Azure Monitor

Azure Monitor is a comprehensive monitoring service that collects, analyzes, and responds to telemetry data from your Azure resources, on-premises infrastructure, and other cloud environments. The primary business problem it solves is the lack of visibility into the health, performance, and availability of your applications and infrastructure. Without a centralized monitoring solution, IT teams would need to manually check logs, performance counters, and alerts from each resource individually—an impossible task at scale. Azure Monitor provides a single pane of glass to view all telemetry, set up alerts, and automate responses, enabling proactive issue resolution, capacity planning, and compliance auditing.

Azure Monitor operates in a pipeline: Collect → Store → Analyze → Act.

1. Collect: Telemetry data is collected from multiple sources: - Azure resources: Built-in metrics and logs from services like VMs, App Services, and databases. - Operating systems: Guest OS metrics and logs via the Azure Monitor Agent (AMA) or legacy Log Analytics agent. - Applications: Application performance data via Application Insights (part of Azure Monitor). - Custom sources: Data from on-premises servers, other clouds, or custom applications using the Azure Monitor HTTP Data Collector API. 2. Store: Data is stored in two types of data stores: - Metrics: Numeric time-series data (e.g., CPU percentage, disk I/O) stored in a time-series database optimized for fast queries and near real-time alerting. Metrics are kept for 93 days by default. - Logs: Text-based data (e.g., event logs, error messages, custom logs) stored in Log Analytics workspaces. Logs are retained for 30 days by default (configurable up to 730 days or longer with data archiving to Azure Storage).

3. Analyze: You can analyze data using: - Metrics Explorer: Interactive charting and pinning to dashboards. - Log Analytics: A powerful query language (Kusto Query Language, KQL) to search, filter, and aggregate log data. - Workbooks: Custom visualizations and reports combining metrics and logs. - Insights: Specialized monitoring experiences for specific services (e.g., VM Insights, Container Insights).

4. Act: You can set up alerts to notify you or trigger automated actions: - Metric alerts: Trigger when a metric crosses a threshold (e.g., CPU > 90%). - Log alerts: Trigger based on log search results (e.g., number of error events > 10 in 5 minutes). - Activity log alerts: Trigger when a specific Azure resource operation occurs (e.g., VM creation). Alerts can fire actions like sending email/SMS, calling a webhook, or triggering an Azure Automation runbook or Logic App.

Azure Monitor uses a pay-as-you-go model with no upfront costs. Key pricing elements: - Metrics: Ingestion of platform metrics (from Azure resources) is free. Custom metrics cost $0.30 per million data points. - Logs: Data ingestion into Log Analytics costs $2.76 per GB for the first 5 GB/day (free tier: 5 GB/month). Data retention beyond 31 days costs $0.12 per GB/month. - Alerts: Metric alerts are free; log alerts cost based on log queries. - Application Insights: Pay-per-GB ingested, with a free tier of 1 GB/month.

In an on-premises environment, you might use tools like Microsoft System Center Operations Manager (SCOM) or Nagios. These require dedicated servers, manual configuration, and limited scalability. Azure Monitor is fully managed, scales automatically, and integrates with other Azure services. It also supports hybrid scenarios by collecting data from on-premises servers via the Azure Monitor Agent.

- Azure Portal: Navigate to "Monitor" in the left-hand menu. Here you can view dashboards, metrics, logs, alerts, and workbooks. - Azure CLI: Use commands like:

az monitor metrics list --resource <resource-id> --metric "Percentage CPU"
  az monitor log-analytics query --workspace <workspace-id> --query "Perf | where CounterName == '% Processor Time'"
  az monitor alert create --name "HighCPU" --resource-group <rg> --condition "Percentage CPU > 90"

A large e-commerce company runs its website on Azure App Services and Azure SQL Database. They need to ensure the site is responsive during Black Friday traffic. The team uses Application Insights (part of Azure Monitor) to monitor page load times, server responses, and dependency calls (e.g., database queries). They configure a metric alert on 'Server Response Time' exceeding 2 seconds for 5 minutes, which triggers an action group that sends an email to the DevOps team and auto-scales the App Service plan. They also set up a log alert on failed requests to detect errors. During a flash sale, a sudden spike in traffic causes response times to increase. The alert fires, and the auto-scaling action adds more instances, preventing downtime. Cost: Application Insights ingestion costs ~$0.276 per GB, and with moderate traffic, the monthly bill is about $100. If they hadn't set up monitoring, they might have missed the issue and lost revenue.

A hospital network must comply with HIPAA, requiring audit logs of all access to patient data. They collect Windows security event logs from all VMs using the Azure Monitor Agent and store them in a Log Analytics workspace. They use KQL queries to detect failed logon attempts and unauthorized access to sensitive folders. They set up a log alert that triggers when more than 10 failed logons occur in 5 minutes from a single IP, sending a text to the security team. They also create a workbook that displays a compliance dashboard showing recent access patterns. The workspace retains logs for 365 days to meet regulatory requirements, costing about $0.12 per GB/month for retention. Without Azure Monitor, they would have to manually parse logs from each server, which is error-prone and time-consuming.

A manufacturing company has on-premises servers and Azure VMs. They use Azure Arc to manage on-premises machines and install the Azure Monitor Agent on all servers. They create a single Log Analytics workspace to collect performance data from both environments. They set up metric alerts for disk space below 20% on critical servers. When a server runs low on disk, the alert triggers an Automation runbook that runs a cleanup script. They also use VM Insights to visualize the health and performance of all VMs in a single map. This hybrid setup allows them to monitor everything from one place. Common mistake: forgetting to install the agent on all servers, leading to blind spots. Cost: Data ingestion from 50 servers at ~1 GB/day costs about $84/month.