Monitoring is a fundamental part of operating modern cloud infrastructure. In Microsoft Azure, Azure Monitor provides a centralised platform for collecting, analysing, and acting on telemetry from both cloud and on-premises environments.
Log Analytics
Log Analytics is the core data platform within Azure Monitor. It collects, stores, and analyses telemetry data from various sources such as virtual machines, applications, and Azure services.
Log Analytics Workspace
A Log Analytics workspace is the central storage and query engine for monitoring data.
Key characteristics:
- It can collect data from Azure resources as well as on-premises machines.
- For on-premises machines, the monitoring agent must be installed manually.
- The workspace does not need to be in the same region as the monitored VM.
- Log Analytics relies on Azure Storage internally for certain scenarios.
In an advanced configuration, you can also attach a customer-managed storage account for additional control over data storage.
Azure Monitor Agents
Monitoring data is collected through agents installed on machines.
The Azure Monitor Agent (AMA) is the modern agent designed to replace several legacy components:
- Log Analytics Agent
- Azure Diagnostics Extension
- Telegraf Agent
The goal is to unify telemetry collection across Windows and Linux systems.
Important notes:
- Telegraf was historically Linux-only.
- Other agents supported both Windows and Linux.
- Early versions of the Azure Monitor Agent lacked some features, such as IIS log collection and custom logs.
Today, Microsoft is gradually moving all telemetry collection toward the Azure Monitor Agent.
Agent Data Sources
Agents can collect telemetry from multiple sources depending on the operating system.
| Data Source | Supported OS |
|---|---|
| Syslog | Linux |
| Windows Event Logs | Windows |
| IIS Logs | Windows |
| Performance Counters | Windows & Linux |
| Custom Logs | Windows & Linux |
These data sources allow Azure Monitor to gather everything from system events and performance metrics to application logs.
Alerting in Azure Monitor
Alerts allow Azure Monitor to notify administrators when certain conditions are met.
For example:
- High CPU usage
- Application failures
- Service outages
- Security anomalies
Alert Lifecycle
Azure Monitor alerts move through several states:
| State | Description |
|---|---|
| New | The issue has been detected but not yet reviewed. |
| Acknowledged | An administrator has reviewed the alert and started investigating. |
| Closed | The issue has been resolved. |
Closed alerts can be reopened if necessary.
Notification Rate Limiting
Azure Monitor limits the rate at which notifications can be sent to prevent alert flooding.
Current limits include:
- SMS: 1 message every 5 minutes
- Voice calls: 1 call every 5 minutes
- Email: Up to 100 emails per hour
Other types of alert actions are not rate-limited.
Alert Actions
When an alert fires, Azure Monitor can trigger automated actions.
Common actions include:
- Automation Runbooks
- Azure Functions
- IT Service Management (ITSM) integrations
- Logic Apps
- Secure Webhooks
- Standard Webhooks
These integrations enable automated remediation workflows or integration with external systems.
Diagnostic Settings
Azure services can emit logs and metrics that need to be stored or streamed elsewhere. This is configured through Diagnostic Settings.
Logs can be sent to multiple destinations:
| Destination | Region Requirements | Retention |
|---|---|---|
| Log Analytics Workspace | Any region | 30–730 days |
| Storage Account | Same region | Configurable (0 = infinite) |
| Event Hub | Streaming pipeline | Depends on configuration |
| Partner Solutions | Varies | Depends on partner |
Important limitation:
The same log cannot be sent to two storage accounts, two Log Analytics workspaces, or two Event Hubs simultaneously.
Service Map
Service Map is a feature of Azure Monitor that automatically discovers application components and visualises how services communicate with each other.
It maps:
- Processes running on servers
- Dependencies between services
- Network connections between components
Prerequisites include:
- A Log Analytics workspace in a supported region
- The Log Analytics Agent installed on the monitored machine
- The Dependency Agent installed for dependency mapping
The result is a real-time topology map of your application architecture, helping you quickly identify service dependencies and potential failure points.
IT Service Management Connector
Azure Monitor integrates with external IT service management tools through the IT Service Management Connector (ITSMC).
Supported platforms include:
- ServiceNow
- System Center Service Manager
- Provance
- Cherwell
This integration allows Azure alerts to automatically create incident tickets in ITSM platforms, aligning monitoring with operational workflows.
Azure Service Health
While Azure Monitor tracks your workloads, Azure Service Health focuses on the health of the Azure platform itself.
It provides notifications about:
- Azure service incidents
- Planned maintenance
- Service outages impacting your resources
You can configure custom alerts and dashboards to be immediately informed when Azure infrastructure issues affect your services.
Final Thoughts
Azure Monitor is more than just a logging system—it is a comprehensive observability platform that helps you:
- Collect telemetry from cloud and on-prem environments
- Analyse logs and performance metrics
- Detect problems with alerts
- Automate remediation workflows
- Visualise service dependencies
By combining Log Analytics, alerting, diagnostics, and service mapping, Azure Monitor provides deep visibility into your infrastructure and applications.
