Azure Monitor: Metrics, Logs, Traces, Events & Changes

What is a Metric in Azure?

A Metric in Azure is a numerical measurement used to monitor the performance, health, and utilization of Azure resources.

Metrics are collected over time and can be viewed using Azure Monitor.

Simple Example

Suppose you have an Azure Virtual Machine (VM).

Azure collects metrics such as:

Metric	Description
CPU Percentage	How much CPU is being used
Available Memory	Amount of available memory, when supported
Disk Read Operations	Number of disk read operations
Disk Write Operations	Number of disk write operations
Network In Total	Incoming network traffic
Network Out Total	Outgoing network traffic

Example: If your VM's CPU usage reaches 95%, it may indicate high resource utilization.

You can configure an Azure Monitor alert to notify you when CPU usage exceeds 80% for 5 minutes.

How Azure Metrics Work

       Azure Resources
              |
              v
       Metrics Collected
              |
              v
         Azure Monitor
              |
       +------+------+
       |             |
       v             v
   Metrics        Alerts
   Explorer          |
       |             v
       v        Email / SMS
    Charts       Notification

Types of Metrics in Azure

Platform Metrics: Automatically collected by Azure, such as VM CPU usage and storage transactions.
Custom Metrics: Metrics published by your application or monitoring solution.
Guest OS Metrics: Metrics collected from inside a VM, such as memory usage, typically using Azure Monitor Agent and a data collection rule.

How to View Metrics in Azure Portal

Open Azure Portal.
Navigate to your resource (e.g., Virtual Machine).
Select Monitoring → Metrics.
Choose a metric such as Percentage CPU.
Select a time range and aggregation (Average, Maximum, etc.).
View the metric as a chart.

Azure Metrics vs Logs

Metrics	Logs
Numerical measurements	Detailed event records
Used for performance monitoring	Used for troubleshooting and investigation
Example: CPU usage = 85%	Example: Application exception details
Suitable for charts and alerts	Suitable for detailed queries and analysis
Analyzed using Metrics Explorer	Analyzed using Log Analytics

Interview Quick Revision

Q: What are metrics in Azure?

Metrics are numerical measurements collected over time to monitor the performance, health, and utilization of Azure resources. Azure Monitor provides Metrics Explorer to visualize metrics and metric alerts to detect performance issues.

Key Points:

Azure Monitor is the primary monitoring service.
Platform metrics are collected automatically.
Metrics are time-series numerical data.
Metrics support monitoring, visualization, and alerting.
Azure Monitor metric data is generally retained for 93 days, although some metric types have different retention rules.

What is a Log in Azure?

A Log in Azure is a detailed record of events, activities, errors, and operations that occur within Azure resources and applications.

Logs help administrators and developers monitor, troubleshoot, investigate errors, and audit activities.

Azure Monitor provides Log Analytics to collect, store, and analyze logs using Kusto Query Language (KQL).

Simple Example

Suppose you have an ASP.NET Core Web API hosted in Azure App Service.

Your application generates logs such as:

10:00:01 - Information - User logged in successfully
10:05:12 - Warning     - API response time exceeded 3 seconds
10:10:25 - Error       - SQL Database connection failed
10:15:30 - Information - Article created successfully

Using these logs, you can identify what happened, when it happened, and why an error occurred.

How Azure Logs Work

        Azure Resources
              |
              v
        Logs Generated
              |
              v
         Azure Monitor
              |
              v
     Log Analytics Workspace
              |
              v
       Query Logs (KQL)
              |
       +------+------+
       |             |
       v             v
  Troubleshooting   Alerts
       |             |
       v             v
  Find Errors     Notifications

Types of Logs in Azure

Log Type	Description
Activity Logs	Records management operations on Azure resources, such as creating or deleting a VM
Resource Logs	Records resource-specific operations, such as HTTP requests or database activity
Application Logs	Records application events, errors, and exceptions
Microsoft Entra ID Logs	Records sign-in activities and identity-related audit events
Guest OS Logs	Records operating system events, such as Windows Event Logs and Linux Syslog

Important: Many resource logs must be explicitly enabled using Diagnostic Settings. Application and guest OS logs may require additional configuration or monitoring agents.

How to View Logs in Azure Portal

Open Azure Portal.
Navigate to Azure Monitor.
Select Logs.
Choose your Log Analytics workspace.
Write a KQL query.
Execute the query to view log records.

