Assess Log Data Requirements and Service Capabilities
Operational Excellence
Operational excellence in logging aims to reduce the manual effort needed to monitor systems while maximizing visibility. A core principle is designing a workspace architecture with the fewest number of Log Analytics workspaces necessary to meet business needs, which simplifies management. You can manage these workspaces consistently using Infrastructure as Code (IaC) tools like ARM, BICEP, or Terraform. To maintain the health of your logging system itself, you should use Log Analytics Workspace Insights to monitor performance and set up proactive alert rules for any operational problems.
Configuration Recommendations
To build a reliable and efficient monitoring system, you should configure Azure Monitor alerts intelligently. Use dynamic thresholds in your metric alert rules, which allow machine learning to set appropriate alert levels based on historical trends. Whenever possible, create a single alert rule that monitors many resources of the same type to reduce management overhead. You can further control alert behavior at scale using alert processing rules. For more complex diagnostics, you can integrate Logic Apps to enrich log data with custom information before it is analyzed.
Log Routing Options
Deciding where to send your log data is a critical cost and compliance decision. You route logs from Azure resources using diagnostic settings, which send data to destinations like a Log Analytics workspace for interactive querying, a storage account for long-term archival, or Event Hubs for streaming to other systems. Your choice depends on analyzing the log volume, how long you need to retain the data, and how you plan to query it. To enforce these routing decisions consistently across many resources, you can use Azure Policy to deploy the required diagnostic settings automatically.
Azure Monitor Metrics and Logs
Azure Monitor collects different types of data to give you a complete picture of your system's health. Standard metrics are pre-aggregated performance numbers, like CPU usage, that are collected automatically. Log-based metrics are time-series data created from log queries, allowing for more detailed analysis of complex events. For tracking unique business or application data, you can create custom metrics. Understanding these types helps you decide what to monitor and where to send the data for the most effective analysis.