Cram sheet — Monitor resources in Azure

Two facts carry a surprising share of this topic: some data arrives without you configuring anything, and nothing you configure reaches backwards over data that was never collected.

What arrives without configuration, and what does not

• Platform metrics and the activity log are automatically collected without configuration. You use a diagnostic setting only to send them somewhere else.
• Resource logs are the ones that need a diagnostic setting to be collected at all.
• ⚠ A diagnostic setting is per resource: create a separate one for each resource you want data from. There is no subscription-wide switch that turns on resource logs everywhere.
• ⚠ The destination must already exist before you create the setting — the workspace, storage account or event hub is a prerequisite, not something the setting provisions.
• Because collection begins when the setting does, a question about last week cannot be answered by turning collection on today.

Metrics or logs — which question is being asked

• Azure Monitor brings metrics, logs, traces and events into one place, so the service name never decides the answer; the signal does.
• Log Analytics workspaces collect log and trace data, analysed with Kusto Query Language (KQL). If the stem describes writing a query, correlating across resources, or looking at text, it is a logs question.
• If it describes a numeric value sampled over time, near-real-time, charted or alerted on directly, it is a metrics question.
• Network Watcher provides network monitoring tools built on the Azure Monitor data platform, which is why network diagnostics sit in this topic rather than in Unit 4.

Alerts have three separable objects

• ⚠ When you monitor several resources, the condition is evaluated separately per resource and alerts fire per resource. One rule over ten machines is ten independent alerts, not one.
• An alert's condition is set to fired when it triggers and to resolved once the underlying condition clears. That is the platform's state, not a human acknowledgement.
• ⚠ Fired alert instances are read-only and cannot be edited. Configuration changes apply only to future alerts. Fixing a noisy rule does not clean up what it has already produced.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.