Example: KQL Query

Retrieve the latest 10 Azure Activity Log records:

AzureActivity
| order by TimeGenerated desc
| take 10

This query works when Azure Activity Logs are being sent to the Log Analytics workspace.

Azure Metrics vs Logs

Metrics	Logs
Numerical measurements	Detailed event records
Shows how a resource is performing	Shows what happened in a resource
Example: CPU usage = 90%	Example: Database connection failed
Used for performance monitoring	Used for troubleshooting and auditing
Viewed using Metrics Explorer	Queried using Log Analytics (KQL)
Usually lightweight time-series data	Often contains detailed structured information

Interview Quick Revision

Q: What are logs in Azure?

Logs are detailed records of events, activities, and errors generated by Azure resources and applications. Azure Monitor Logs stores and analyzes this information, typically using a Log Analytics workspace and KQL.

Key Points:

Azure Monitor provides centralized monitoring.
Log Analytics Workspace stores and organizes log data.
KQL is used to query and analyze logs.
Diagnostic Settings can route resource logs to destinations such as Log Analytics, Azure Storage, and Event Hubs.
Logs are useful for troubleshooting, auditing, and security investigations.
Log retention depends on the workspace, table configuration, and pricing plan.

Easy way to remember:

Metric: How much CPU is being used? → 90%

Log: Why did the application fail? → SQL connection timeout at 10:30 AM.

What is a Trace in Azure?

A Trace in Azure is a record that tracks the execution flow of a request or operation through an application, including the services and components involved.

Traces help developers understand how a request was processed, where time was spent, and where failures occurred.

Azure uses Application Insights, part of Azure Monitor, to collect and analyze distributed traces.

Simple Example

Suppose you have an ASP.NET Core Web API hosted in Azure App Service.

A user requests article details from your application.

          User Request
               |
               v
       ASP.NET Core Web API
               |
               v
        Article Controller
               |
               v
         Article Service
               |
               v
       Article Repository
               |
               v
        Azure SQL Database
               |
               v
          API Response

A distributed trace can show how long each operation takes.

Operation	Duration
HTTP Request	500 ms
Controller Processing	20 ms
Service Processing	30 ms
SQL Database Query	400 ms
Other Processing	50 ms

Illustrative timings; these operations may be nested within the overall request.

From this trace, you can identify that the SQL database query is consuming most of the request time.

How Azure Tracing Works

        Application Request
                 |
                 v
        Trace ID Generated
                 |
                 v
        Operations Tracked
                 |
                 v
        Application Insights
                 |
                 v
        Distributed Tracing
                 |
          +------+------+
          |             |
          v             v
     Performance      Errors
       Analysis       Analysis

Important Trace Concepts

Concept	Description
Trace	Represents the complete execution of a request across components
Trace ID	Unique identifier used to correlate operations belonging to the same trace
Span	Represents an individual operation within a trace
Parent Span	Represents the operation that initiated another span
Duration	Time taken to execute an operation
Distributed Tracing	Tracks requests across multiple services or applications

How to View Traces in Azure Portal

Open Azure Portal.
Navigate to Application Insights.
Select your Application Insights resource.
Open Transaction Search.
Select a request to view its details.
Open the End-to-end transaction details to examine related operations and dependencies.

You can also use Application Map to understand dependencies between services.

Example: KQL Query

Retrieve the latest 10 trace messages from Application Insights using workspace-based tables:

AppTraces
| order by TimeGenerated desc
| take 10

Note: AppTraces contains trace log messages. For distributed request tracing, use correlated telemetry such as AppRequests, AppDependencies, and AppTraces, or the end-to-end transaction view.

Azure Metrics vs Logs vs Traces

Feature	Metrics	Logs	Traces
Purpose	Measure performance	Record events	Track execution flow
Main Question	How much?	What happened?	Where and why?
Example	CPU usage 90%	SQL timeout error	Request delayed by SQL query
Data	Numerical	Event records	Correlated operations
Azure Tool	Metrics Explorer	Log Analytics	Application Insights
Primary Use	Monitoring	Troubleshooting	Performance analysis

Interview Quick Revision

Q: What is tracing in Azure?

Tracing tracks the execution flow of requests across application components and services. Azure Application Insights supports distributed tracing to identify performance bottlenecks, dependencies, and failures.

Key Points:

Application Insights supports distributed tracing.
A Trace ID correlates operations across services.
A Span represents an individual operation.
OpenTelemetry can be used to instrument .NET applications.
Distributed tracing is especially useful in microservices architectures.

