AZ-900
Deep Dive
Azure Monitor, Log Analytics, Application Insights, and Service Health. Monitoring isn't just metrics: it's the ability to detect problems before they impact users and to demonstrate SLA compliance.
Contents
Azure Monitor is the umbrella service that collects, analyzes, and acts on telemetry data from all Azure resources. It's not a single product but a platform that unifies multiple capabilities.
Azure Monitor architecture
Data sources
Storage
Consumption
Metrics are numeric values collected at regular intervals (typically 1 minute). They describe some aspect of the system at a given moment.
Metrics by resource type
Virtual Machine
Azure SQL Database
App Service
Storage Account
SLA metrics — the "nines"
| SLA | Downtime/year | Downtime/month |
|---|---|---|
| 99% | 3.65 days | 7.3 hours |
| 99.9% | 8.7 hours | 43.8 min |
| 99.95% | 4.4 hours | 21.9 min |
| 99.99% | 52.6 min | 4.4 min |
| 99.999% | 5.3 min | 26.3 sec |
Quick rule for the exam
99.9% (3 nines) = ~43 min downtime/month. 99.99% (4 nines) = ~4 min downtime/month. Each extra nine = 10x less downtime.
Logs are detailed records of events. Unlike metrics (numbers), logs contain context: what happened, who did it, when, and with what result.
Types of logs in Azure
Activity Log
Record of operations on the Azure control plane: who created/modified/deleted which resource. 90-day retention.
María deleted the VM "web-01" on 2024-01-15 at 14:32
Resource Logs (Diagnostics)
Operational logs for specific resources: SQL queries, HTTP requests, storage operations. Must be enabled.
SQL Query: SELECT * FROM orders took 4,523ms (slow)
Entra ID Sign-in Logs
All authentication attempts: successes, failures, MFA, Conditional Access. 30-day retention (P1/P2) or 7 days (free).
Failed login from 185.134.21.1 (Russia) for admin@contoso.com
Alert Logs
History of triggered alerts. When, which metric/condition, what action was taken.
Alert "CPU > 90%" triggered for VM "prod-web-01" at 09:45
KQL — Kusto Query Language
Log Analytics uses KQL to query logs. The AZ-900 doesn't test writing KQL, but it does expect you to know it exists and what it's for.
Errors from the last hour
AzureActivity | where TimeGenerated > ago(1h) | where ActivityStatus == "Failed" | project TimeGenerated, Caller, OperationName
Top 10 IPs with the most login failures
SigninLogs | where ResultType != "0" | summarize Failures=count() by IPAddress | top 10 by Failures
Average VM CPU over the last 24h
Perf | where TimeGenerated > ago(24h) | where ObjectName == "Processor" | summarize avg(CounterValue) by Computer
Metrics vs Logs — key difference for the exam
Metrics
Logs
Alerts monitor conditions and notify (or act) when they're met. An Action Group defines who gets notified and what action is taken.
Anatomy of an alert
Which resource is it about? (VM, SQL, Subscription, RG)
What condition? Metric > threshold, log query result, activity log event
What to do when triggered? Email, SMS, Azure Function, Logic App, ITSM
Name, severity (0-4), description
Action Groups — action types
Notifications
Email, SMS, Push (Azure app), Voice call
Actions - ITSM
Create a ticket in ServiceNow, Jira, PagerDuty
Actions - Automation
Trigger Azure Function, Logic App, Webhook
Actions - Runbook
Run an Azure Automation Runbook (e.g., restart a VM)
Severities: 0=Critical, 1=Error, 2=Warning, 3=Informational, 4=Verbose. Used for filtering and prioritizing.
Application Insights is Azure's Application Performance Management (APM) service. It monitors applications in real time: performance, errors, users, dependencies.
Live Metrics
Real-time metrics with latency < 1 second. See requests, dependencies, and errors as they happen.
Request Tracking
Every HTTP request logged: URL, duration, response code, success/failure. p50, p95, p99 percentiles.
Dependency Tracking
Calls to SQL, external APIs, queues. Detects which dependency is the bottleneck.
Exception Tracking
Unhandled errors and exceptions with full stack trace. Grouped by type.
User Analytics
How many active users, navigation flows, conversion funnels, retention.
Availability Tests
Synthetic tests from multiple regions. Alerts if your URL doesn't respond within < X ms or returns an error.
Application Insights vs Azure Monitor
Application Insights is a feature of Azure Monitor. Azure Monitor is the general platform for infrastructure. Application Insights specializes in applications. Both store data in a Log Analytics Workspace. App Insights data is queryable with KQL from Azure Monitor.
Azure Service Health reports on the status of the Azure services you use, in the regions you use. It distinguishes between platform issues and issues with your own configuration.
Azure Status
Global Azure status: incidents affecting multiple customers or entire regions. Public information at status.azure.com.
When to use
Check when there's a major incident affecting many customers.
Service Health
Personalized status for the services and regions YOU USE. Includes service issues, planned maintenance, and health advisories.
When to use
Daily monitoring of the services relevant to your organization.
Resource Health
Status of your individual specific resources. Is this particular VM healthy? Did it have an unplanned restart?
When to use
Diagnosis when a specific resource has problems.
Create an alert that notifies you by email if Microsoft reports an incident in the services and regions you use.
+1 more...
Review Advisor's personalized recommendations and apply one to resize underused VMs and reduce costs.
+1 more...
When a solution depends on multiple services in series, the composite SLA is the product of the individual SLAs. Each component reduces the overall SLA.
Example: typical web app
Composite SLA
0.9995 × 0.9999 × 0.999 = 0.9983
Composite SLA ≈ 99.83% → ~12.6 hours of potential downtime per year
Important rule
The composite SLA is ALWAYS less than or equal to the lowest SLA among the components. Adding more services in series always reduces the overall SLA. To improve it: use redundancy (Availability Zones, multi-region), which multiplies uptime in parallel.
Create an alert rule in Azure Monitor to get notified when a VM's CPU goes above 80%. Observability and alerts are part of the AZ-900 management and governance domain.
+1 more...
Did you get this topic?
Test what you just learned
Which Azure service lets you create automatic alerts when a VM's CPU usage exceeds 90% for 5 minutes?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.