Azure Monitor and Alerts

What it is

Azure Monitor collects data from your resources, lets you analyse it and acts on what it finds. It works with two kinds of data. Metrics are numbers over time, such as CPU percentage. Logs are records of events, which you query.

The exam asks you to configure where the data goes, read it, and set alerts that tell the right people.

How it works

Metrics

Platform metrics are collected automatically from most Azure resources, with no setup. They are numeric, close to real time, and kept for 93 days. You read them in Metrics Explorer, where you can split a chart by a dimension and pin it to a dashboard.

Logs and the activity log

Logs are stored in a Log Analytics workspace. Two kinds matter.

• Resource logs record what a resource did. They are not collected until you create a diagnostic setting.
• The activity log records operations on resources in a subscription, such as who deleted a VM. It is kept for 90 days, and you send it to a workspace to keep it longer.

Diagnostic settings

A diagnostic setting chooses which log categories and metrics to send, and where.

Querying logs with KQL

You query a workspace with the Kusto Query Language (KQL). A query names a table and pipes it through operators.

AzureActivity
| where TimeGenerated > ago(1d)
| where OperationNameValue has "delete"
| summarize count() by Caller

Alert rules

An alert rule watches a signal and fires when a condition is met.

• Signal types are metrics, log search results from a KQL query, and the activity log.
• You set a threshold, how often to evaluate and a severity from 0, which is critical, to 4, which is verbose.
• A rule is attached to an action group, which lists who or what to notify. Notifications can be email, SMS, voice or push. Actions can run a runbook, a function, a logic app or a webhook.

Alert processing rules change alerts after they fire, without editing the alert rules. You can use one to add an action group to many alerts, or to suppress notifications during a maintenance window.

Insights

Azure Monitor Insights are prebuilt views for common resources. VM insights shows performance and the connections between machines, using the Azure Monitor Agent. Storage insights shows capacity, latency and failures. Network insights shows the topology and health of network resources.

Network Watcher and Connection Monitor

Network Watcher provides tools to diagnose network problems, such as IP flow verify, next hop, packet capture and topology. Connection Monitor checks connectivity continuously. It tests reachability and latency between sources, such as VMs, and endpoints, and can alert when a test fails.

Monitoring virtual machines

To collect logs and metrics from inside a VM, install the Azure Monitor Agent. What the agent collects is defined by a data collection rule, which names the data to gather and the workspace to send it to. One rule can be applied to many machines.

More KQL examples

Queries start from a table. Two useful ones:

Heartbeat
| where TimeGenerated > ago(15m)
| summarize LastSeen = max(TimeGenerated) by Computer

This lists the machines that reported a heartbeat in the last 15 minutes. Computers that do not appear have stopped reporting.

Metric alerts

A metric alert can use a static threshold, such as CPU above 90 percent for five minutes. It can also use a dynamic threshold, where Azure learns the normal pattern of the metric and alerts when the value is unusual. Dynamic thresholds suit metrics that vary through the day.

A worked scenario

The operations team wants an email and a text message when any VM in a resource group stays above 90 percent CPU for five minutes. They create a metric alert scoped to the resource group, with the condition and a severity, and attach an action group that has an email and an SMS receiver. If they are doing maintenance, an alert processing rule can suppress the notifications for that window without changing the alert.

How the exam asks about this

• "Keep logs for years at low cost." Archive to a storage account through a diagnostic setting.
• "Query resource logs." Send them to a Log Analytics workspace.
• "Notify people when an alert fires." An action group.
• "Check connectivity and latency continuously." Connection Monitor.
• Platform metrics are kept for 93 days. The activity log is kept for 90.