AzureのLog AnalyticsでLinuxサーバーのログを収集・分析する方法｜Azure Monitor AgentとKQLの実践手順

この記事のポイント

・Azure Monitor Agent（AMA）がLog Analyticsのログ収集の核心でAMAは無料拡張機能
・DCR（Data Collection Rule）でどのログを収集するかを宣言的に定義する
・KQLのSyslogテーブルで複数VMのログを一画面で横断検索できる
・AMAは443/TCPのアウトバウンドが通れば追加のinbound穴あけは不要

# リソースグループを作成（東日本リージョン）
az group create \
  --name rg-monitoring \
  --location japaneast

# Log Analyticsワークスペースを作成
az monitor log-analytics workspace create \
  --resource-group rg-monitoring \
  --workspace-name law-linuxmonitor \
  --location japaneast \
  --retention-time 30

# ワークスペースのリソースIDを取得
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-monitoring \
  --workspace-name law-linuxmonitor \
  --query id \
  --output tsv)
echo $WORKSPACE_ID

/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-linuxmonitor

# Managed Identityを有効化する
az vm identity assign \
  --resource-group rg-monitoring \
  --name vm-rhel94

# Identity が有効か確認
az vm identity show \
  --resource-group rg-monitoring \
  --name vm-rhel94

{
  "principalId": "aabbccdd-1234-5678-90ab-cdef01234567",
  "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "type": "SystemAssigned",
  "userAssignedIdentities": null
}

# RHEL/Rocky/AlmaLinux 系（AzureMonitorLinuxAgent）
az vm extension set \
  --resource-group rg-monitoring \
  --vm-name vm-rhel94 \
  --name AzureMonitorLinuxAgent \
  --publisher Microsoft.Azure.Monitor \
  --version 1.0 \
  --enable-auto-upgrade true

# VM内でサービス状態を確認
$ sudo systemctl status azuremonitoragent

* azuremonitoragent.service - Azure Monitor Agent
   Loaded: loaded (/lib/systemd/system/azuremonitoragent.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2026-06-30 10:15:22 UTC; 3min ago
 Main PID: 1842 (mdsd)

Jun 30 10:15:22 vm-rhel94 systemd[1]: Started Azure Monitor Agent.

# dcr-syslog.json を作成する（workspaceResourceIdは実際の値で置き換える）
cat << 'JSONEOF' > /tmp/dcr-syslog.json
{
  "location": "japaneast",
  "properties": {
    "dataSources": {
      "syslog": [
        {
          "name": "syslog-datasource",
          "streams": ["Microsoft-Syslog"],
          "facilityNames": ["auth", "authpriv", "kern", "syslog"],
          "logLevels": ["Warning", "Error", "Critical", "Alert", "Emergency"],
          "sendToChannels": ["dcr-channel"]
        }
      ]
    },
    "destinations": {
      "logAnalytics": [
        {
          "workspaceResourceId": "/subscriptions/xxxx/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-linuxmonitor",
          "name": "dcr-channel"
        }
      ]
    },
    "dataFlows": [
      {
        "streams": ["Microsoft-Syslog"],
        "destinations": ["dcr-channel"]
      }
    ]
  }
}
JSONEOF

# DCRを作成する
az monitor data-collection rule create \
  --resource-group rg-monitoring \
  --name dcr-syslog-linux \
  --rule-file /tmp/dcr-syslog.json

# 作成したDCRのリソースIDを取得
DCR_ID=$(az monitor data-collection rule show \
  --resource-group rg-monitoring \
  --name dcr-syslog-linux \
  --query id \
  --output tsv)

# VMのリソースIDを取得
VM_ID=$(az vm show \
  --resource-group rg-monitoring \
  --name vm-rhel94 \
  --query id \
  --output tsv)

# DCRをVMに関連付ける（DCR Association）
az monitor data-collection rule association create \
  --name dcra-vm-rhel94 \
  --resource $VM_ID \
  --rule-id $DCR_ID

// 直近1時間のエラーログ一覧
Syslog
| where TimeGenerated > ago(1h)
| where SeverityLevel in ("err", "crit", "alert", "emerg")
| project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

// VM別のエラー件数を集計（過去24時間）
Syslog
| where TimeGenerated > ago(24h)
| where SeverityLevel in ("err", "crit")
| summarize ErrorCount = count() by Computer
| order by ErrorCount desc

// authlogから「Failed password」を抄出（不正アクセス検知）
Syslog
| where TimeGenerated > ago(6h)
| where Facility == "authpriv"
| where SyslogMessage contains "Failed password"
| project TimeGenerated, Computer, SyslogMessage

# AMA拡張のプロビジョニング状態を確認する
az vm extension show \
  --resource-group rg-monitoring \
  --vm-name vm-rhel94 \
  --name AzureMonitorLinuxAgent \
  --query provisioningState

# VM内の拡張ログを確認する
sudo tail -50 /var/log/azure/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent/extension.log