Microsoft AZ-104 - Microsoft Azure Administrator - Monitor and Maintain Azure Resources - Monitor Resources in Azure
Monitor and Maintain Azure Resources — 10–15%
Monitor resources in Azure
Interpret metrics in Azure Monitor
Configure log settings in Azure Monitor
Query and analyze logs in Azure Monitor
Set up alert rules, action groups, and alert processing rules in Azure Monitor
Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights
Use Azure Network Watcher and Connection Monitor
1. Collect and configure telemetry
Telemetry | What it tells you | Example |
Metrics | Numeric measurements over time. | CPU percentage, storage latency, request count. |
Logs | Structured records of events and activity. | A failed request, configuration change, or Windows event. |
Traces | How a request travels through application components. | A slow transaction spanning an API and database. |
Correlating these signals improves troubleshooting. You do not need all three for every investigation, but isolated signals can leave important gaps.
Configure collection according to the source:
Platform metrics: Usually collected automatically for supported resources; examine them in Metrics Explorer.
Resource logs: Enable diagnostic settings and select categories and destinations.
VM guest telemetry: Install Azure Monitor Agent (AMA) and associate a Data Collection Rule (DCR) specifying what to collect and where to send it.
Application telemetry: Configure Application Insights using supported SDKs, OpenTelemetry, or supported automatic instrumentation.
Custom logs: Supported applications can use the Logs Ingestion API with an appropriate DCR.
Diagnostic settings destinations
Destination | Main purpose |
Log Analytics workspace | Store and query logs together. |
Azure Storage | Retain exported telemetry as files. |
Event Hubs | Stream telemetry to external consumers or a SIEM. |
A Log Analytics workspace stores Azure Monitor Logs. An Azure Monitor workspace is a different resource used for managed Prometheus metrics. The repeated Log Analytics boxes in Diagram 1 represent possible destinations, not a requirement for separate workspaces.
Retention and cost: Select collection scope, table plan, and retention deliberately. Total log retention can extend to 12 years; older data may require a search job or another supported retrieval approach.
2. Interpret, query, visualize, and alert
Interpret metrics
In Metrics Explorer, select:
Scope: Which resource?
Namespace: Which metric category?
Metric: Which measurement?
Aggregation: Average, maximum, total, or another supported calculation.
Time range and granularity: Which period and interval?
Dimensions: Filter or split by properties such as API operation or response type.
For example, average CPU shows sustained demand, while maximum CPU can expose short spikes. Use total for counts where appropriate; do not assume every metric supports every aggregation.
Query logs with KQL
Log Analytics is the query tool; the workspace is the data repository. Azure Monitor Logs uses Kusto Query Language.
AzureActivity
| where TimeGenerated > ago(24h)
| where ActivityStatusValue == "Failed"
| summarize FailedOperations = count() by ResourceGroup
| order by FailedOperations descThis example identifies resource groups with failed management operations, provided the Activity Log has been exported to the workspace.
Key operators include where, project, extend, summarize, join, and order by. Queries can support investigations, workbooks, log-search alerts, and API-driven automation. You do not need to provision your own Azure Data Explorer cluster to query a Log Analytics workspace.
Understand the alert components
Component | Responsibility |
Alert rule | Defines the resource, signal, condition, evaluation settings, and severity. |
Action group | Defines notifications or actions, such as email, SMS, webhook, Function, or Logic App. |
Alert processing rule | Adds or suppresses action groups for matching fired alerts, optionally on a schedule. |
The main alert types to recognize are metric, log-search, and Activity Log alerts. Alert processing rules can suppress actions during maintenance; they do not stop the alert rule from detecting the condition.
Visualize: Use dashboards for an operational overview and workbooks for parameterized investigations combining queries, charts, and explanatory text.
3. Resource Insights and network troubleshooting
Capability | Key configuration or interpretation |
VM Insights | Enable supported guest collection with AMA and a DCR; investigate CPU, memory, disk, and performance trends. |
Storage Insights | Compare availability, transactions, capacity, latency, and errors. Enable resource logs when detailed operations are needed. |
Network Insights | Review supported network resource health, topology, and performance; use Network Watcher for deeper diagnosis. |
Application Insights | Investigate requests, exceptions, dependencies, and distributed traces from instrumented applications. |
Network Watcher tools
Question | Tool |
Is an NSG allowing or denying this proposed VM flow? | IP flow verify |
Where would traffic to this destination be routed? | Next hop |
Can the source reach the destination now? | Connection troubleshoot |
Is connectivity or latency degrading over time? | Connection Monitor |
What packets are actually being exchanged? | Packet capture |
What traffic flows traverse the VNet? | Virtual network flow logs, with optional Traffic Analytics |
Network Watcher is regional: one instance per subscription per region, rather than one per VNet or subnet.
For Connection Monitor, define the sources, destinations, protocol/port, test frequency, and failure/latency thresholds. Configure the required source monitoring components and permissions. A successful test validates that configured path—not every application dependency.
Flow-log path: Raw VNet flow logs go to Azure Storage. When enabled, Traffic Analytics processes flow information into a Log Analytics workspace; it is not a direct export of every raw flow record.
Application Insights update: Use a connection string for current configurations. Instrumentation-key-only ingestion support ended on March 31, 2025; the key should not be treated as an authentication secret.
AZ-104 distinctions:
Diagnostic settings → platform logs.
AMA + DCR → guest collection.
Metrics Explorer → numeric trends.
Log Analytics → KQL.
Alert rule → detection. Action group → response.
Processing rule → modify actions.
Connection Monitor → continuous connectivity tests.
Comments