Skip to main content
This lesson explains how Azure Monitor helps you observe, analyze, and troubleshoot your Azure network environment. You will learn how Azure Monitor collects telemetry from Azure resources, how to use Metric Explorer to inspect trends, and how to leverage Network Insights to get end-to-end visibility across your Azure network. Our objectives are threefold:
  • Understand what Azure Monitor is and how it gathers telemetry (metrics, logs, and traces) from your resources.
  • Learn to use Metric Explorer to visualize and analyze performance trends in real time and historically.
  • Explore Azure Monitor’s network insights to get a unified view of network health, connectivity, and diagnostics across your Azure resources.

​
What Azure Monitor collects (Telemetry types)

Azure Monitor ingests three primary telemetry types. The following table summarizes each type, the typical sources, and common storage/usage patterns.
Telemetry TypeWhat it isTypical sourcesStorage & common use
MetricsNumerical measurements emitted at regular intervals (high-cardinality, low-latency)Platform metrics (VM CPU, NIC throughput), resource metricsStored in the Metrics database; used for near-real-time monitoring, charts, and alert rules
LogsTimestamped, structured/unstructured records (events, diagnostics)Activity Logs, resource diagnostics, NSG flow logs, Firewall logsSent to Log Analytics workspaces, storage accounts, or Event Hubs; used for queries, forensic analysis, and dashboards
TracesDistributed traces and application telemetryApplication Insights, OpenTelemetry instrumentationStored in Application Insights / Log Analytics; used for application performance management and root-cause analysis

​
How telemetry is collected and where it goes

Azure Monitor ingests data via multiple mechanisms; choose the mechanism that fits the resource and the telemetry type you need:
  • Platform metrics and activity logs: automatically collected from Azure resources (no agent required).
  • Resource diagnostics: enable Diagnostic Settings on resources to send resource logs and metrics to a Log Analytics workspace, storage account, or Event Hub.
  • Guest-level telemetry: collect OS and application logs by installing an agent (Azure Monitor Agent or older Log Analytics agent).
  • Network-specific telemetry: NSG flow logs, Azure Firewall logs, and Network Watcher diagnostics are available when those services are enabled and the diagnostic destination is configured.
Example: enable diagnostic settings via Azure CLI to send NSG flow logs to a Log Analytics workspace: 
az monitor diagnostic-settings create \
  --name SendNSGFlowToLA \
  --resource /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/networkSecurityGroups/<nsg> \
  --workspace /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName> \
  --logs '[{"category":"NetworkSecurityGroupFlowEvent","enabled":true}]'
Example: install Azure Monitor Agent on a VM (Windows example): 
az vm extension set \
  --resource-group MyResourceGroup \
  --vm-name MyVM \
  --name AzureMonitorWindowsAgent \
  --publisher Microsoft.Azure.Monitor \
  --protected-settings '{"workspaceId":"<workspace-id>"}'
Before you begin, ensure you have the necessary permissions to enable diagnostics (Contributor or Owner on resources) and access to a Log Analytics workspace to centralize logs and insights.
Enabling diagnostics and high-frequency metrics can increase ingestion and storage costs. Verify retention, sampling, and any traffic analytics settings before enabling logging at scale.

​
Metric Explorer — visualize, analyze, and act

Metric Explorer (inside Azure Monitor) provides interactive visualizations and fast exploration of metric time series data. Use it to build charts, analyze trends, and create alerts. Key features:
  • Interactive charting with selectable aggregations: Sum, Average, Min, Max, Count.
  • Split and group by dimensions (for example, VM, NIC, or Availability Zone).
  • Time range selection, smoothing, and live vs. historical comparison.
  • Pin charts to dashboards, export data, or share visualizations.
Quick steps to use Metric Explorer:
  1. Open Azure Portal → Azure Monitor → Metrics.
  2. Select a resource or resource type, choose a metric namespace, and pick a metric (e.g., Network In/Out).
  3. Use “Aggregation” and “Apply splitting” (by dimension) to break down the metric.
  4. Save chart, pin to dashboard, or export CSV.
Tip: When troubleshooting network performance, compare NIC throughput, VM-level metrics, and Azure Firewall/Application Gateway metrics on the same time scale to correlate events.

​
Network insights — end-to-end network visibility

Network Insights aggregates network telemetry into cross-resource views so you can understand topology, connectivity, traffic patterns, and health. Key capabilities:
  • Topology maps and resource-level views for quick comprehension of network layout and dependencies.
  • Connectivity checks via Connection Monitor to validate end-to-end reachability and identify path issues.
  • Traffic visibility with NSG flow logs and Traffic Analytics to analyze traffic patterns, identify suspicious activity, and inform security posture.
  • Health and performance metrics for network resources such as VPN Gateways, Azure Firewall, and Application Gateways, with built-in diagnostics.
Network telemetry sources and common uses:
Resource / ServiceTelemetry availableHow to collect
Network Security Group (NSG)NSG flow logs (allow/deny, source/dest, ports)Enable NSG flow logs via Network Watcher & Diagnostic Settings
Azure FirewallApplication/IP logs, threat intelligence, metricsConfigure Diagnostic Settings to Log Analytics or Storage
Connection MonitorHop-by-hop connectivity, TCP/ICMP checksEnable Connection Monitor from Network Watcher
Network Watcher diagnosticsPacket capture, next hop, IP flow verify, NSG viewEnable Network Watcher in region and run diagnostics via portal or CLI
Example: enable Connection Monitor via Azure CLI (simplified): 
az network watcher connection-monitor create \
  --resource-group MyResourceGroup \
  --name MyConnMonitor \
  --location eastus \
  --source-resource /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Compute/virtualMachines/<vm> \
  --dest-address 13.82.0.2 \
  --dest-port 443

​
Common usage patterns and troubleshooting workflow

  1. Start with Metrics: Use Metric Explorer to detect anomalies (spikes in latency, drops in throughput, CPU, etc.).
  2. Correlate with Logs: Run Log Analytics queries against the timespan of interest (NSG flow logs, firewall logs, activity logs).
  3. Run connectivity diagnostics: Use Connection Monitor, IP flow verify, and next-hop checks to validate path and routing.
  4. Drill into traces: If the issue is application-level latency, inspect Application Insights traces and dependencies.
  5. Remediate & automate: Create alert rules, automated actions, or runbooks based on detected conditions.
Useful Log Analytics query examples (conceptual):
  • Count NSG denies by source IP: 
    AzureDiagnostics
| where Category == "NetworkSecurityGroupFlowEvent"
| where action_s == "Deny"
| summarize DenyCount = count() by src_ip_s, bin(TimeGenerated, 1h)
  • Firewall blocked connections grouped by rule: 
    AzureDiagnostics
| where Category == "AzureFirewallApplicationRule"
| summarize Count = count() by ruleName_s
This lesson covers:
  1. How telemetry is collected and where it is stored.
  2. Demonstrations of Metric Explorer features and common usage patterns.
  3. How to enable and use Azure Monitor’s network insights to troubleshoot connectivity and analyze network health.

Watch Video