Azure Monitor Flashcards
What is Azure Monitor?
A comprehensive monitoring service that provides visibility into the performance and health of Azure resources services and applications.
What are the key features of Azure Monitor?
Application, service, and resource collection of performance, metrics, and log data for analysis, visualization, and alerting.
What data sources does Azure Monitor collect from?
Applications
Services
Azure infrastructure
Operating systems
Custom sources
What is the role of Log Analytics in Azure Monitor?
Log Analytics enables, capture, querying and analyzing collected data from Azure Monitor using KQL (Kusto Query Language).
What is the use of Metrics in Azure Monitor?
Metrics are numerical values that describe the state of a system at a particular point in time, used for near real-time monitoring.
What is the difference between logs and metrics in Azure Monitor?
Metrics are structured numerical data collected at regular intervals, while logs are unstructured events that provide detailed information.
How does Azure Monitor integrate with Azure Alerts?
Azure Monitor can trigger alerts based on metrics or log queries when certain conditions are met.
What is a Diagnostic Setting in Azure Monitor?
A configuration that specifies where and what data to send from an Azure resource to Azure Monitor for Azure level infra level logs..
What is Azure Monitor Application Insights?
A feature of Azure Monitor that monitors the performance and usage of applications, particularly web apps.
What are Azure Monitor Workbooks?
Customizable reports and dashboards that help visualize Azure Monitor data for analysis.
What is the role of Action Groups in Azure Monitor?
Action Groups define actions to take when an alert is triggered, such as sending an email or invoking an Azure Function.
What isAzure Monitor Autoscale?
It is a function of Azure Monitor thet can be used automatically adjust the number of resources (applications ) based on performance data collected by Azure Monitor.
How does Azure Monitor integrate with Log Analytics Workspace?
Logs from Azure Monitor can be stored in a Log Analytics Workspace for advanced querying and analysis.
What is the role of Kusto Query Language (KQL) in Azure Monitor?
KQL is used to query and analyze log data collected by Azure Monitor.
What is the use of Azure Monitor Metrics Explorer?
To visually explore and analyze metrics in real-time through customizable charts.
What is Azure Monitor for VMs?
A feature that monitors the performance, dependencies, and health of virtual machines.
What is Azure Monitor for containers?
A feature that monitors the performance of Azure Kubernetes Service (AKS) and other containerized workloads.
What types of alerts can be created in Azure Monitor?
Metric alerts, log alerts, and activity log alerts.
How does Azure Monitor support proactive alerting?
By setting up alert rules based on thresholds, anomalies, or log queries.
What is an Azure Monitor metric namespace?
A container for a set of metrics related to a specific resource.
What is the role of Log Analytics Agent in Azure Monitor?
The agent collects telemetry data from virtual machines and sends it to Azure Monitor.
What is the purpose of Azure Monitor Network Insights?
To provide visibility into network performance and dependencies between resources.
What is Azure Monitor Activity Log?
A log that records all control-plane events (resource management events) in Azure.
What is Azure Monitor’s Service Health feature?
A feature that provides information on Azure service outages and planned maintenance.
What is the retention period for Azure Monitor Logs?
By default, logs are retained for 30 days, but the retention period can be configured.
What is a Log Analytics Workspace in Azure Monitor?
A central repository for storing and analyzing log data using KQL.
How can Azure Monitor integrate with external tools?
Azure Monitor can integrate with tools like Grafana, Power BI, and external SIEM systems.
What is the cost model for Azure Monitor?
Costs are based on the volume of data ingested, stored, and the number of alerts set.
What is the Azure Monitor Insights feature?
A collection of insights (e.g., VM Insights, Container Insights) to monitor the health and performance of specific resources.
How does Azure Monitor support application performance monitoring (APM)?
Through Application Insights, which monitors application performance, user behavior, and diagnostics.
What is the role of Azure Monitor Logs?
To collect and analyze log data from Azure resources and applications for troubleshooting and auditing.
What is the benefit of using Azure Monitor Workbooks?
Workbooks allow you to create customizable visual reports for better insight into monitoring data.
What is a data source in Azure Monitor?
Any system or application that sends data to Azure Monitor, such as VMs, apps, or databases.
What are Diagnostic Logs in Azure Monitor?
