Implement an instrumentation strategy · Topic 1 of 2
Configuring Monitoring for DevOps
AZ-400 monitoring: Azure Monitor, Application Insights, VM and container insights, GitHub charts, and alerts for Azure Pipelines and GitHub Actions.
- 6 min
- Metrics are fast numeric series. Logs go to Log Analytics and use KQL. Diagnostic settings route platform data.
- The Azure Monitor Agent with data collection rules collects from VMs. Application Insights uses a connection string.
- VM insights, Container insights, Storage insights and Network insights give resource focused views.
What it is
Monitoring collects telemetry from applications, infrastructure and the delivery process, stores it where it can be queried, and raises alerts when something needs attention. For DevOps it also closes the loop: production data feeds back to the team and back into the pipeline.
This topic covers what to turn on, where the data goes and how to be told about problems, including problems in Azure Pipelines and GitHub Actions themselves.
How it works
Azure Monitor
Azure Monitor is the platform for telemetry on Azure and hybrid resources.
| Data | Details |
|---|---|
| Metrics | Numeric time series, collected automatically from Azure resources (platform metrics), low latency, and kept for a limited period. Good for fast alerts and charts |
| Logs | Detailed records stored in a Log Analytics workspace and queried with KQL |
| Activity log | Control plane events: who created, changed or deleted a resource |
| Traces and changes | Application traces, change analysis |
Diagnostic settings send a resource's platform logs and metrics to a Log Analytics workspace, a storage account (cheap archive) or an event hub (stream to another tool). The Azure Monitor Agent (AMA) collects data from virtual machines, guided by data collection rules (DCRs). It replaces the older Log Analytics agent.
Organize workspaces by ownership and retention needs, and use RBAC to control who can read which data.
Application Insights
Application Insights is the application performance management feature of Azure Monitor. A workspace-based instance stores its data in a Log Analytics workspace.
- Instrument the app with the Azure Monitor OpenTelemetry distro or SDK, or enable auto-instrumentation for some hosts such as App Service. The app uses a connection string to send data.
- Telemetry types include requests, dependencies (calls to databases and services), exceptions, traces, page views, custom events and metrics.
- Features: Live Metrics, Application Map (components and the calls between them), availability tests (synthetic checks from several locations), failures and performance views, smart detection of anomalies and sampling to control volume and cost.
- Release annotations mark deployments on charts so you can see whether a change coincided with a problem.
Insights for infrastructure
| Feature | What it monitors |
|---|---|
| VM insights | Performance (CPU, memory, disk, network) of Azure VMs, scale sets and Arc servers, and a Map of process dependencies. Uses the Azure Monitor Agent |
| Container insights | AKS and other container platforms: node and pod performance, container logs, controller health. Works with Azure Monitor managed service for Prometheus and Managed Grafana for metrics dashboards |
| Storage insights | Capacity, transactions, latency and availability for storage accounts |
| Network insights | Topology, health and connectivity of network resources, with tools such as Connection Monitor and traffic analytics |
Monitoring in GitHub
- The repository Insights tab shows Pulse, Contributors, Traffic, Commits, Code frequency, Dependency graph and Forks.
- GitHub Projects insights let you create and configure charts (bar, column, line, stacked) from item fields, grouped by values such as status or iteration, with filters.
- Organization audit logs can be streamed to a monitoring system, and the Security overview shows alert trends.
- Actions shows run history, durations and usage.
Alerts for pipelines and workflows
Delivery systems need alerts too.
| Platform | Options |
|---|---|
| Azure Pipelines | Notification subscriptions (email) for failed builds, pending approvals and completed releases. Service hooks to Microsoft Teams, Slack or a web hook. The pipeline Pipelines analytics for failure trends. A pipeline step can post to a channel with condition: failed() |
| GitHub Actions | Built in failure notifications for your own workflow runs, a step with if: failure() that posts to Teams or Slack, a workflow_run workflow that reacts when another workflow fails, and webhooks for workflow_run or workflow_job events sent to an Azure Function or Logic App |
| Azure Monitor | Forward pipeline events to a workspace and write log alerts on them |
Azure Monitor alerts
| Alert type | Triggers on |
|---|---|
| Metric alert | A metric crossing a static or dynamic (learned) threshold |
| Log search alert | The result of a KQL query |
| Activity log alert | A control plane event, such as a resource being deleted, or Service Health events |
Each alert has a severity from 0 (critical) to 4 (verbose) and calls an action group: email, SMS, push, voice, webhook, Azure Function, Logic App, runbook, Event Hub or ITSM. Alert processing rules can suppress notifications during planned maintenance without disabling the rules. Alerts also feed release gates: the Query Azure Monitor alerts gate or check stops a deployment while alerts are active.
Choosing quickly
| Requirement | Answer |
|---|---|
| Application dependencies and slow calls | Application Insights, Application Map |
| Memory and disk of VMs | VM insights with the Azure Monitor Agent |
| AKS node and pod health | Container insights |
| Archive logs cheaply | Diagnostic setting to a storage account |
| Stream logs to a SIEM | Diagnostic setting to an Event Hub |
| Notify Teams when a pipeline fails | Service hook or the Azure Pipelines app for Teams |
| Silence alerts during maintenance | Alert processing rule |
A worked scenario
A team runs a web app on AKS with a SQL database. They enable Container insights and Application Insights (workspace-based), and add diagnostic settings for the database to the same workspace. A metric alert (dynamic threshold) watches response time, a log alert watches failed requests, and an action group posts to Teams and opens a ticket. The release pipeline uses the Query Azure Monitor alerts check on the production environment and annotates the deployment in Application Insights.
What to remember for the exam
- Metrics are fast numeric series. Logs go to Log Analytics and use KQL. Diagnostic settings route platform data.
- The Azure Monitor Agent with data collection rules collects from VMs. Application Insights uses a connection string.
- VM insights, Container insights, Storage insights and Network insights give resource focused views.
- Alerts use action groups. Severity runs 0 (critical) to 4 (verbose). Alert processing rules suppress notifications.
- Pipeline alerts use notifications, service hooks,
if: failure()steps andworkflow_run.
"Collect guest memory and disk counters from VMs" needs the Azure Monitor Agent. Host level metrics alone do not include them.
How the exam asks about this
- "Send resource logs to a workspace for querying." A diagnostic setting.
- "See the services your app depends on and their failure rates." Application Map.
- "Alert when response time deviates from its normal pattern." Metric alert with a dynamic threshold.
- "Run a Teams notification when a GitHub workflow fails." A failure step or a webhook based flow.
Common mistakes
Assuming logs flow automatically. Many resources need a diagnostic setting.
One giant workspace for everyone. Access and retention needs differ.
Alerts with no action group. Nobody is told.
Ignoring cost. Sampling and retention settings control spend.
Check yourself
Which Azure Monitor feature routes a resource's platform logs to a workspace or storage account?
Diagnostic settings.
Which agent replaces the Log Analytics agent for VM data collection?
Azure Monitor Agent.
What lets you silence alert notifications during a maintenance window?
An alert processing rule.
Topic 1 of 2 in Implement an instrumentation strategy
Test yourself on Implement an instrumentation strategy
The full Microsoft AZ-400 question bank has 766 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.