Nordlicht Reisen GmbH, a fictional travel agency, wants to be able to answer two questions: "How heavily is the receipts storage account being used?" and "Who changed something last night?" Azure Monitor delivers both, but from different buckets, and Azure collects some data only when you ask for it. The exam calls this interpret metrics in Azure Monitor and configure log settings in Azure Monitor.
Prior knowledge. What Azure Monitor, Log Analytics, and Application Insights are good for is explained in "AZ-900 compact", lesson 3.4. The difference between logs, metrics, and traces for applications is shown in K3, lesson 3.4.1 (Logs, metrics, traces), and Application Insights in K3, lesson 3.4.2 (Application Insights with OpenTelemetry). This lesson is about operating the Azure resources themselves. Queries on the collected logs follow in lesson 5.2, alerts in lesson 5.3.
Which data exists
| Platform metrics | Activity log | Resource logs | |
|---|---|---|---|
| Content | Numeric values over time (CPU, transactions, bytes) | Management operations of the control plane: create a VM, change a role, run a deployment | Operations inside a resource (data plane): read a blob, send a request to a database |
| Collected | automatically, no setup | automatically, no setup | only after a diagnostic setting |
| Retention | 93 days | 90 days, at no cost | depends on the destination |
| Read operations | – | usually not recorded | depends on the category |
The activity log is not an audit log for sign-in and authorization: requests that Azure Resource Manager already rejects during authentication or authorization produce no entry. According to Microsoft, its entries are usually available 3 to 20 minutes after the event. If you want to know who created a resource, you have to forward the entries early enough, because only the activity log names the creator.