Back to Blog
AzureAZ-104MonitoringAdminTutorial

Monitor, Alert and Analyze with Azure Monitor

Complete AZ-104 tutorial on Azure Monitor & Log Analytics. Learn metrics, logs, KQL basics, action groups.

Daniel Urbano
November 3, 2025
7 min read
Monitor, Alert and Analyze with Azure Monitor

Monitor, Alert and Analyze with Azure Monitor

Introduction

Azure Monitor is a comprehensive monitoring solution designed to collect, analyze, and act on telemetry data from your Azure and on-premises environments. It plays a crucial role in ensuring the availability and performance of applications and services, which is essential knowledge for the AZ-104 exam. Azure Monitor helps administrators proactively identify issues, optimize performance, and gain insights into their systems.

The service comprises several components including metrics, logs, and alerts, and integrates with services like Log Analytics and Action Groups. Key scenarios include monitoring application performance, system health, and resource utilization while implementing alerts to notify teams of potential issues before they impact end-users. By mastering Azure Monitor, administrators can ensure their environments are running optimally, making it a vital topic for anyone preparing for the AZ-104 certification.

Prerequisites

To effectively use Azure Monitor, ensure you have the following prerequisites:

  • An Azure subscription to access Azure services.
  • Appropriate RBAC permissions to manage Azure Monitor settings.
  • Tools:
    • Azure Portal for graphical interface interactions.
    • Azure CLI or PowerShell for command-line operations.
    • Log Analytics workspace set up for querying logs and metrics.

Core Concepts

Definitions

  • Metrics: Numeric data points that represent system performance over time (e.g., CPU usage, memory usage).

  • Logs: Text-based entries that record events and diagnostics (e.g., application errors, system events).

  • Kusto Query Language (KQL): A powerful query language used for querying logs in Azure Monitor and Log Analytics.

  • Action Groups: Notifications and actions triggered by alert rules to send alerts via email, SMS, or integrate with other services.

Architecture

Azure Monitor collects telemetry from various resources and stores it in a centralized data platform. The architecture consists of:

  • Data Sources: Applications, virtual machines, and other Azure resources.
  • Data Collection: Metrics and logs are collected using Azure Monitor agents or built-in integrations.
  • Data Storage: Telemetry is stored in Azure Monitor Logs and Metrics store for analysis.
  • Data Consumption: Tools like Metrics Explorer, Log Analytics, and Dashboards are used for visualization and analysis.

Limitations

  • Azure Monitor may have data retention limits based on the configuration of the Log Analytics workspace.
  • Complex queries may require a good understanding of KQL to optimize performance.

Pricing Notes

Azure Monitor offers a free tier with some limitations. Costs may incur based on data ingested, retention periods, and additional features.

Syntax/Configuration

Azure CLI Commands for Azure Monitor

Command Description
az monitor metrics list Lists the metrics for a specified resource.
az monitor metrics alert create Creates a metric alert rule.
az monitor log-analytics query Runs a KQL query against a Log Analytics workspace.

PowerShell Commands for Azure Monitor

Command Description
Get-AzMetric Retrieves metrics for a specified resource.
New-AzMetricAlertRule Creates a new metric alert rule.
Invoke-AzOperationalInsightsQuery Executes a KQL query against a Log Analytics workspace.

Azure Portal Steps

  1. Access Azure Monitor:

    • Navigate to the Azure Portal.
    • Select "Monitor" from the left navigation pane.

  2. Create an Alert:

    • Go to "Alerts" > "Create" > "Alert rule".
    • Select the resource and condition for the alert.
    • Configure the action group and alert details.

  3. Analyze Metrics:

    • Select "Metrics" from the Monitor blade.
    • Choose the desired resource, metric, and time range to visualize.

