
  4. You can remove all other resources created by template deployment such as the Function App, Managed Identity, App Insight, and Storage account. The names of these resources follow the Event Hub naming convention from the template. You can remove each item individually, or if they are in a resource group, you can remove the entire group. For more information, see Delete resource groups from Microsoft.