1. Overview:

  • Can also collect logs on premise

2. Activity log:

3. Alert:

  • Log alert vs metric alert
  • Can have post processing
  • RESOURCE
    • The target resource for the alert rule. You can assign multiple target resources to a single alert rule. The type of resource defines the available signal types.
  • CONDITION
    • The signal type used to assess the rule. The signal type can be a metric, an activity log, or logs. There are others, but this module doesn’t cover them.
    • The alert logic applied to the data that’s supplied via the signal type. The structure of the alert logic changes depending on the signal type.
  • ACTIONS
    • The action, like sending an email, sending an SMS message, or using a webhook.
    • An action group, which typically contains a unique set of recipients for the action.
  • ALERT DETAILS
    • An alert name and an alert description that specify the alert’s purpose.
    • The severity of the alert if the criteria or logic test evaluates true. The five severity levels are:
      • 0: Critical
      • 1: Error
      • 2: Warning
      • 3: Informational
      • 4: Verbose

4. Metrics:

5. Logs:

  • Kusto Query Language
    • can render visualization
  • Log Analytics in Azure Monitor offers query features and tools that help you answer virtually any question about your monitored configuration.
    • seperate by table
  • Log Analytics supports the Kusto Query Language (KQL). You can create simple or complex queries with KQL
  • Your Log Analytics workspace is the basic management environment for Azure Monitor Logs.
  • Each workspace has a unique workspace ID and resource ID. After you create your workspace, you configure your data sources and solutions to store their data in your workspace.

1. Applications:

2. Virtual Machine:

3. Storage account: