Azure Monitor — Metrics, Logs and Data Tiers

Azure Basics · Azure Monitor – Metrics, Logs, Alerts, Log Analytics, Network Watcher · Lesson 1 of 5

Azure Monitor collects data from the app up to the tenant into two stores — metrics (numbers, near real time) and logs (records with many properties, queried with KQL); resource logs are kept only when diagnostic settings are on.

Azure Monitor is Azure's shared monitoring platform: it collects, analyzes, alerts on and visualizes data from Azure, other clouds and on-premises.

	Metrics	Logs
Data shape	Numeric values over time	Records with many properties (text, numbers, times)
Latency	Near real time, lightweight	A few minutes, deep analysis
Tools	Metrics explorer, metric alerts	Log Analytics (KQL), log alerts, workbooks
Examples	`Percentage CPU`, `Network In`	Error events, Heartbeat, Activity Log, traces

flowchart LR
  A["Application"] --> M[("Metrics")]
  A --> L[("Logs")]
  OS["Guest OS (via Azure Monitor Agent)"] --> M
  OS --> L
  R["Azure resource"] --> M
  R -- "diagnostic settings" --> L
  S["Subscription (Activity Log)"] --> L
  T["Tenant (Microsoft Entra ID)"] --> L
  M --> X["Analyze / Alert / Visualize"]
  L --> X

Data tiers: Application (your code, Application Insights) → Guest OS (Azure, other clouds, on-prem) → Azure resource → Azure subscription (Activity Log, Service Health) → Azure tenant (Microsoft Entra ID, formerly Azure AD).

A resource's platform metrics are there with no setup.
Resource logs (data plane, such as blob reads) are not stored by default: create diagnostic settings to send them to a Log Analytics workspace, a storage account or an Event Hub.
Guest OS data (VM memory, disk) needs the Azure Monitor Agent + a Data Collection Rule; the old MMA/OMS agent lost support in Aug 2024.

Traps: metrics hold no text events (those are logs); without diagnostic settings there are no resource logs to query.

Command	Meaning
`az monitor metrics list --resource "$VM_ID" --metric "Percentage CPU" --interval PT5M`	Read the CPU metric
`az monitor metrics list-definitions --resource "$VM_ID" -o table`	Which metrics exist
`az monitor diagnostic-settings create ...`	Send resource logs to a workspace

Insights: ready-made monitoring

Insight	Covers
VM insights	Performance charts and a map of processes and connections for VMs
Container insights	AKS nodes, pods, and container logs
Application Insights	Requests, dependencies, exceptions, and traces from application code
Network insights	Health and topology of network resources
Storage and Key Vault insights	Capacity, availability, and latency

Insights combine metrics and logs into curated views, so they are a good first stop before building your own.

Application Insights in more depth

Instrument an app with the Azure Monitor OpenTelemetry distro or with autoinstrumentation for App Service, Functions, and AKS, without code changes for many languages. Availability tests call a URL from several locations every few minutes and alert when it fails. The application map draws the components and their dependencies with failure rates, which quickly shows which downstream call is slow.

Visualising data

Workbooks mix text, KQL queries, metric charts, and parameters into interactive reports that a team can share. Azure dashboards pin charts from many resources on one page. Azure Managed Grafana gives Grafana dashboards that read Azure Monitor metrics, logs, and managed Prometheus.

Metric details

Platform metrics are kept for 93 days and are sampled every minute for most resources. Many are multi-dimensional, so a storage metric can be split by API name or response type. Applications and agents can send custom metrics. For Kubernetes and other cloud-native workloads, Azure Monitor managed service for Prometheus stores Prometheus metrics without running your own Prometheus servers.

Putting it together

A sound setup turns on diagnostic settings for every important resource (ideally enforced with Azure Policy), sends them to a central workspace, instruments the application, and builds alerts and a workbook on top, so data, alerts, and views come from one place.