25. Monitoring and Managing Azure Resources with Azure Monitor and Log Analytics

In the previous section, we explored Azure security and compliance—particularly best practices for access control and identity management. To ensure that your Azure environment remains secure, compliant, and efficiently utilized, the ability to monitor and manage resources is critically important. In this section, we focus on how to achieve these goals using Azure Monitor and Log Analytics.

Overview of Azure Monitor

Azure Monitor is a comprehensive platform service designed to collect, analyze, and act upon telemetry data across Azure services. It enables you to understand application performance and health, and helps diagnose issues quickly.

Key Features

• Data Collection: Supports multiple data sources—including management layer telemetry, virtual machines, applications, and more.
• Performance Monitoring: Tracks performance metrics for applications and VMs, delivering real-time analysis.
• Alerts and Notifications: Enables configuration of alerts to notify you promptly when performance issues or specific events occur.
• Custom Dashboards: Create personalized dashboards for real-time data visualization.

Example: Monitoring a Web App with Azure Monitor

Suppose you host a web application on Azure and want to monitor its performance and health.

1. In the Azure portal, navigate to your web app.
2. Under the Monitoring section, view key performance metrics such as request count and average response time.
3. Create an alert:

   az monitor metrics alert create --resource-group {ResourceGroup} --name "HighResponseTimeAlert" --scopes {WebAppResourceId} --condition "avg ResponseTime > 1" --description "Alert when average response time exceeds 1 second."
   

With these steps, you’ll receive timely notifications if application performance degrades.

Overview of Log Analytics

Log Analytics, a core component of Azure Monitor, is used to analyze collected log data. Leveraging the powerful Kusto Query Language (KQL), it enables deep investigation into system performance, failures, and usage patterns.

Key Features

• Log Querying: Perform rich, ad-hoc analysis of log data using KQL.
• Data Integration: Aggregate logs from diverse Azure services and resources into a unified workspace for cross-resource analysis.
• Pre-built Reports: Offers out-of-the-box visualizations and reports to accelerate insights.

Example: Querying Logs with Log Analytics

Suppose you want to analyze virtual machine login events to detect potential suspicious activity.

1. In the Azure portal, go to your Log Analytics workspace.
2. Run the following KQL query to filter successful login events:

   SecurityEvent 
   | where EventID == 4624 // Successful logon event ID
   | summarize Count = count() by Account, bin(TimeGenerated, 1h)
   | order by Count desc
   

This query returns the number of successful logins per account, aggregated hourly.

Integrating Azure Monitor and Log Analytics

Azure Monitor and Log Analytics integrate seamlessly to deliver a more robust monitoring and management solution. Within Azure Monitor, you can configure telemetry (e.g., metrics, diagnostics) to be sent directly to a Log Analytics workspace—enabling advanced, KQL-powered analysis.

Practical Example

You can configure monitoring for a virtual machine in Azure Monitor to collect CPU utilization and disk I/O metrics—and route that data to Log Analytics. Then use the following KQL query to identify abnormal CPU usage:

Heartbeat
| where TimeGenerated > ago(1d) 
| summarize avg_CPU_Usage = avg(CPU_Usage) by bin(TimeGenerated, 1h), Computer
| where avg_CPU_Usage > 80

This query identifies virtual machines whose average CPU usage exceeded 80% over the past 24 hours.

Summary

In this section, we examined the core capabilities and practical use cases of Azure Monitor and Log Analytics. By leveraging these tools effectively, you gain deeper visibility and control over your Azure resources—significantly enhancing service availability, reliability, and performance. In the next part of our tutorial series, we’ll explore resource diagnostics and troubleshooting techniques to further strengthen your Azure environment’s observability and operational resilience.