Practical Examples

Example 1: List Metrics for a Virtual Machine

az monitor metrics list --resource "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}" --metric "Percentage CPU"

Example 2: Create a Metric Alert Using Azure CLI

az monitor metrics alert create --name "High CPU Alert" --resource-group "MyResourceGroup" --scopes "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}" --condition "avg Percentage CPU > 80" --action-group "MyActionGroup"

Example 3: Query Logs in Log Analytics

az monitor log-analytics query --workspace "<workspace-id>" --query "AzureActivity | summarize count() by ResourceGroup"

Example 4: Create an Action Group

az monitor action-group create --resource-group "MyResourceGroup" --name "MyActionGroup" --short-name "AlertGroup" --email "admin@example.com"

Example 5: View Metrics in Azure Portal

  1. Go to the Azure Portal.
  2. Select "Monitor" > "Metrics".
  3. Select the resource and metric to visualize.

Example 6: Configure Alerts in Azure Portal

  1. Navigate to "Alerts" under Azure Monitor.
  2. Click on "New alert rule".
  3. Select the resource and define conditions.
  4. Configure action groups to notify users.

Example 7: Use KQL to Analyze Logs

Heartbeat
| summarize Count = count() by Computer
| order by Count desc

Example 8: Create a Log Alert Rule

az monitor log-analytics alert create --workspace "<workspace-id>" --query "AppRequests | summarize Count = count() by bin(timestamp, 1h)" --name "App Request Alert"

Real-World Scenarios

Scenario 1: Monitoring Application Performance

  • Set up Azure Monitor to track the performance metrics of a web application using Application Insights.
  • Use KQL to analyze slow requests and identify performance issues.
  • Configure alerts to notify the development team of any performance degradation.

Scenario 2: Resource Utilization

  • Utilize Azure Monitor to keep track of virtual machine metrics to ensure optimal resource utilization.
  • Implement autoscaling based on CPU and memory metrics to maintain performance without overspending.

Scenario 3: Security Monitoring

  • Configure Azure Monitor to log security-related events.
  • Use KQL to query logs for unauthorized access attempts and configure alerts for real-time notifications.

Best Practices

  1. Use Action Groups: Always configure action groups to ensure alerts reach the right teams promptly. 📧
  2. Optimize KQL Queries: Structure queries to filter data as early as possible. This improves performance significantly. ⚡
  3. Set Alerts Wisely: Avoid alert fatigue by setting meaningful thresholds that require attention. 🚦
  4. Regularly Review Metrics: Analyze collected metrics periodically to identify trends and optimize resource allocation. 📊
  5. Utilize Dashboards: Create custom dashboards in the Azure Portal for a holistic view of your monitoring data. 🖥️

Common Errors

Error 1: "Insufficient permissions to view metrics"

  • Cause: The user does not have the required RBAC permissions.
  • Fix: Assign the necessary permissions to the user or role.

Error 2: "Alert rule cannot be created"

  • Cause: The specified condition is invalid or not supported.
  • Fix: Review and modify the alert condition to comply with Azure Monitor's requirements.

Error 3: "Query failed due to syntax error"

  • Cause: Incorrect KQL syntax.
  • Fix: Refer to KQL documentation to correct the syntax.

Error 4: "Data not found in workspace"

  • Cause: The data may not be ingested yet or the query scope is incorrect.
  • Fix: Ensure data ingestion is set up properly and check the query scope.

Related Services/Commands

Service Description CLI Command
Azure Monitor Central service for monitoring Azure resources az monitor
Log Analytics Tool for analyzing logs using KQL az monitor log-analytics
Application Insights Monitor application performance and usage az monitor app-insights
Azure Alerts Create and manage alerts based on metrics and logs az monitor metrics alert

Automation Script

Here’s a PowerShell script to automate log alert creation:

# PowerShell Script to Create Log Alert
# Ensure you have the necessary permissions and Log Analytics workspace set up.

$resourceGroupName = "MyResourceGroup"
$workspaceId = "<workspace-id>"
$alertName = "Log Alert for High Errors"
$query = "AppRequests | where ResultCode == '500' | summarize Count=count()"
$actionGroupId = "<action-group-id>"

New-AzMetricAlertRule -ResourceGroupName $resourceGroupName -Name $alertName -Description "Alert for high error rates" -TargetResourceId $workspaceId -Condition $query -ActionGroupId $actionGroupId

Conclusion

In summary, Azure Monitor is a powerful tool for monitoring, alerting, and analyzing metrics and logs, vital for maintaining optimal performance and availability of resources in Azure environments. Mastery of Azure Monitor, KQL, and alert configurations not only prepares you for the AZ-104 exam but also equips you to handle real-world scenarios effectively.

Next Steps

References