Azure Basics · Module 09

Azure Monitor – Metrics, Logs, Alerts, Log Analytics, Network Watcher

Collect and read metrics, logs and the Activity Log; create alerts with action groups; query Log Analytics with KQL; diagnose networking with Network Watcher.

Practice interactively →

What you will learn

• Tell metrics from logs and know Azure Monitor data tiers
• Query the Activity Log by time and status
• Create an action group and a metric alert rule
• Create a Log Analytics workspace and write basic KQL queries
• Use IP Flow Verify and Next Hop to diagnose networking

Lessons

1. Azure Monitor — Metrics, Logs and Data Tiers

   Azure Monitor collects data from the app up to the tenant into two stores — metrics (numbers, near real time) and logs (records with many properties, queried with KQL); resource logs are kept only when diagnostic settings are on.

2. Activity Log — Who Did What on the Subscription

   The Activity Log records management (control-plane) operations such as creating, updating and deleting resources; filter by time, severity and category; it keeps 90 days, so send it to Log Analytics or storage to keep it longer.

3. Alert Rules and Action Groups

   An alert rule has a scope, a condition on a signal, a severity from 0 (most severe) to 4 and an action group; an action group bundles notifications and automated actions and is reused across rules.

4. Log Analytics Workspaces and KQL Queries

   A workspace is where logs are collected and stored as tables; KQL chains operators with pipes — where filters, summarize groups, bin() buckets time, ago() counts back from now.

5. Network Watcher — Network Diagnostics

   Network Watcher is a regional service with IP Flow Verify (which NSG rule blocks a packet), Next Hop (where a route goes), Connection troubleshoot, VPN diagnostics, flow logs and Topology.