Azure Monitor & Log Analytics

Metrics, logs, diagnostics, alerts, App Insights.

You cannot manage what you cannot see, so observability is central to the administrator role. Azure Monitor is the platform that collects metrics and logs across the estate and drives alerting, with Log Analytics and Application Insights as its key components.

Metrics, logs, and Log Analytics

Azure Monitor collects two kinds of telemetry: metrics (numeric time-series like CPU, memory, request count — near-real-time, good for alerting and dashboards) and logs (detailed event records queried with the Kusto Query Language). Logs land in a Log Analytics workspace, the central store you query across all your resources and that Microsoft Sentinel reads for security. Critically, most resources do not send their logs anywhere by default — you must configure diagnostic settings on each resource to route its metrics and logs to a Log Analytics workspace (or storage/Event Hub). Centralizing diagnostics into one workspace lets you correlate across resources, run cross-resource queries, and build unified dashboards, rather than logging into each resource separately.

# Without diagnostic settings, most resource logs are NOT retained.
az monitor diagnostic-settings create --name to-la \
  --resource <resource-id> \
  --workspace <log-analytics-workspace-id> \
  --logs   '[{"categoryGroup":"allLogs","enabled":true}]' \
  --metrics '[{"category":"AllMetrics","enabled":true}]'
 
# Then query across resources with KQL in the workspace:
#   AzureActivity | where OperationNameValue contains "delete" | ...

Alerts and application monitoring

Collecting telemetry is only useful if it drives action. Azure Monitor alert rules fire when a metric or log condition is met and trigger an action group — notifying via email/SMS or running automation (a webhook, Function, or Logic App) to respond. Design alerts on signals that indicate real problems (high error rate, low available memory, a failed backup), and tune them so responders are not drowned in low-value noise — alert fatigue is as much a risk here as anywhere. For application-level insight, Application Insights provides deep APM: request rates, response times, dependency calls, exceptions, and distributed traces, showing not just that a VM is busy but why an application is slow. Together, infrastructure metrics/logs and application insights give the full picture an administrator needs to keep services healthy.