What Is Azure Monitor?
Azure Monitor is Microsoft's comprehensive monitoring platform for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. Think of it as the central nervous system for everything running in Azure — it sees what's happening, stores the data, and helps you respond.
The Monitoring Data Pipeline
Azure Monitor follows a four-stage pipeline:
| Stage | What Happens | Example |
|---|---|---|
| Collect | Telemetry is gathered from resources, apps, OS, and custom sources | A VM emits CPU metrics every minute |
| Store | Data lands in Metrics Store (numeric) or Log Analytics (logs/traces) | CPU % stored as a time-series; boot logs stored as text records |
| Analyze | You query, visualize, and correlate the data | KQL query finds error spikes at 3 AM |
| Act | Alerts fire, autoscale triggers, or runbooks execute | Email sent when CPU > 90% for 5 minutes |
This pipeline runs continuously and automatically for most Azure resources — you don't need to install anything to start getting basic metrics.
Metrics vs Logs — A Detailed Comparison
These are the two fundamental data types in Azure Monitor. Understanding the difference is critical.
| Aspect | Metrics | Logs |
|---|---|---|
| Data type | Numeric time-series values | Semi-structured text records (JSON-like) |
| Storage | Azure Monitor Metrics Store (lightweight, fast) | Log Analytics workspace (rich, queryable) |
| Retention | 93 days by default | 30 days free, configurable up to 730 days |
| Query language | Simple filters in Metrics Explorer | KQL (Kusto Query Language) |
| Latency | Near real-time (< 1 minute) | Typically 1–5 minutes ingestion delay |
| Cost | Free for platform metrics | Pay per GB ingested |
| Best for | Dashboards, quick health checks, autoscale triggers | Root-cause analysis, audit trails, complex correlations |
| Example | CPU Percentage = 72.3% at 10:05 AM | "Error: Connection refused to SQL server at 10:05:03 AM" |
Data Sources
Azure Monitor collects from four layers:
- Azure Resources — Every Azure service (VMs, App Services, Storage, SQL) emits platform metrics and resource logs automatically.
- Applications — Application Insights SDK or auto-instrumentation captures requests, dependencies, exceptions, and custom telemetry.
- Operating System — The Azure Monitor Agent (AMA) collects performance counters, event logs (Windows), and syslog (Linux) from guest OS.
- Custom Sources — REST API, custom metrics SDK, or Data Collection Rules let you push your own data into Azure Monitor.
Core Components
Metrics Explorer
A portal tool for charting numeric metrics. Select a resource, pick a metric (e.g., CPU Percentage), choose an aggregation (avg, max), and instantly see a time-series graph. You can split by dimension (e.g., per-instance CPU) and pin charts to dashboards.
Log Analytics
A workspace where all log data lives. You write KQL queries to search, filter, and summarize millions of records. It powers alerts, workbooks, and integrations.
Alerts
Rules that evaluate conditions (metric thresholds or log query results) and trigger actions — emails, SMS, webhooks, Azure Functions, or ITSM tickets.
Workbooks
Interactive reports combining metrics, logs, text, and parameters into shareable dashboards. More flexible than portal dashboards for complex visualizations.
Application Map
A visual topology of your distributed application showing services, dependencies, and the health/performance of each connection.
How It Relates to Application Insights and Log Analytics
Azure Monitor is the umbrella platform. Application Insights and Log Analytics are components within it:
Azure Monitor (platform)
├── Metrics Store ← platform metrics, custom metrics
├── Log Analytics Workspace ← all log data
│ ├── Resource logs
│ ├── Activity logs
│ └── Application Insights data (AppRequests, AppExceptions, etc.)
└── Application Insights ← app-level telemetry (uses Log Analytics for storage)
Application Insights data is stored in a Log Analytics workspace. When you query AppRequests in Log Analytics, you're querying App Insights data.
CLI Examples
# List available metric definitions for an App Service
az monitor metrics list-definitions \
--resource "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Web/sites/myApp"
# Query average CPU percentage for the last hour
az monitor metrics list \
--resource "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myVM" \
--metric "Percentage CPU" \
--aggregation Average \
--interval PT1M \
--start-time 2026-05-25T00:00:00Z \
--end-time 2026-05-25T01:00:00Z
# List Log Analytics workspaces in a resource group
az monitor log-analytics workspace list --resource-group myRG --output table
Pricing Basics
| Component | Cost Model |
|---|---|
| Platform metrics | Free (included with every resource) |
| Custom metrics | Per million time-series ingested |
| Log ingestion | Per GB ingested into Log Analytics |
| Log retention | Free for first 31 days; per GB/month after |
| Alerts | Per alert rule per month (metric ~$0.10; log ~$0.50–$1.50) |
| Notifications | Free for email; SMS/voice charged per message |
Tip: Use the Azure Pricing Calculator for current rates — prices vary by region.
Common Mistakes
- Ignoring diagnostic settings — Resources emit metrics automatically, but logs require you to explicitly configure diagnostic settings to route them to a workspace.
- Creating too many workspaces — Start with one workspace per environment (dev/prod). More workspaces = harder cross-resource queries.
- Not setting retention policies — Default 30-day retention may lose data you need for compliance. Set it explicitly.
- Confusing metrics with logs — Trying to do root-cause analysis with metrics alone won't work. You need logs for detail.
Real-World Use Cases
- E-commerce site — Monitor HTTP 5xx rates (metrics) and correlate with exception logs to find the failing dependency.
- Microservices — Use Application Map to see which downstream service is causing latency spikes.
- Compliance — Route Activity Logs to a workspace with 365-day retention for audit requirements.
- Cost control — Set budget alerts combined with resource metric alerts to catch runaway services.
Key Takeaways
- Azure Monitor is the unified monitoring platform — metrics, logs, alerts, and visualizations all live here.
- Metrics are fast, numeric, and free; logs are rich, text-based, and billed per GB.
- The pipeline is Collect → Store → Analyze → Act.
- Application Insights and Log Analytics are components of Azure Monitor, not separate products.
- Platform metrics flow automatically; logs require diagnostic settings configuration.
- Start with one Log Analytics workspace and expand only when you have a clear reason.