An engineer at Cascade Regional Airlines is onboarding new reservation servers to Azure Monitor Agent and needs to define exactly which Windows event log channels and performance counters get collected, and which Log Analytics workspace they are sent to. Which object should the engineer create to define this?
Select an answer to reveal the explanation.
Short Explanation
Think of a data collection rule as the recipe card handed to the collection agent: it spells out exactly which ingredients (events, counters) to gather and which kitchen (workspace) to deliver them to. Without one, Azure Monitor Agent doesn't know what to send anywhere.
Full Explanation
A data collection rule (DCR) is the configuration object used with Azure Monitor Agent that specifies which data sources to collect, such as specific performance counters or Windows event log channels, any transformation applied along the way, and the destination workspace the data is sent to. It is then associated with the target VMs so the agent on each one knows what to gather. An alert processing rule modifies how already-fired alerts are routed or suppressed; it has no role in defining what telemetry gets collected in the first place. A diagnostic setting on the subscription forwards subscription-level activity log data to a destination, which is a different data source entirely from VM-level performance counters and event logs. An action group is purely a notification target, such as email or a webhook, invoked when an alert fires, and it has no concept of data collection. A useful check after creating the DCR is to confirm it shows an associated status against the target VMs and that new records begin appearing in the destination workspace's tables within a few minutes.