You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
Diagnostic settings are the primary mechanism for routing resource logs and platform metrics to destinations such as a Log Analytics workspace, an Azure Storage account, or an Azure Event Hub. These settings capture granular operational data that is not collected by default, and by selecting specific log categories administrators can control which information is stored to manage costs. For virtual machines, Data Collection Rules (DCRs) define the telemetry gathered by the Azure Monitor Agent (AMA). A DCR acts as a blueprint specifying which performance counters and Windows or Syslog events to send to a workspace, and a single DCR can apply to multiple VMs for consistent monitoring across the environment. This method replaces older agents and offers granular control over data filtering through transformations.
Monitoring virtual machines involves tracking both the VM host and the guest operating system. Host metrics such as CPU and disk utilization are collected automatically, but guest-level data requires the AMA and a DCR. VM Insights streamlines this process by automatically deploying the agent and configuring a default DCR. Key features include performance views with predefined charts for core metrics, a map feature that visualizes processes and dependencies between machines, and health monitoring that tracks the availability and status of workloads. Azure Storage accounts and Virtual Networks also require specific diagnostic configurations. For storage, you must enable diagnostic settings for each service type, such as Blobs or Files, to capture access logs and transaction data. Networking resources use diagnostic settings to record NSG flow logs and resource logs vital for security auditing. Integrating this data into a Log Analytics workspace enables complex cross-resource analysis using the Kusto Query Language (KQL).
Effective data collection requires balancing visibility with cost optimization. Azure Monitor allows transformations within a DCR to filter out unnecessary columns or rows before ingestion. Reducing the polling frequency of performance counters and avoiding duplicate data streams are critical steps for maintaining a budget. Administrators should regularly use Log Analytics workspace insights to identify high-volume data sources and adjust collection settings accordingly.
Azure Monitor Insights provides comprehensive monitoring of health, performance, and availability for virtual machines, storage accounts, and networks through dedicated tools: VM Insights, Storage Insights, and Network Insights. These tools visualize and analyze key metrics and logs such as CPU, memory, disk, network utilization, and application dependencies, helping identify trends, troubleshoot issues, and optimize resource usage. Data collection relies on platform metrics, activity logs, and resource logs. Metrics like CPU usage are collected automatically and stored in the Azure Monitor metrics database. For deeper analysis, install the Azure Monitor Agent on VMs and configure Data Collection Rules (DCRs) to gather guest OS performance counters, application logs, and custom events. Use Log Analytics and Kusto Query Language (KQL) to query and correlate data across resources for advanced troubleshooting and reporting.
Visualization tools within Azure Monitor include Metrics Explorer for charting performance trends, Workbooks for creating interactive dashboards with metrics and log queries, Dependency Maps for understanding process relationships, and integrations with Grafana and Power BI for custom dashboards. To proactively address issues, configure alert rules in Azure Monitor. You can create metric alerts based on threshold breaches, log alerts using KQL queries, and activity log alerts for resource changes. Alerts can be set at scale using multi-resource alert rules and Azure Monitor Baseline Alerts (AMBA). Action groups automate responses such as email or SMS notifications, webhooks, and Logic Apps for remediation workflows.
Recommended practices include enabling recommended alerts for common VM issues like server downtime or agent heartbeat failures, using dynamic thresholds for metric alerts that leverage machine learning for baseline detection, and routinely reviewing Advisor recommendations for personalized guidance. Integration with Microsoft Defender for Cloud and Microsoft Sentinel enhances security and threat detection, while Azure RBAC manages access. By leveraging these insights and robust alerting, you ensure a healthy, secure, and performant Azure infrastructure with proactive monitoring and rapid incident response.
Azure Monitor Insights helps monitor and analyze performance across virtual machines, storage accounts, and networks. To monitor session hosts, install the Azure Monitor Agent on all hosts in the pool and send data to a Log Analytics workspace. If some hosts are not sending data, select the Data Collection Rule (DCR) for data collection, deploy the agent, configure the required managed identity, and refresh the configuration workbook. Performance counters are essential for collecting performance data from session hosts. Check the Configured counters and Missing counters in the configuration workbook, enable any missing counters by selecting Configure performance counters, and then refresh the workbook to verify all required counters are enabled.
Windows Event Logs collect errors, warnings, and information from session hosts. Check Configured Event Logs and Missing Event Logs in the configuration workbook, enable missing logs by selecting Configure Events, and refresh the workbook. Azure Monitor allows setting up alerts for various metrics and logs to identify performance issues and take corrective actions. The Traffic tab in Azure Monitor Insights provides a detailed view of network security groups and their configurations for NSG flow logs and Traffic analytics. You can search for specific IP addresses and view configuration status and alerts. The Diagnostic Toolkit offers tools such as packet capture, VPN troubleshoot, connection troubleshoot, next hop, and IP flow verify for diagnosing network performance problems.
Azure Monitor Insights also provides visibility into the health of networking resources. Some resources are Onboarded, offering a specific topology view and built-in metrics workbook for easier exploration. To troubleshoot performance problems, refer to the documentation for the malfunctioning resource. You can make changes or add visualizations by selecting Edit Mode in the workbook. The diagnostics service tracks activity logs such as WVDCheckpoints, WVDConnections, WVDErrors, and more, and estimating data ingestion per VM per day helps manage monitoring costs. Use custom queries to analyze data ingestion in your Log Analytics workspace, tracking frequency and size of performance counter data to identify cost-reduction opportunities. Estimate total costs based on size estimates per day for performance counters, events, and diagnostics, and consider the Pay-as-you-go or Capacity Reservation model for Log Analytics pricing. Measure and manage data ingestion to optimize costs, and be aware of known issues such as query errors or missing connection events, regularly reviewing and updating monitoring configurations.
StudyCerts
StudyCerts