Logs that capture events and activity within Azure resources, providing insight into their behavior.
What is Azure Monitor Metrics API?
An API that allows programmatic access to metrics data from Azure Monitor.
How can you query data in Azure Monitor?
By using Kusto Query Language (KQL) in the Log Analytics Workspace.
What is the Azure Monitor Auto Scale feature?
It automatically adjusts resource capacity based on performance data collected by Azure Monitor.
What is Azure Monitor Logs ingestion?
The process of collecting and storing log data from resources and services in Azure Monitor.
How does Azure Monitor assist in troubleshooting issues?
By collecting metrics and logs to identify performance issues and errors in applications or resources.
What is Azure Monitor’s Custom Metrics feature?
It allows you to define and track custom metrics specific to your application or resource needs.
What is the Azure Monitor REST API?
An API that enables developers to retrieve monitoring data programmatically from Azure Monitor.
What is Azure Monitor for SAP Solutions?
A feature that monitors SAP systems running on Azure for performance and health.
How does Azure Monitor help with resource optimization?
By analyzing metrics and logs to provide insights into underused or overused resources.
What is the role of Azure Monitor in governance and compliance?
It provides logging and monitoring that can be used to meet compliance requirements.
How does Azure Monitor support security monitoring?
By collecting logs and metrics that can help detect security threats or anomalies.
What is Azure Monitor’s Change Analysis feature?
A tool that tracks and analyzes changes to Azure resources, helping to identify potential issues.
How can Azure Monitor help with capacity planning?
By using historical performance data to predict future resource requirements.
What is the purpose of setting thresholds in Azure Monitor?
To trigger alerts when performance metrics exceed or fall below the defined limits.
What is a Log Alert in Azure Monitor?
An alert triggered based on a query that runs against log data in a Log Analytics Workspace.
How does Azure Monitor support multi-cloud monitoring?
By collecting data from both Azure and non-Azure environments for a unified monitoring view.
Explain how Azure AutoScale works.
Azure AutoScale is part of Azure Monitor; it enables resources such as Virtual Machine Scale Set to be increased based on Azure Monitor Metric Value from an Azure Resource being monitored.
What are the pricing tiers for Azure Monitor?
- Per GB (Pay-As-You-Go) Pricing Tier
Data Ingestion: You pay based on the amount of data ingested into Azure Monitor. The cost is per GB of data ingested.
Data Retention: Data can be retained for free for the first 31 days. Beyond this, you pay a per-GB rate for retention.
Log Analytics Query Charges: No additional cost for querying the data stored in the workspace.
Features:
Log collection and analysis from multiple sources.
Basic monitoring metrics and insights.
Alerts and notifications.
Azure Monitor Logs, Alerts, Metrics, Application Insights. - Insight and Analytics (Legacy Pricing Tier)
This tier provides more detailed analytics but is not typically available for new customers, as it is part of legacy plans.
Fixed Fee: Pricing is typically based on a set amount of included data per day.
Additional Data: If usage exceeds the daily included amount, extra charges apply per GB.
Data Retention: Data can be retained for free for the first 31 days, with charges for extended retention. - Add-ons for Azure Monitor:
Application Insights: Costs based on data ingested per GB.
Azure Monitor Metrics: Free up to a certain number of standard metrics. Custom metrics have an additional cost per GB.
Log Alerts: Alerts based on query results, charged per query and frequency.
When data is injested into Azure monitor, how long before you start paying for data storage?
After 31 data will be deleted if there is not a retention period set.
What are the pricing tiers for Azure Monitor?
- Pay-as-you-go (ingestion and retention): You pay based on the volume of data ingested per GB and the retention period beyond the first included free days.
- Application Insights: Charged based on the volume of telemetry data collected by Application Insights from your applications, often integrated with Azure Monitor for comprehensive monitoring.
- Log Analytics Add-ons: Additional features, such as alerting, enhanced security, or performance monitoring, come at extra costs.
- Dedicated Capacity: For large-scale data ingestion, there’s an option to reserve capacity, offering a fixed cost per unit of reserved capacity.
Is Azure monitor deployed to a region or global?
It is a mix of both regional and global services
Are Azure Monitor Workspaces regional or global?
