Techie BabajiLearn to Code. Build Real Skills.
Microsoft Azure · Identity & Ops

Azure Monitor

Azure Monitor collects metrics and logs from every resource, and alerts you before your users notice a problem.

Intermediate 5 min Lesson 15 of 28
Before you start:Azure App Service
0/28 in Microsoft Azure
On this page · 5 min · Intermediate

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Distinguish metrics from logs
  • Send logs to a Log Analytics workspace
  • Query logs with KQL
  • Create alerts with action groups

Explanation#

Metrics are numbers over time (CPU %, request count, response time) — lightweight and near real-time. Logs are detailed records (requests, errors, audit events) you query with KQL.

Diagnostic settings send a resource’s logs to a Log Analytics workspace, where you can query everything in one place.

Alert rules watch a metric or a log query and fire when a condition is met. Action groups decide what happens: email, SMS, a webhook, a Teams message or an Azure Function.

Code example: Alert when the API is slow#

ShellAlert when the API is slow Illustrative
az monitor action-group create -g rg-shop-prod -n ag-oncall \
  --action email oncall oncall@example.com


az monitor metrics alert create -g rg-shop-prod -n alert-api-slow \
  --scopes $(az webapp show -g rg-shop-prod -n app-shop-api --query id -o tsv) \
  --condition "avg HttpResponseTime > 2" \
  --window-size 5m --evaluation-frequency 1m \
  --action ag-oncall


# KQL in Log Analytics: errors per hour for the last day
# AppServiceHTTPLogs
# | where TimeGenerated > ago(1d) and ScStatus >= 500
# | summarize errors = count() by bin(TimeGenerated, 1h)
Expected output
When average response time exceeds 2 seconds over 5 minutes, the on-call engineer receives an email.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. The action group defines who is notified and how.
  2. The metric alert evaluates every minute over a 5-minute window.
  3. The KQL query counts server errors per hour.

Real-world use case#

During a sale, an alert on rising 5xx errors lets the team scale out before the checkout page fails for everyone.

Common mistakes#

Alerting on everything

Too many noisy alerts are ignored. Alert on symptoms users feel: errors, latency, availability.

Not collecting logs until there is an incident

Configure diagnostic settings up front; you cannot query logs that were never collected.

Best practices#

  • Send logs to one workspace per environment
  • Alert on user-facing symptoms
  • Route alerts to a shared action group
  • Build a dashboard of key metrics

Remember this#

Metrics = numbers over time. Logs = detailed records (KQL).

Alert rule = condition. Action group = who gets told.

Collect before you need it.

Practice exercise#

Your task: Write a KQL query that shows the 10 slowest requests in the last hour from AppServiceHTTPLogs.

Show solution
Text Illustrative
AppServiceHTTPLogs
| where TimeGenerated > ago(1h)
| top 10 by TimeTaken desc
| project TimeGenerated, CsUriStem, ScStatus, TimeTaken

Mini quiz#

Azure Monitor quizMultiple choice Question 1 of 1

Where do you define who receives an alert notification?

Score so far: 0/0

Want more? Practise all Microsoft Azure MCQs · Microsoft Azure interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.