Monitor and Back up Azure Resources Flashcards
What two types of data feed into Azure Monitor ?
Metrics
Logs
What are the three big differentiators between metrics and logs ?
Retention
Properties
Data Availability
Can be stored for up to 2 years
- Metrics
- Log Analytics
Log Analytics
Typically retained for up to 93 days
- Metrics
- Log Analytics
Metrics
Metrics have a fixed set of properties (or attributes). What are these five properties ?
Time Type Resource Value Dimensions
Typically gathered over time and available for immediate query
- Metrics
- Log Analytics
Metrics
………………………… are often gathered after being triggered by an event (such as an event is written to an application log) and can take time to process before they are available for query.
Log Analytics
……………………… will typically be used for fast alerts, and …………………….. are used for more complex analysis.
metrics
logs
Data stored in Log Analytics can also be queried directly through a ……………………………… , where you will have access to the same query interfaces as you have through Azure Monitor, but you also can make customizations to the configuration of the workspace
Log Analytics Workspace
What is the time interval at which Azure Metrics are collected ?
one - minute intervals
How is an Azure metric identified ? (2 things)
metric name
namespace (category)
What is the typical retention period of metrics ?
93 days
What must you enable and set up to query application metrics ?
Application Insights
Virtual machines in Azure can also push custom metrics to the monitor service using the ………………………… extension on Windows servers
Windows Diagnostic
Virtual machines in Azure can also push custom metrics to the monitor service using the ……………………………………. on Linux VMs
InfluxData Telegraf Agent
What are two ways to increase the retention period of metrics ?
Send them to Log Analytics
Send them to a storage account with a retention policy
What are the four properties of each metric ?
■ The time the value was collected
■ The type of measurement the value represents
■ The resource with which the value is associated
■ The value itself
True or false : Using Azure Monitor, you can chart resources and metrics across several different subscriptions
True
True or false : Using Azure Monitor, you can chart resources and metric, but they must reside within the same subscription.
False
A Log Analytics Workspace is an Azure……………………….. , meaning that……………………………. can be applied for granular access to the service and the data stored within it.
resource
RBAC
After having provisioned a Log Analytics Workspace, which blade in the Logs Analytics Workspace blade allows you to obtain the Agent ID, the primary key, and the secondary key for the Agent ?
Agent Management
For VM machines to begin reporting telemetry to Log Analytics, what must they have installed ?
Azure Log Analytics Agent
For the agent to send telemetry, you must also ensure that the required………….. are available, and the required………………. are added to the approved-list.
ports
URIs
A Log Analytics Agent on a machine uses which port for all outbound communication to the Log Analytics Workspace ?
Port 443
What are the three different types of platform logs ?
What layer of Azure are they associated with ? (tenant, subscription, resources…)
Resource logs - resource layer
Activity logs - subscription layer
Azure Active Directory logs - tenant layer
What are 4 destinations where one can send their logs ?
The Azure Portal
Azure Log Analytics
A storage account
An event hub
The Azure …………………………. surfaces data at the subscription level and can be useful for understanding actions that occur within your environment against the Resource Manager APIs.
Activity Log
The query language used by Log Analytics is called……………….
Kusto
Queries always begin with a……………… –either a table or search-based query
scope
………………………………. target a single table in a Log Analytics Workspace (or database), while ………………………. target all tables by default.
Table-based queries
search-based queries
What are the two types of queries Log Analytics ?
Table - based queries
Search - based queries
………………………… queries can be saved for later and/or marked as favorites so they can be retrieved later using the Query explorer
Authored
What is the path for accessing Sample Queries and authoring your own queries ?
Azure Portal - Azure Monitor - Logs blade
What is the path in the Azure Portal to create an Application Insight resource ?
Azure Monitor - Insights - Applications (left side pane) - Create Application Insight App
Alerts in Azure Monitor are centered on alert rules. Alert Rules contain what 4 components ?
■ A target resource (or resource type)
■ Conditional logic for the alert with criteria based on the available signals for the target resource
■ An Action Group, or what should happen when the alert rule condition is met
■ A name and description for the alert rule
When creating an alert rule, the target resource defines the scope and signals available for the alert.
A target resource is an Azure resource that generates signals. What are the three types of signals ?
■ Metrics
■ Log search queries
■ Activity Logs
A(n) …………….. is a collection of actions that should occur in response to an alert being triggered.
Action Group
Action groups are separate resources and are independent of the alert rule.
What does this mean iif you have a large amount of alert rules ?
This means that the same Action Group can be used across multiple alert rules.
When configuring an action group, in addition to sending email notifications, what are five other actions that you can automate ?
Runbook (Powershell that runs in Azure Automation Service) Function Apps ITSM (ServiceNow for example) Logic Apps Webhook
True or false : Alerts are managed independently of alert rules and maintain their own state.
True
What are the three states an alert can have ?
■ New. The alert is new and has not been reviewed
■ Acknowledged. The issue that generated the alert is being actioned by an administrator
■ Closed. The issue that generated the alert has been resolved, and the alert has been marked as closed
True or false : The state of an alert is updated by the user who is interacting with the alert and is not updated automatically by the Azure platform.
True
True or false : The state of an alert is updated automatically by the Azure platform.
False
Alert state is not the same as the monitor condition of an alert.
When the Azure platform generates an alert based on an alert rule, the alert’s monitor condition is set to ………….. and when the underlying condition clears, the monitor condition is set to …………….
fired
resolved
[Backup and restore with on-premises workloads]
To back up files and folders from on-premises VMs, you need to use the MARS agent.
What does MARS stand for ?
Microsoft Azure Recovery Services