Find Azure VMs That Have Stopped Sending Heartbeat for More Than 15 Minutes
A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?
Quick Answer
The correct answer is `Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m)`. This query works because the Heartbeat table logs a signal from Azure Monitor agents every five minutes by default, so summarizing the maximum `TimeGenerated` per computer and filtering for values older than 15 minutes directly identifies VMs that have missed at least three consecutive heartbeats, indicating they are likely offline. On the AZ-104 exam, this tests your ability to use the `summarize` operator with `max()` to find the most recent event and then apply a time filter with `ago()`—a common pattern for monitoring agent health. A frequent trap is forgetting that `ago(15m)` looks backward from the current time, not from a fixed point, or using `min()` instead of `max()`, which would return the first heartbeat rather than the last. Remember the memory tip: “Max for the latest, ago for the gap”—use `max(TimeGenerated)` to get the most recent ping, then `ago(15m)` to catch the missing ones.
⚠ Common exam trap
Many candidates confuse the Heartbeat table with other log tables (AzureActivity, Perf, SecurityEvent) that contain different data types, leading them to pick a query that looks for 'heartbeat' in the wrong table or uses irrelevant metrics like CPU or logon events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m)
The Heartbeat table in Log Analytics records a heartbeat signal from Azure Monitor agents every 5 minutes by default. The query uses `summarize` to find the latest `TimeGenerated` per computer, then filters with `where LastSeen < ago(15m)` to identify VMs that have not sent a heartbeat in over 15 minutes, indicating they are likely offline or unresponsive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m)
Why this is correct
This query uses the Heartbeat table to identify the most recent signal from each VM and filters for machines whose latest heartbeat is older than 15 minutes. That is the correct pattern for detecting VMs that are no longer reporting to Log Analytics or Azure Monitor. It is practical, concise, and directly aligned to troubleshooting agent connectivity or VM availability.
- ✗
AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroup
Why it's wrong here
AzureActivity tracks control-plane operations, not VM heartbeat telemetry, so it will not identify silent agents.
When this WOULD be correct
If the question asked for the number of Azure activity log entries related to 'Heartbeat' operations per resource group, this query would be correct.
- ✗
Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer
Why it's wrong here
Perf is useful for performance counters, but CPU data does not indicate whether the VM has stopped sending heartbeat records.
When this WOULD be correct
This query would be correct if the question asked: 'Which query returns the average CPU usage per Azure virtual machine over the last hour?'
- ✗
SecurityEvent | where EventID == 4624 | summarize count() by Computer
Why it's wrong here
SecurityEvent contains Windows security logs and successful sign-ins, which are unrelated to heartbeat reporting status.
When this WOULD be correct
A question asking: 'Which query returns the number of successful logon events per computer in the last 24 hours?' would make this option correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m)Correct answer▾
Why this is correct
This query uses the Heartbeat table to identify the most recent signal from each VM and filters for machines whose latest heartbeat is older than 15 minutes. That is the correct pattern for detecting VMs that are no longer reporting to Log Analytics or Azure Monitor. It is practical, concise, and directly aligned to troubleshooting agent connectivity or VM availability.
✗AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroupWrong answer — click to see why▾
Why this is wrong here
AzureActivity does not contain heartbeat data; heartbeats are logged in the Heartbeat table. This query also counts events by resource group instead of identifying VMs with no recent heartbeat.
★ When this WOULD be the correct answer
If the question asked for the number of Azure activity log entries related to 'Heartbeat' operations per resource group, this query would be correct.
Why candidates choose this
Candidates may mistakenly think heartbeat events are recorded in the AzureActivity table, or they may confuse 'heartbeat' with general activity log operations.
✗Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by ComputerWrong answer — click to see why▾
Why this is wrong here
The Perf table contains performance counters like '% Processor Time', not heartbeat data. This query calculates average CPU usage per computer, which does not identify VMs that have stopped sending heartbeats.
★ When this WOULD be the correct answer
This query would be correct if the question asked: 'Which query returns the average CPU usage per Azure virtual machine over the last hour?'
Why candidates choose this
Candidates may confuse performance monitoring with health monitoring, thinking that a lack of CPU data implies a stopped VM, or they may mistakenly believe the Perf table includes heartbeat information.
✗SecurityEvent | where EventID == 4624 | summarize count() by ComputerWrong answer — click to see why▾
Why this is wrong here
SecurityEvent with EventID 4624 logs successful user logons, not VM heartbeats. It cannot determine if a VM has stopped sending heartbeats.
★ When this WOULD be the correct answer
A question asking: 'Which query returns the number of successful logon events per computer in the last 24 hours?' would make this option correct.
Why candidates choose this
Candidates may confuse security events (like logons) with agent heartbeats, assuming any event from a VM indicates its health status.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A help desk analyst needs to find Azure VM heartbeat records in Log Analytics and limit results to the last 30 minutes. Which two KQL elements should be used? Select two.
easy- ✓ A.where
- ✓ B.ago()
- C.summarize
- D.join
- E.extend
Why A: The `where` operator filters the result set based on a specified condition, which is essential for limiting records to those with a timestamp within the last 30 minutes. The `ago()` function returns a datetime value representing the current time minus a given timespan, allowing you to create a dynamic filter like `where TimeGenerated > ago(30m)`. Together, they enable precise time-based filtering in Kusto Query Language (KQL) for Log Analytics.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.