Azure Log Analytics Workspaces are regional resources. When you create a Log Analytics workspace, you must select a region where it will be hosted. All the data stored and processed in that workspace remains within the selected region, and this choice impacts data residency, latency, and compliance with regional data regulations.
What would I use in Azure monitor to monitor containers?
Azure container insights?
What is the primary purpose of Azure Monitor Container Insights?
Azure Monitor Container Insights helps monitor the performance and health of Kubernetes clusters and containers running on them.
Which Kubernetes platforms does Azure Monitor Container Insights support?
Azure Kubernetes Service (AKS),
Kubernetes running on Azure Stack,
Any Kubernetes cluster hosted on other platforms.
Does Azure Container Insights support other platforms than Kubernetes?
No, not directly.
How can you use Azure Monitor to provide monitoring for Azure Container Apps?
Azure monitoring provide for:
Log streaming View streaming system and console logs from a container in near real-time.
Container console Connect to the Linux console in your containers to debug your application from inside the container.
Azure Monitor metrics View and analyze your application’s compute and network usage through metric data.
Application logging Monitor, analyze, and debug your app using log data.
Azure Monitor Log Analytics Run queries to view and analyze your app’s system and application logs.
Azure Monitor alerts Create and manage alerts to notify you of events and conditions based on metric and log data.
I require complete monitoring for my Azure Kubernetes Service deployment; what can I use?
You can use Azure Monitor Container Insights.
I wnat to be alerted when an Azure service fails; how can I do this?
Use Azure Monitor Service Health; you can define what service in what region are to be monitored, you can use action groups.
List the log types available in the Active directory.
Sign-in logs
Is it possible to log sign-in attempts?
Yes, Azure Entra ID provides sign-in logs under monitoring
In Azure Entra ID, what are the audit logs providing?
Audit logs provide records of all changes made to resources in Azure Entra ID. This includes activities like user creation, group modification, role changes, and license assignments. Each log entry includes details such as who performed the action, what was changed, and when the action occurred, helping administrators track resource modifications for compliance and governance purposes.
In Azure Entra ID, what are the Sign-in logs providing?
These logs record each user’s sign-in activity. Information includes who signed in, when, and from where, along with details such as IP address, device, and application used. Sign-in logs are useful for analyzing authentication patterns, identifying suspicious activity, or troubleshooting login issues.
In Azure Entra ID, what are the Non-Interactive User Sign-In logs providing?
These logs capture sign-in attempts by non-interactive users, which are typically automated processes such as background services or scheduled tasks that authenticate without requiring direct user interaction (e.g., accessing an application with a token). Monitoring these logs helps detect unexpected automated sign-ins or bot activities.
In Azure Entra ID, what are the Sign-in logs providing?
Service principals are the identities associated with applications and services that need to authenticate in Azure Entra ID. These logs track the sign-in attempts of service principals and help in troubleshooting application access issues and ensuring security around how applications are accessing resources.
In Azure Entra ID, what are theManaged Identity Sign-In Logs: logs providing?
Managed identities are special identities in Azure used by services to authenticate without storing credentials. These logs capture the sign-in attempts of managed identities, which are often used by applications and services to securely access Azure resources.
In Azure Entra ID, what are the Provisioning Logs: Logs providing?
Provisioning logs track the creation, update, and deletion of users, groups, and applications within Azure Entra ID, typically as part of automated user or group provisioning workflows (e.g., SCIM provisioning for SaaS apps). They provide insight into synchronization operations, including success and failure details.
In Azure Entra ID, what are the Sign-in logs providing?
These logs track authentication requests that go through Active Directory Federation Services (ADFS), a service used to provide federated authentication. Monitoring these logs helps troubleshoot federated login issues and track the health of ADFS infrastructure.
In Azure Entra ID, what are the Risky Users logs providing?
Risky user logs provide information about users that have been flagged as high risk by Azure Entra Identity Protection. These users might have been involved in suspicious activities such as signing in from unusual locations or exhibiting compromised credentials, enabling administrators to take appropriate remediation actions.
In Azure Entra ID, what are the User Risk Events logs providing?
These logs capture the specific events that contribute to marking a user as risky, such as sign-ins from unfamiliar devices, atypical behavior, or known password leaks. They are a critical part of risk-based conditional access policies.
