Skip to main content
Azure Monitor is Microsoft Azure’s unified monitoring service that provides full‑stack telemetry, analytics, and automation across applications, infrastructure, and the Azure platform. It collects, analyzes, and helps you act on telemetry from Azure, on‑premises environments, and other clouds — enabling performance visibility, proactive issue detection, and automated responses. This article focuses on the Azure Monitor architecture and the two core data types you must understand for diagnostics and exam scenarios: metrics and logs.

​
Architecture — data flow and components

Monitoring begins at the data sources and flows through collection and transformation into Azure Monitor’s central data platform. From there, insights and response features consume the data.
  • Data sources: applications, infrastructure, Azure services, subscription/tenant events, and custom telemetry.
  • Collection & routing: Agents, SDKs, data collection rules, diagnostic settings, and APIs collect and shape telemetry.
  • Data platform: Stores and processes metrics, logs, traces, and change records.
  • Consumption & integrations: Visualizations, insights, alerts, autoscale, AIOps, and integrations with SCOM, Event Hubs, Storage, Logic Apps, Functions, DevOps pipelines, and third‑party tools.
A labeled architecture diagram of Azure Monitor showing data sources (apps, infrastructure, Azure resources and custom sources), the collection/routing components (agents, SDKs, APIs), and the data platform (metrics, logs, traces). The right side shows consumption features—insights, visualization, analysis and response—and integrations like SCOM, storage, DevOps and third‑party tools.
This article concentrates on metrics and logs — the primary Azure Monitor data types that you need to master for monitoring, troubleshooting, and exam scenarios.

​
Key components (quick reference)

  • Metrics: Time‑series numeric data for near real‑time monitoring (used for dashboards, alerts, autoscale).
  • Logs: Structured, timestamped records for deep diagnostics, auditing, and complex queries.
  • Agents & SDKs: Azure Monitor Agent (AMA), diagnostic extensions, and Application Insights SDKs.
  • Data platform: Central storage and processing (Log Analytics, Metrics store).
  • Analysis & response: Kusto Query Language (KQL), Metrics Explorer, workbooks, alerts, dashboards.

​
Metrics

Metrics are numerical values sampled at regular intervals that describe the performance or state of a resource. They provide near real‑time visibility and are commonly used for dashboards, alerting, and autoscaling.
  • Platform metrics: Many Azure resources expose platform metrics by default (for example, VM CPU percentage or web app request latency).
  • Visualization: Metrics are typically visualized as time series to identify trends, spikes, and correlations across resources.
  • Use cases: Alerts, autoscale rules, short‑term trend analysis, and operational dashboards.
A metrics dashboard with two time-series charts: CPU (average) on the left showing a small peak and an average around 2.73%. On the right is Network (total) with inbound/outbound traffic, including a sharp spike and totals of about 13.86 MiB in and 15.75 MiB out.

​
Logs

Logs are structured records that capture events, traces, and diagnostic details. They enable root‑cause analysis, forensic investigations, and complex queries that metrics cannot support.
  • Collection: Enable diagnostic settings on resources, install the Azure Monitor Agent (AMA) on VMs, or instrument applications with Application Insights SDKs.
  • Storage & query: Logs are stored in Log Analytics and queried using Kusto Query Language (KQL).
  • Use cases: Troubleshooting, detailed audits, cross‑table queries, joins, and historical analysis.
Example KQL query:
What this query does:
  • Filters the VMProcess table for hosts with “SQL” in the Computer name and svchost as the executable.
  • Adds a TimeInEST column by applying a fixed offset to TimeGenerated (note: this example uses a simple offset; use timezone-aware functions for production).
  • Projects (selects) the columns TimeInEST, Computer, ExecutableName, Group, and FileVersion for output.

​
Metrics vs Logs (comparison)

​
Data sources relevant to Azure Monitor (exam focus)

Azure Monitor ingests telemetry from a wide range of sources. The following table summarizes common sources and examples: All these sources feed into the metrics and logs stores so you can analyze them with Azure Monitor features or route them to external systems.
A presentation slide titled "Data Sources" showing six colored columns (Application, OS, Azure Resources, Azure Subscription, Azure Tenant, Custom) with example data sources like instrumentation packages, Azure Monitor agent, metrics, resource logs, service health, activity log, and Active Directory. Below the columns are icons labeled "Metrics" and "Logs."
Tip: For exam scenarios, prioritize knowing how to collect platform metrics (out of the box), enable diagnostic settings for logs, install AMA for VMs, and use KQL in Log Analytics for troubleshooting.
Use these resources to deepen your practical knowledge of metrics, logs, agents, and KQL when preparing for the exam or building production monitoring.

Watch Video