Why are orders failing?
Friday evening: a customer messages that her order failed twice. Is it the payment API? One city? Every request since 6 pm? Without data you can only guess. With Azure Monitor you can ask: "how many requests failed, by route, in the last hour?" and get an answer in seconds — and have an alert wake you up before the customers do.
Today you'll build a tiny version of the query engine behind Azure's logs, and the rule that decides when an alert fires.
Metrics, logs and where they go
Azure Monitor collects two kinds of data. Metrics are numbers sampled over time — CPU percentage, request count, latency — stored for 93 days and cheap to chart and alert on. Logs are records with many fields, stored as tables in a Log Analytics workspace and queried with KQL, the Kusto Query Language.
- The activity log records management operations on resources — who deleted that VM, and when.
- Diagnostic settings send a resource's own logs and metrics to a workspace, a storage account or an event hub.
- Application Insights instruments your code: requests, dependencies, exceptions, traces.
- The Azure Monitor agent collects logs and performance counters from inside VMs.
- Microsoft Defender for Cloud, Microsoft Sentinel and Azure Advisor build on the same data.