In Azure Entra ID, what are the Network Access Traffic Log providing?
These logs track traffic and access patterns associated with network-based authentication events. They help monitor the behavior of users and services as they access Azure resources via Azure Entra ID, providing insights for network performance and security analysis.
In Azure Entra ID, what are the Risky Service Principals providing?
Similar to risky user logs, these logs identify service principals (applications or services) that have been flagged as risky, often due to suspicious or abnormal behavior such as unusual authentication attempts or unexpected changes in permissions.
In Azure Entra ID, what are the Service Principal Risk Events providing?
These logs document specific events contributing to the identification of risky service principals. Examples include failed authentication attempts or attempts to access sensitive data from unexpected locations.
In Azure Entra ID, what are the Enriched Office 365 Audit Logs providing?
These logs provide detailed audit trails for activities in Office 365 that are enriched with data from Azure Entra ID. They include actions such as user and group management, login attempts, and changes to permissions in Office 365 applications like Exchange, SharePoint, and Teams.
In Azure Entra ID, what are the Microsoft Graph Activity Logsproviding?
These logs capture activities and requests made through the Microsoft Graph API, which is the gateway to accessing data and insights across Microsoft services. These logs are helpful in monitoring application access patterns and ensuring proper use of APIs.
In Azure Entra ID, what is Remote Network Health Log providing?
These logs capture the health and performance of network connectivity for remote workers accessing Azure services. It helps in understanding the quality and reliability of network access from remote locations and identifying potential connectivity issues impacting user experience.
In Azure Entra ID, what are the Network Access Alerts providing?
These alerts are generated based on unusual or suspicious network access patterns, such as an unexpected surge in authentication requests from a specific IP range or geolocation. They help administrators quickly detect and respond to potential security incidents.
How long are audit logs kept for by default?
90 days
How long are diagnostic logs kept for default?
Diagnostic logs are sent to your azure storage account, and you can decide how long to keep them.
How long are Azure workspace logs kept for?
By default, 30 days, but you can decide to keep them for 730 days
How can I use Azure Monitor to collect performance metrics from custom resources?
To collect performance metrics from custom resources using Azure Monitor, you can leverage Azure Monitor’s custom metrics feature by deploying:
Azure Monitor Agent
Application Insights
Can you use Azure Monitor Agent (AMA) for logs and metrics?
The Azure Monitor Agent (AMA) supports log and metric data collection for Azure resources. It is a unified agent designed to collect telemetry from various sources and send it to different destinations in Azure Monitor, such as Log Analytics workspaces or Application Insights.
Explain how to capture logs and metrics and send them to Azure monitor from a Linux server running in Azure?
To capture logs and metrics from a Linux server in Azure, install the Azure Monitor Agent (AMA) on the server. Configure the agent to collect data such as performance metrics, syslog, and custom logs. Send this data to Azure Monitor by specifying the destination Log Analytics workspace in the agent configuration settings.
Is Azure Monitor Agent (AMA) deployed on a VM when deployed in Azure
No, the Azure Monitor Agent (AMA) is not automatically installed when a VM is deployed in Azure; it requires a separate installation and configuration process if you want to use it to collect telemetry data (logs and metrics) from that VM. Here’s a quick breakdown:
- Automatic Deployment of Diagnostics vs. AMA:
When you deploy a VM in Azure, diagnostic settings are available for capturing some basic metrics and activity logs, but AMA is not automatically included.
To gain advanced monitoring capabilities (custom logs, detailed metrics), you need to explicitly install AMA on the VM. - Installing AMA After VM Deployment:
AMA can be installed post-deployment using Azure Policy, which allows you to enforce installation across multiple VMs automatically.
You can also manually install AMA using the Azure portal, Azure CLI, PowerShell, or automation tools like Azure Resource Manager (ARM) templates. - Using AMA for Comprehensive Monitoring:
AMA provides a unified agent for both metrics and logs, allowing you to create Data Collection Rules (DCRs) that specify exactly what data to collect and where to send it (e.g., Log Analytics workspace).
It’s suitable for Azure VMs as well as on-premises and multi-cloud environments, making it a flexible choice for hybrid setups.