Easy way to remember:

Metric: API response time is 5 seconds.
Log: SQL connection timeout occurred.
Trace: The API request spent 4.5 seconds waiting for the SQL database.

Together, Metrics, Logs, and Traces are known as the three pillars of observability.

What is a Change / Event in Azure?

A Change or Event in Azure is a record of an action, modification, or occurrence involving an Azure resource, application, or service.

It helps administrators understand what changed, when it changed, and what might have caused a problem.

1. What is a Change in Azure?

A Change represents a modification to an Azure resource or its configuration.

Examples:

A Virtual Machine was resized.
A Network Security Group (NSG) rule was modified.
An App Service configuration was updated.
A resource was created or deleted.
A deployment changed an application's configuration.

Simple Example:

10:00 AM - Application working normally
10:15 AM - NSG rule modified
10:20 AM - Application connection failed
10:25 AM - Administrator investigates changes
10:30 AM - Incorrect NSG rule identified

Azure Change Analysis capabilities and Azure Activity Logs can help investigate resource changes.

2. What is an Event in Azure?

An Event is an occurrence or activity that happens within an Azure resource or service.

Examples:

Event	Description
VM Started	Virtual Machine started
VM Deleted	Virtual Machine deleted
Resource Updated	Resource configuration changed
Blob Created	New file uploaded to Azure Blob Storage
User Sign-in	User signed in through Microsoft Entra ID
Deployment Failed	Azure resource deployment failed

Azure provides services such as Azure Event Grid to distribute supported events to subscribers.

3. How Changes and Events Work

         Azure Resources
                |
                v
       Changes / Events
                |
         +------+------+
         |             |
         v             v
     Activity       Event Grid
       Logs             |
         |              v
         v         Event Handlers
    Investigation       |
                        v
                  Azure Function

Important: Activity Logs record management operations, whereas Event Grid distributes supported events to event handlers. Not every event or configuration change is automatically captured by both services.

4. Change vs Event in Azure

Change	Event
Represents a modification	Represents an occurrence
Example: VM size changed	Example: VM started
Helps investigate configuration changes	Helps detect or respond to activities
Often investigated using Activity Logs	Can be processed using Event Grid
Useful for troubleshooting	Useful for automation and monitoring

5. Metrics vs Logs vs Traces vs Changes / Events

Type	Main Question	Example
Metric	How much?	CPU usage is 90%
Log	What happened?	Database connection failed
Trace	Where did the request slow down?	SQL query took 4 seconds
Change	What was modified?	Firewall rule changed
Event	What occurred?	Virtual Machine restarted

Interview Quick Revision

Q: What are Changes and Events in Azure?

Changes represent modifications to Azure resources or configurations, while events represent occurrences or activities within Azure services. They help administrators monitor operations, investigate incidents, and automate responses.

Key Points:

Azure Activity Logs record subscription-level management operations.
Change Analysis capabilities help investigate resource configuration changes.
Azure Event Grid supports event-driven architectures.
Azure Monitor Alerts can notify administrators when specified conditions occur.
Changes and events provide valuable context when troubleshooting application or infrastructure issues.

Real-Time Example

Suppose your Azure application suddenly becomes unavailable.

Metric: CPU usage increased to 95%.
Log: Application reported a connection timeout.
Trace: API request failed while accessing SQL Database.
Change: An NSG rule was modified 10 minutes earlier.
Event: Azure recorded the NSG update operation.

Conclusion: Metrics identify the performance issue, logs and traces help investigate the failure, and changes/events provide context about what may have triggered it.

Aggregation, Granularity, and Dimension in Azure Metrics

In Azure Monitor Metrics, Aggregation, Granularity, and Dimension help you understand how metric data is calculated, displayed, and filtered.

1. What is Aggregation?

Aggregation is the process of combining multiple metric values into a single summarized value over a selected time interval.

Azure Monitor supports common aggregation types:

Aggregation	Description
Average	Calculates the average metric value
Minimum (Min)	Shows the lowest value
Maximum (Max)	Shows the highest value
Sum (Total)	Adds all metric values
Count	Counts the number of measurements

Example:

Suppose an Azure VM reports these CPU usage values:

Time	CPU Usage
10:00 AM	20%
10:01 AM	40%
10:02 AM	60%
10:03 AM	80%
10:04 AM	100%

For this five-minute period:

Average: 60%
Minimum: 20%
Maximum: 100%
Sum: 300 percentage points (mathematically, but generally not meaningful for CPU utilization)
Count: 5 measurements

Important: Available and meaningful aggregation types depend on the metric. For CPU usage, Average and Maximum are usually more useful than Sum.

