5.1 - Azure Monitor, Log Analytics and KQL
AZ-104 objective 5.1 covers monitoring with Azure Monitor and Log Analytics. A diagnostic setting routes platform metrics and resource logs to one or more destinations: a Log Analytics workspace for KQL queries, an Azure Storage account for cheap long-term archival, or an Event Hub for streaming to external tools; a Log Analytics workspace can even hold platform metric history alongside logs, but an arbitrary VM is not itself a valid destination. You query collected logs with Kusto Query Language: search does a free-text hunt across all columns for a string such as error, union appends the rows of two or more tables into one result, take returns a quick arbitrary sample to preview a table's shape, and the AzureActivity table records subscription-level control-plane operations such as who deleted a resource group. Azure Monitor metrics explorer shows resource-level metrics directly without first sending them to a workspace. Beyond the interactive retention period, a Log Analytics table can keep data cheaply in a lower-cost archive state before it is finally deleted, controlling cost. Alert rules fire on a metric threshold or a log query and trigger an action group. Expect scenarios that ask which destination, table or KQL operator fits.
Route platform metrics and logs to a workspace, storage account or event hub = diagnostic setting. Who deleted a resource group = AzureActivity table. Append rows across tables = union; quick sample = take. Cut cost past retention = archive state.
Practice questions
1. You want to write KQL queries against logs collected from many Azure resources in one place. Where are those logs stored and queried?
- A Log Analytics workspace (correct answer)
- The Azure Pricing calculator, which only estimates the future monthly cost of planned resources
- A general-purpose storage account
- Azure Advisor
A Log Analytics workspace is the store for logs collected by Azure Monitor, queried with KQL. The Pricing calculator only estimates costs, a storage account is raw storage without KQL, and Advisor gives recommendations.
2. You need near-real-time numeric performance data such as VM CPU percentage, sampled at short intervals for charting. Which Azure Monitor data type is this?
- Metrics (correct answer)
- Activity logs, which instead record control-plane operations such as resource create and delete events
- Boot diagnostics
- Application source code
Metrics are lightweight numeric values collected at regular intervals, ideal for near-real-time performance charts like CPU percentage. Activity logs record management operations, boot diagnostics capture startup output, and source code is unrelated.
3. Which Azure Monitor tool lets you plot and chart numeric platform metrics such as VM CPU percentage interactively?
- Metrics explorer (correct answer)
- The activity log, which instead lists the control-plane operations performed on your resources over time
- A Recovery Services vault
- A network security group
Metrics explorer is the interactive charting tool in Azure Monitor for numeric time-series metrics. The activity log records management operations, a Recovery Services vault stores backups, and an NSG filters traffic.
4. For how long are Azure Monitor platform metrics retained by default before they roll off?
- Ten years, matching the maximum legal audit retention offered by most compliance frameworks worldwide
- 93 days (correct answer)
- Forever, at no additional cost
- One hour
Platform metrics are kept for 93 days by default. To keep metric data longer you route it to a Log Analytics workspace or storage via a diagnostic setting; retention is neither one hour nor unlimited.
5. In metrics explorer, what does the aggregation setting (avg, min, max, sum, count) control?
- How the raw samples in each time interval are combined into one value on the chart (correct answer)
- The physical geographic region into which the underlying virtual machine sending this metric is currently deployed, executed, and billed by Azure
- Which backup vault stores the recovery points
- The subnet the resource belongs to
Aggregation defines how the raw samples within each time grain are summarized into a single plotted value, for example average or maximum. It has nothing to do with region, backup vaults, or subnets.
6. You want one metrics chart to show CPU broken out separately per instance of a scale set. Which feature do you use?
- A brand new Log Analytics workspace deployed specifically to store one copy of the CPU counter per node
- A resource lock
- Splitting by a dimension (correct answer)
- A user-defined route
Splitting by a dimension (such as instance) draws a separate line per dimension value on one chart. A new workspace is unnecessary, a lock protects resources, and a UDR concerns routing.