When a VM is deployed in Azure, does Azure Monitor automatically deploy a monitoring agent and collect operating system metrics?
No, the Azure Monitor Agent that collects logs and metrics is a separate install and configuration.
How would you automatically deploy the Azure Agent Monitor across all VM as they are deployed as a requirement in your organization?
Use Azure Policy to automate the deployment of the agent across multiple VMs in you orgnization.
What is the easy way to deploy app insights?
You can manually enable it on the virtual machine, or if you want it to be deployed more widely across the organization, you can use a policy to define how it is deployed.
What types of data do you capture with Azure App Insight?
Application code level metrics
What can you monitor with Azure Monitor
Applications:
Virtual machines:
Guest operating systems:
Containers: including Prometheus metrics
Databases:
Security events: in combination with Azure Sentinel
Networking: events and health in combination with Network Watcher
Custom sources: that use the APIs to get data into Azure Monitor
Can I use application insights for network events
Yes, this is supported.
What functions/services would I use to understand the network topology in Azure Monitor?
Azure Monitor has a Network Watcher, and it has a Topology view.
What is an Azure monitor network monitor - connection monitor?
It enables you to connect a connection from a virtual machine to a destination (IP, FQDN) (PORT) and have a record of round trip time (latency) and probes failed). The capture probe latency is saved, and you can see it.
How can I have a probe to check for connection latency and missed probes?
It enables you to connect a connection from a virtual machine to a destination (IP, FQDN) (PORT) and have a record of round trip time (latency) and probes failed). The capture probe latency is saved, and you can see it.
What is Azure Monitor Application Insights?
It is an APM (application performance management) service thet is part of Azure Monitor.
What is Azure Monitor Application Insights Application Map?
Azure Monitor Application Insights Application Map creates a visual map of the application cop[onents of the applications.
What is Azure Monitor Application Insights Application Map?
Azure Monitor Application Insights Application Map creates a visual map of the application cop[onents of the applications.
What is Azure Monitor Application Insights Profiler?
Azure Monitor Application Insights Profiler is a performance monitoring tool designed to help developers and IT professionals analyze the performance of .NET applications running in Azure. It captures detailed performance traces, enabling you to identify performance bottlenecks, optimize code, and enhance the overall efficiency of your applications.
Key Features:
Automatic Profiling: Profiler runs automatically at regular intervals, capturing performance data without manual intervention. It can also be triggered based on specific conditions, such as high CPU or memory usage.
Low Overhead: Designed for production environments, Profiler adds minimal overhead, typically between 5% to 15% of CPU and memory usage during active profiling sessions.
Detailed Trace Analysis: Provides in-depth insights into the execution of your application, including call stacks and the time spent on various methods, helping you pinpoint performance issues.
Integration with Application Insights: Seamlessly integrates with Azure Monitor Application Insights, allowing you to correlate performance data with other telemetry, such as logs and metrics, for a comprehensive view of your application’s health.
What is Azure Monitor Application Insights Userflow?
Azure Monitor Application Insights User Flows is a feature that visualizes the navigation paths users take through your web application. It helps you understand how users interact with your app, identify common navigation patterns, and detect potential bottlenecks or drop-off points. By analyzing these flows, you can optimize the user experience and improve application performance.
To utilize User Flows, ensure your application is instrumented with the Application Insights SDK. Once set up, you can access the User Flows feature in the Azure portal under the Application Insights resource for your application. This feature provides a visual representation of user navigation, highlighting the most common paths and areas where users may encounter issues.
What is Azure Monitor Application Insights Telemetry?
Azure Monitor Application Insights Telemetry is a feature of Azure Monitor that enables you to collect, analyze, and act upon telemetry data from your applications. This telemetry encompasses various types of data, including:
Requests: Logs of incoming requests to your application, detailing their success or failure, duration, and other relevant metrics.
Dependencies: Information about external calls your application makes, such as database queries or API calls, including their performance and outcomes.
Exceptions: Records of errors and exceptions that occur within your application, aiding in diagnosing and resolving issues.
Traces: Diagnostic log messages that provide insights into the application’s behavior and flow.
Metrics: Quantitative measurements like CPU usage, memory consumption, or custom metrics you define.
What is Azure Monitor Application Insights Live Metrics?
