Nordlicht Reisen GmbH, a fictional travel agency, no longer wants to guess when the portal gets slow in the summer wave. It needs the logs of the servers in Hamburg and of the Azure resources in one place, an archive that nobody can change in secret, a data stream for an external security provider and alerts before customers call. This lesson doesn't ask how to set up Azure Monitor, but which solution fits which requirement: logging, forwarding and monitoring.
Prior knowledge. What Azure Monitor is, is covered in "AZ-900 compact, lesson 3.4". Metrics, diagnostic settings, workspace and KQL you set up in "AZ-104, lessons 5.1 and 5.2", alert rules in "AZ-104, lesson 5.3", insights in "AZ-104, lesson 5.4". How developers produce and query the three signals log, metric and trace is shown in "K3, lessons 3.4.1 to 3.4.5". None of that is repeated here; the lesson asks what to recommend when.
The requirement
The requirements sheet uses the template from lesson 0.2 and the starting point G-01 to G-10. All numbers are assumptions of the task.
| No. | Requirement | Type | Measure | Weight | Source |
|---|---|---|---|---|---|
| 1.1-01 | Logs of the Windows servers in Hamburg (G-04) are available centrally. | F | about 60 servers (assumption) | Must | Operations |
| 1.1-02 | Resource logs of the Azure services are available centrally. | F | all services of the portal (G-02); assumption | Must | Operations |
| 1.1-03 | Operations queries logs of the last 90 days interactively. | Q | 90 days; assumption | Must | Operations |
| 1.1-04 | Audit logs are kept for seven years and cannot be changed in secret. | R | 7 years; assumption | Must | Audit |
| 1.1-05 | Logs stay in the EU (G-08). | R | germanywestcentral |
Must | Data protection |
| 1.1-06 | An external provider reads part of the logs in its own SIEM. | F | stream, not query; assumption | Should | Security |
| 1.1-07 | Operations learns of rising booking errors. | Q | alert within 5 minutes; assumption | Must | Operations |
| 1.1-08 | Developers see requests and exceptions of the portal. | F | application monitoring; assumption | Should | Development |
Cost frame. Costs fall before operating convenience, not before 1.1-04. Cost drivers: ingested data volume per gigabyte, retention beyond the included time, queries on low-cost table plans, storage in the archive. Amounts are on the Azure Monitor pricing page.