2. What is Granularity?

Granularity, also called Time Granularity, defines the time interval used to group metric data.

For example:

1 minute
5 minutes
15 minutes
1 hour
1 day

The available intervals depend on the metric and selected time range.

Example:

Suppose CPU usage is collected every minute.

CPU Usage:

10:00 → 20%
10:01 → 40%
10:02 → 60%
10:03 → 80%
10:04 → 100%

1-minute granularity — Average CPU

Each point represents a one-minute interval.

With 5-minute granularity and Average aggregation, Azure combines these five measurements into one value:

5-minute granularity — Average CPU

One data point represents the average of five measurements.

Key Difference:

Aggregation determines how values are calculated.
Granularity determines the time interval over which they are calculated.

3. What is a Dimension?

A Dimension is an additional property or attribute of a metric that allows you to filter or split metric data into different groups.

Example:

Suppose your Azure App Service receives HTTP requests with different response status codes.

HTTP Status Code	Request Count
200 (Success)	800
404 (Not Found)	150
500 (Server Error)	50
Total	1,000

Without using a dimension, you may see only the total number of requests: 1,000.

By applying the HTTP Status Code dimension (where supported), you can see the request counts separately.

Requests split by HTTP status code

Dimensions are particularly useful for identifying which part of an application or resource is experiencing problems.

Note: Not every Azure metric supports dimensions. Available dimensions depend on the resource type and metric.

4. Aggregation vs Granularity vs Dimension

Feature	Aggregation	Granularity	Dimension
Purpose	Summarize values	Group by time	Group by attribute
Main Question	How to calculate?	Over what interval?	Which category?
Example	Average	5 minutes	HTTP Status Code
Output	Average CPU 60%	One value per 5 minutes	Requests by status code

5. How to Configure in Azure Portal

Open Azure Portal.
Navigate to Azure Monitor → Metrics.
Select your Azure resource.
Choose a metric, such as Percentage CPU.
Select an Aggregation, such as Average or Maximum.
Select Time Granularity, such as 1 minute or 5 minutes.
Use Add filter or Apply splitting for supported metric dimensions.

Interview Quick Revision

Q1. What is Aggregation in Azure Metrics?

Aggregation combines metric measurements into a summarized value using calculations such as Average, Minimum, Maximum, Sum, or Count.

Q2. What is Granularity in Azure Metrics?

Granularity specifies the time interval used to group metric measurements, such as 1 minute, 5 minutes, or 1 hour.

Q3. What is Dimension in Azure Metrics?

A Dimension is a property used to filter or split metric data into categories, such as HTTP status codes, API names, or storage operations, depending on the metric.

Easy way to remember:

Aggregation: Calculate the average CPU usage.
Granularity: Calculate it every 5 minutes.
Dimension: Separate measurements by a supported attribute.

Combined Example: Show the Average number of HTTP requests every 5 minutes, grouped by HTTP Status Code.

Azure Metric - Log, Trace, Change and Event

What is a Metric in Azure?

Simple Example

How Azure Metrics Work

Types of Metrics in Azure

How to View Metrics in Azure Portal

Azure Metrics vs Logs

Interview Quick Revision

What is a Log in Azure?

Simple Example

How Azure Logs Work

Types of Logs in Azure

How to View Logs in Azure Portal

Example: KQL Query

Azure Metrics vs Logs

Interview Quick Revision

What is a Trace in Azure?

Simple Example

How Azure Tracing Works

Important Trace Concepts

How to View Traces in Azure Portal

Example: KQL Query

Azure Metrics vs Logs vs Traces

Interview Quick Revision

What is a Change / Event in Azure?

1. What is a Change in Azure?

2. What is an Event in Azure?

3. How Changes and Events Work

4. Change vs Event in Azure

5. Metrics vs Logs vs Traces vs Changes / Events

Interview Quick Revision

Real-Time Example

Aggregation, Granularity, and Dimension in Azure Metrics

1. What is Aggregation?

2. What is Granularity?

3. What is a Dimension?

4. Aggregation vs Granularity vs Dimension

5. How to Configure in Azure Portal

Interview Quick Revision

Keep Learning - More From This Category