Stage 5 · Platform

Azure Monitor & Observability

Azure Monitor

Metrics, logs, traces — the three pillars in Azure's monitoring stack.

7 min readAzure Cloud EngineeringPlatform

Azure Monitor Overview

Azure Monitor is a full-stack monitoring service that collects, analyzes, and acts on telemetry from your Azure resources, applications, and networks. It provides metrics, logs, and traces as the three pillars of observability.

Metrics — Numerical time-series data collected every minute (CPU, memory, IOPS)
Logs — Structured and unstructured log data queried with Kusto Query Language
Traces — Distributed trace data for tracking requests across services
Alerts — Automated responses based on metric thresholds or log queries
Dashboards — Visual representations of monitoring data

Metrics

Azure Monitor Metrics is a time-series database optimized for analyzing time-stamped data. Metrics are collected automatically for most Azure resources and are available at one-minute granularity.

Query metrics with Azure CLI


# Get CPU metrics for a VM
az monitor metrics list \
  --resource "/subscriptions/{sub-id}/resourceGroups/rg-payments/providers/Microsoft.Compute/vmScaleSets/vmss-web" \
  --metric "Percentage CPU" \
  --interval PT5M \
  --query "value[].timeseries[].data[].{timestamp:timeStamp, average:average}" \
  --output table

# Get AKS node metrics
az monitor metrics list \
  --resource "/subscriptions/{sub-id}/resourceGroups/rg-aks-prod/providers/Microsoft.ContainerService/managedClusters/aks-payments-prod" \
  --metric "Node CPU Usage Percentage" \
  --interval PT1M \
  --output table

Metrics are stored for 93 days at one-minute granularity. For longer retention, export metrics to a Log Analytics workspace or a storage account.

Logs

Azure Monitor Logs is built on Azure Data Explorer and uses Kusto Query Language (KQL) for querying. Logs are collected into a Log Analytics workspace and can include resource logs, application logs, and audit logs.

Basic KQL query


// Get all error events from the last hour
AzureDiagnostics
| where TimeGenerated > ago(1h)
| where Level == "Error"
| project TimeGenerated, Resource, Category, Message
| order by TimeGenerated desc

// Count errors by resource
AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Level == "Error"
| summarize ErrorCount = count() by Resource
| order by ErrorCount desc

KQL is similar to SQL but optimized for time-series data. The pipe operator (|) chains transformations — filter, project, aggregate, and sort.

Use Log Analytics for ad-hoc analysis

Log Analytics in the Azure Portal provides a query editor with autocomplete, schema browser, and visualization tools. It is the fastest way to explore and analyze your monitoring data.

Traces

Distributed tracing tracks requests as they flow through multiple services. Application Insights captures traces automatically and correlates them with requests, dependencies, and exceptions.

Trace analysis with Application Insights


// View request duration and dependencies
requests
| where timestamp > ago(1h)
| join kind=leftouter dependencies
  on operation_Id
| project timestamp, name, duration, success, target, type
| order by duration desc

// Find slow dependencies
dependencies
| where timestamp > ago(24h)
| summarize avgDuration = avg(duration), count = count() by target, type
| where count > 100
| order by avgDuration desc

Traces let you identify which service in a chain is causing latency. The operation_Id field correlates all telemetry for a single request.

Data Collection

Data Collection Rules (DCRs) define what data to collect and where to send it. They control the flow of logs from Azure resources to Log Analytics workspaces.

Create a Data Collection Rule


# Create a DCR for VM diagnostic logs
az monitor data-collection rule create \
  --resource-group rg-monitoring \
  --name dcr-vm-logs \
  --location eastus \
  --destinations-log-analytics workspaceId="/subscriptions/{sub-id}/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-payments" \
  --data-sources syslog \
    --name syslog-collector \
    --facility-names local0 \
    --log-levels notice \
    --protocol tcp \
    --port 514

DCRs replace the legacy Diagnostic Settings for many scenarios. They provide more granular control over what data is collected and reduce unnecessary log ingestion costs.

Monitoring Architecture

A production monitoring architecture uses multiple Log Analytics workspaces, action groups for alerting, and workbooks for visualization. Design your monitoring to scale with your organization.

Component	Purpose	Scope
Log Analytics Workspace	Central log repository	Per team or per environment
Action Group	Alert notification target	Shared across subscriptions
Workbook	Custom dashboards and reports	Per use case or SLO
Metric Alert	Threshold-based notifications	Per resource or resource group
Diagnostic Settings	Resource-level log forwarding	Per resource type

Separate production and non-production workspaces

Use separate Log Analytics workspaces for production and non-production. This limits blast radius, controls costs, and simplifies access management.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.