Azure Monitor for Application Developers

Azure Monitor is a comprehensive monitoring service for Azure resources and applications. It collects, analyzes, and acts on telemetry from cloud and on-premises environments. Its primary purpose is to maximize the availability and performance of your applications by providing a unified view of metrics, logs, and alerts. For developers, Azure Monitor enables you to understand how your application behaves in production, detect anomalies, and diagnose issues without requiring users to report them.

Azure Monitor stores data in two fundamental types: - Metrics: Numerical values collected at regular intervals (e.g., CPU percentage, request count). They are lightweight, support near-real-time analysis, and are ideal for alerting on thresholds. Metrics are stored for 93 days (default) and can be visualized in Metrics Explorer. - Logs: Text-based records of events (e.g., application errors, audit logs). They are stored in a Log Analytics workspace and can be queried using Kusto Query Language (KQL). Logs have a default retention of 30 days (can be extended up to 730 days or more with pricing tiers).

Both data types can be correlated; for example, a metric spike in CPU can be correlated with a specific error log entry to pinpoint the cause.

Azure Monitor can ingest data from multiple sources: - Azure Infrastructure: Metrics and logs from Azure VMs, App Services, Functions, SQL Database, etc. These are automatically collected at no extra cost for basic metrics. - Application Insights: An extension of Azure Monitor for application performance management (APM). It collects request rates, response times, dependency calls, exceptions, and custom telemetry from your code. It also supports distributed tracing and smart detection. - Custom Data: You can send custom metrics and logs using the Azure Monitor Data Collector API or the Azure Monitor Agent (AMA) for VMs. - Guest OS Monitoring: Collect performance counters and event logs from VMs using the Azure Monitor Agent or legacy Log Analytics agent.

Metrics Explorer is a tool in the Azure portal that allows you to plot metrics from Azure resources. You can:

Key metrics for developers: - App Service: HTTP 5xx errors, request count, response time, memory, CPU. - Azure Functions: Function execution count, execution duration, errors. - Azure SQL Database: DTU/CPU usage, deadlocks, sessions count.

Logs are stored in a Log Analytics workspace. Each workspace has a unique ID and key. You can query logs using KQL, which is similar to SQL but optimized for time-series and unstructured data. Example query for retrieving errors from an App Service:

AppExceptions
| where timestamp > ago(1h)
| summarize Count = count() by type

Common KQL operators: where, summarize, project, extend, join, union. The exam expects you to know basic KQL syntax and understand what each operator does.

Azure Monitor Alerts proactively notify you when conditions are met. An alert consists of: - Alert Rule: Defines the condition (e.g., CPU > 90% for 5 minutes). - Action Group: Specifies who gets notified and how (e.g., email, SMS, webhook, Azure Function, ITSM connector). - Alert Processing Rules: Allow you to suppress alerts during maintenance windows.

Alert types: - Metric Alerts: Evaluate metric values at regular intervals (frequency 1 min to 24 hrs). They are stateful: when the condition is met, the alert fires; when resolved, it sends a resolved notification. - Log Alerts: Run a log query at a specified frequency (e.g., every 5 minutes) and fire if the result count or metric measurement exceeds a threshold. They are stateless by default but can be configured as stateful. - Activity Log Alerts: Trigger when specific events occur in the Azure Activity Log (e.g., resource creation, security events). - Smart Detection Alerts: Available via Application Insights, they automatically detect anomalies in failure rates, response times, and dependency durations using machine learning.

Application Insights is a feature of Azure Monitor that provides application performance management (APM). It is instrumented by adding a NuGet package (for .NET) or SDK (for Node.js, Python, Java) to your application. Key capabilities: - Request Tracking: Automatically logs every HTTP request with duration, response code, and success/failure. - Dependency Tracking: Logs calls to external services (SQL, HTTP, Azure services) with duration and status. - Exceptions: Captures unhandled and custom exceptions with stack traces. - Distributed Tracing: Correlates requests across multiple services using a unique operation ID (traceparent header). - Live Metrics: Real-time monitoring of request rate, CPU, and memory without sampling. - Smart Detection: Proactively detects anomalies in failure rates, response times, and dependency durations. - Availability Tests: Ping tests or multi-step web tests from multiple locations to monitor uptime and responsiveness.

Log Analytics is the main interface for querying log data. You can create: - Workbooks: Interactive reports that combine metrics, logs, and visualizations. They are useful for creating custom dashboards for operations teams. - Views: Custom visualizations using View Designer (legacy) or Workbook templates.

Azure Monitor can trigger autoscale actions based on metrics. For example, you can create an autoscale rule for a Virtual Machine Scale Set that adds instances when CPU > 75% and removes instances when CPU < 25%. The rule must have a cool-down period (default 5 minutes) to avoid flapping.

For Azure Functions, you can enable Application Insights integration during creation or later. The host automatically logs function executions, duration, and errors. You can also add custom telemetry using the ILogger interface or TelemetryClient.

This deep understanding of Azure Monitor's mechanisms will help you answer scenario-based exam questions and design robust monitoring solutions.

A large e-commerce company runs its website on Azure App Services with a SQL Database backend. They use Azure Monitor to track key metrics like page load time, checkout success rate, and database DTU consumption. They have set up metric alerts to notify the on-call engineer if the 95th percentile response time exceeds 3 seconds for 5 minutes. They also use Application Insights distributed tracing to diagnose slow transactions that span multiple microservices. When a promotional event causes a traffic spike, they rely on autoscale rules that add instances when CPU exceeds 80%. The operations team uses a workbook that combines live metrics, recent errors, and a map of dependencies to quickly identify bottlenecks. Common issues include misconfigured diagnostic settings that miss SQL Server audit logs, leading to compliance gaps.

A bank uses Azure Monitor to meet strict audit requirements. They enable diagnostic settings for all Azure resources and stream logs to a Log Analytics workspace with 365-day retention. They use Azure Policy to enforce that all new resources have diagnostic settings enabled. The security team runs KQL queries daily to detect unauthorized access attempts. They have configured activity log alerts for any changes to network security groups. Application Insights tracks user transactions and exceptions, with smart detection alerting on unusual failure rates. A common mistake is forgetting to enable diagnostic settings for the Azure SQL Database, which means no audit logs are collected. The bank also uses Azure Monitor Workbooks to create compliance dashboards for regulators.

A manufacturing company collects telemetry from thousands of IoT devices using Azure IoT Hub. They use Azure Monitor to monitor IoT Hub operations (e.g., device-to-cloud messages, throttle events). They stream IoT Hub diagnostics to Log Analytics for long-term analysis. They also use custom metrics to track device health. Alerts are configured for high message latency. Application Insights is used to monitor the backend processing logic in Azure Functions. At scale, they need to manage data volume carefully to avoid high costs; they use sampling in Application Insights and set retention limits. Misconfigurations often involve setting too low a retention period for compliance or failing to set up alerts for critical thresholds like IoT Hub throttling.