Monitoring & backup · Lesson 21 of 24

Azure Monitor: metrics, logs, alerts

What Azure records on its own, what you must switch on, and how an alert actually reaches a person.

About 10 min · Interactive · 3 practice questions

Exam objective
Interpret metrics · Configure log settings · Query and analyze logs · Set up alert rules, action groups and alert processing rules · Configure and interpret monitoring with Azure Monitor InsightsMonitor and maintain Azure resources · 10–15% of the exam · typical question: "Keep Activity log N years", "collect Windows events from VMs", alert components, suppressing notifications during maintenance
In one sentence. Azure measures numbers for you automatically (metrics) but keeps text records (logs) only where you route them, and an alert is a rule that watches either and tells a named list of people. Azure keeps two kinds of records. Metrics are numbers it measures for you all the time (CPU %, disk reads); you get them free and they are shown as charts on every resource's Overview. Logs are text records of what happened (someone deleted a VM, a web request returned 500, a Windows event). Logs are only kept if you tell Azure where to put them. Alerts watch either kind and ring someone.
Activity logwho did what · 90 daysResource logsinside a resource · off by defaultGuest OS logsWindows events, syslog, countersDiagnostic settinga routing rule you createAzure Monitor Agent+ data collection ruleLog Analytics workspacequery (KQL), alert · 30 days defaultStorage accountcheap long-term archiveEvent Hubstream to a SIEMMetrics are the other half: numbers sampled automatically, kept 93 days, nothing to set up.

You, the admin: start collecting logs properly

  1. Create one Log Analytics workspace per environment: Log Analytics workspaces › + Create, name LAW-Prod, region same as most resources. Under Usage and estimated costs › Data retention set 90 days (default 30; up to 2 years interactive, then archive to 12 years). You pay per GB ingested.
  2. Keep the Activity log longer than 90 days: Monitor › Activity log › Export Activity Logs › + Add diagnostic setting, tick all categories, destination LAW-Prod.
  3. Get logs from inside a resource: Storage account (or Key Vault, NSG…) › Diagnostic settings › + Add, pick log categories and metrics, destination workspace (to query), storage account (cheap archive) or Event Hub (to a SIEM).
  4. Get Windows event logs and performance counters from VMs: Monitor › Data Collection Rules › + Create, add the VMs as resources, choose Windows Event Logs / Performance counters / Syslog, destination LAW-Prod. This installs the Azure Monitor Agent on each VM for you. (The old Log Analytics agent is retired.)

Asking questions of the logs

Workspace › Logs uses KQL. You will read it, not write it from scratch:

Heartbeat                                  // table: one row per agent check-in
| where TimeGenerated > ago(1h)            // last hour only
| summarize count() by Computer            // group and count
| order by count_ desc                     // biggest first

Tables to recognise: Heartbeat (agent alive), Perf (counters), Event (Windows events), Syslog, AzureActivity, AzureDiagnostics, AzureMetrics, StorageBlobLogs. Operators: where, summarize, project, extend, join, top, render.

Alerts

How an alert reaches a person

  1. Signal and conditionWhich metric or log query, and the threshold: average CPU above 85% for 5 minutes.
  2. Alert rule firesScoped to a resource or group, with a severity 0 (critical) to 4.
  3. Action group runsA reusable list: email, SMS, push, voice, runbook, Function, Logic App, webhook. Create once, attach to many rules.
  4. Alert processing rule may interveneAt a scope it can add action groups in bulk or suppress notifications on a schedule, while alerts keep being recorded.
Signal + conditionCPU avg > 85% for 5 minAlert rule firesseverity 2, scope = VM1Action groupemail ops, SMSProcessing rulesuppress Sat 2-4am
Three objects. The action group is reusable across hundreds of rules; the processing rule can mute notifications without touching the rules.

You, the admin: email ops when VM1's CPU stays above 85%

  1. Make the action group first: Monitor › Alerts › Action groups › + Create, name AG-Ops, notification Email = [email protected] (also SMS, push to the Azure app, voice; and actions: Automation runbook, Function, Logic App, webhook, ITSM, Event Hub).
  2. Monitor › Alerts › + Create › Alert rule. Scope: VM1. Condition: signal Percentage CPU, aggregation Average, operator greater than, threshold 85, check every 1 min, lookback 5 min. (Or tick Dynamic threshold and let Azure learn normal.)
  3. Actions: AG-Ops. Details: severity 2, name, enable on create. Metric alerts auto-resolve when the condition clears.
  4. Maintenance window: Alerts › Alert processing rules › + Create, scope RG-Prod, rule type Suppress notifications, recurring Saturday 02:00 to 04:00. Alerts still fire and show in history; nobody gets paged.
Signal typeExampleNote
MetricCPU, disk queue, HTTP 5xx countNear real time, cheapest, auto-resolves
Log searchKQL returns rows (failed logons > 10)Runs every 5 to 60 min
Activity logAny VM deleted; Service Health incident; Resource Health changeManagement events

Insights are ready-built dashboards: VM insights (performance + a map of which process talks to which port), Storage insights, Network insights, Container insights, Application Insights for code. All built on Workbooks, which you can also edit and pin to a shared dashboard.

Trap wording. "Keep Activity log 2 years and query it" = diagnostic setting → workspace. "Collect Windows events from VMs" = Azure Monitor Agent + data collection rule. "No notifications during maintenance, but keep the records" = alert processing rule (suppress). "Alert fired, nobody told" = no action group attached or a processing rule is suppressing.

Key points

  • Metrics are free numbers, logs are text you must route. Diagnostic settings route platform logs; the Azure Monitor Agent plus a data collection rule gets guest OS logs.
  • Activity log lives 90 days unless sent to a Log Analytics workspace.
  • Alert = signal + condition + action group. Action groups are reusable; alert processing rules suppress notifications without touching rules.
  • KQL: table | where | summarize | order by. Recognise it, do not write it.

Formal terms: Azure Monitor, metric, platform log, diagnostic setting, Log Analytics workspace, KQL, Azure Monitor Agent (AMA), data collection rule (DCR), action group, alert processing rule, Workbook.

Check your understanding

3 exam-style questions in the formats AZ-104 uses. Each is marked when you check it, with the reasoning.

0 of 3 checked

All scenarios and questions are original. None are taken from the exam, Microsoft's practice assessment or any question bank. PrepToExcel is not affiliated with Microsoft.