What Is Azure Monitor?
Azure Monitor is the umbrella observability service that collects, analyzes, and acts on telemetry from every Azure resource, on-premises server, and application you connect to it. Instead of stitching together separate tools for metrics, logs, traces, and alerts, Azure Monitor centralizes all of it: platform metrics stream in automatically the moment a resource is created, while logs, custom events, and traces are collected once you attach agents or SDKs. The two foundational data stores underneath are the Metrics database (a lightweight time-series store) and Log Analytics workspaces (built on the Kusto engine), and almost every other Azure Monitor feature — dashboards, alerts, Insights, Workbooks — is really just a consumer of one or both of those stores.
Cricket analogy: Think of Azure Monitor like the broadcast production truck at a cricket match: ball-by-ball speed and pitch data feed one screen while the umpire's decisions and commentary log feed another, but both flow into the same control room, just like Metrics and Log Analytics feed the same monitoring plane.
Metrics and Logs (KQL)
Platform metrics are numeric, time-stamped values — CPU percentage, HTTP response time, queue length — retained for 93 days by default and queryable with near-instant latency, which makes them ideal for near-real-time dashboards and autoscale rules. Logs, by contrast, are structured records (resource logs, activity logs, custom application logs) sent to a Log Analytics workspace, where you query them with Kusto Query Language (KQL). KQL is a pipe-based query language — you filter with where, shape with project and summarize, and join across tables — and because a workspace can ingest data from many resources at once, a single KQL query can correlate a spike in a web app's failures with a corresponding App Service Plan CPU metric or a downstream SQL Database deadlock event.
Cricket analogy: Writing a KQL query is like a scorer filtering the ball-by-ball database to find every dismissal Jasprit Bumrah caused in the death overs across a tournament — you where on bowler and phase, then summarize count() to get his wicket tally, far faster than watching every match again.
// Correlate failed requests with CPU pressure over the last hour
AppRequests
| where TimeGenerated > ago(1h)
| where Success == false
| summarize FailedCount = count() by bin(TimeGenerated, 5m), Name
| join kind=inner (
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AvgCpu = avg(CounterValue) by bin(TimeGenerated, 5m)
) on TimeGenerated
| project TimeGenerated, Name, FailedCount, AvgCpu
| order by TimeGenerated descAlerts and Action Groups
An alert rule in Azure Monitor watches a signal — a metric threshold, a log query result, or an activity log event — and evaluates it on a schedule (as often as every minute for metrics). When the condition is met, the rule fires and hands off to one or more action groups, which are reusable bundles of responses: send an email or SMS, trigger a webhook, call an Azure Function, invoke a Logic App, or open an ITSM ticket. Separating the 'what to watch' (the alert rule) from the 'what to do about it' (the action group) means you can reuse the same escalation path — say, page the on-call engineer via a webhook to PagerDuty — across dozens of different alert rules without redefining it each time.
Cricket analogy: It's like a stadium's Duckworth-Lewis trigger: once rain crosses a defined threshold, a fixed protocol kicks in — covers come out, umpires confer, the scoreboard recalculates — the same response procedure reused every time that condition is met, regardless of which match it's raining on.
As of recent Azure updates, the Azure Monitor Agent (AMA) is the standard collection agent, replacing the older Log Analytics Agent (MMA/OMS) and Diagnostics Extension, which are on a retirement path. AMA uses Data Collection Rules (DCRs) to define exactly which data to collect per machine, giving far more granular control than the legacy agents' all-or-nothing collection.
Application Insights
Application Insights is Azure Monitor's application performance management (APM) feature: you add its SDK (or, for many languages, enable it codeless via auto-instrumentation) and it automatically captures request rates, response times, failure rates, dependency calls (to databases, external APIs, storage), and exceptions with full stack traces. Its Application Map feature visualizes your distributed system topology in real time, showing which downstream dependency is slow or failing, while the End-to-End Transaction view lets you follow a single request across multiple microservices using a correlated operation ID — invaluable when a slow page load could be caused by your code, a database, or a third-party API three hops away.
Cricket analogy: It's like DRS ball-tracking during an lbw review: instead of just seeing the outcome, you get the full trajectory — pitch point, impact point, projected path — Application Insights gives you that same end-to-end trace of a request instead of just a pass/fail result.
Log Analytics and Application Insights ingestion is billed per GB, and verbose logging (debug-level traces, full SQL text capture, high-cardinality custom dimensions) can silently balloon your bill. Set a daily cap on the workspace, tune sampling in Application Insights (adaptive sampling is on by default for high-volume apps), and review data retention settings — the default 90-day retention may be far more than you need for noisy diagnostic tables.
- Azure Monitor is the unified platform for metrics, logs, alerts, and dashboards across Azure and hybrid resources.
- Metrics are lightweight, near-real-time numeric time series; logs are structured records queried with KQL in a Log Analytics workspace.
- KQL uses a pipe-based syntax (where, project, summarize, join) to filter and aggregate large log datasets efficiently.
- Alert rules watch a signal and fire action groups, which decouple the detection logic from the notification/response logic.
- Azure Monitor Agent (AMA) with Data Collection Rules is the modern replacement for the legacy Log Analytics/Diagnostics agents.
- Application Insights adds APM capabilities: dependency tracking, Application Map, and end-to-end distributed transaction tracing.
- Ingestion volume drives cost — use sampling, daily caps, and right-sized retention to keep Log Analytics spend under control.
Practice what you learned
1. Which Azure Monitor data store is best suited for near-real-time dashboards and autoscale decisions?
2. What query language is used to analyze data in a Log Analytics workspace?
3. What is the purpose of an action group in Azure Monitor?
4. Which Azure Monitor agent is the current recommended standard, replacing the legacy Log Analytics Agent (MMA)?
5. What Application Insights feature visualizes the real-time topology of a distributed application's dependencies?
Was this page helpful?
You May Also Like
The Azure Well-Architected Framework
An overview of the five pillars of the Azure Well-Architected Framework and how they guide design decisions for reliable, secure, and cost-efficient workloads.
Deploying a Simple App on Azure
A hands-on walkthrough of deploying a simple web application to Azure App Service, from CLI deployment to CI/CD and configuration.
Azure Quick Reference
A condensed cheat sheet of core Azure services, CLI commands, networking basics, and pricing concepts for fast lookup.