Watching Azure: Azure Advisor, Azure Service Health and Azure Monitor

Why this matters

When an application in Azure goes wrong, the first question is always "is it us or is it Microsoft?". If the team cannot answer quickly, it spends an hour restarting its own servers while a regional outage is the real cause, or it waits for Microsoft to fix something that is actually a bug in its own code. Azure gives three monitoring tools, and each answers a different question: what could we improve, is Azure itself healthy, and what are our own resources and applications doing right now.

A manager needs to know which tool gives the single figure for "how well are we following best practice" and which one sends the outage email. A salesperson will be asked how a customer finds out about Azure problems before their own users do. A junior administrator is the person who has to set up the alert that wakes the on-call engineer, and who needs to know where to look when someone asks who deleted a storage account. This lesson keeps the three tools apart.

The lesson

Azure Advisor: recommendations for your own setup

Azure Advisor looks at the configuration and usage of the resources you have deployed and gives personalised recommendations to improve them. It is a consultant that reads your subscription: it does not change anything itself, and it does not watch live metrics or page anyone.

Advisor sorts its recommendations into five categories:

Two details are often tested. The security recommendations in Advisor come from Microsoft Defender for Cloud (lesson 11), which assesses resources against security best practice; Advisor simply shows them alongside the rest. And regulatory compliance, encryption and data classification are not Advisor categories: compliance dashboards come from Azure Policy and Defender for Cloud, and classification is Microsoft Purview (lesson 13).

Other Advisor features:

• Advisor score. A percentage that sums up how closely your resources follow Advisor's recommendations, overall and per category. A manager who wants one figure for best-practice health, and wants to track it over time, looks here.
• Postpone or dismiss. If a recommendation does not fit, such as a reliability suggestion for a throwaway test environment, the team can postpone it for a period or dismiss it.
• Alerts and digests. Advisor can notify you of new recommendations and send periodic digest summaries.
• Cost. Advisor is included with Azure at no extra charge and covers the subscriptions you can access. It needs no paid support plan. Acting on a recommendation, such as adding a zone-redundant instance, may change your bill.

Azure Service Health: the health of Azure itself

Azure Service Health tells you about problems and planned work on Microsoft's side of the platform. Microsoft describes it as three related experiences:

• Azure status: a public page showing broad service health across every Azure region. It needs no sign-in, so a consultant can check for a widespread outage without access to any subscription. It is global and not tailored to you.
• Service Health: a personalised view of events affecting the services and regions your subscriptions use. It requires signing in. During an incident this is more useful than the status page because it filters out everything that does not touch you.
• Resource Health: the current and past health of individual resources, such as one virtual machine. If a single VM became unavailable overnight, Resource Health can show whether an Azure platform problem was the cause.

Service Health reports four kinds of event: service issues (outages happening now), planned maintenance, health advisories and security advisories. It keeps a history, and after a significant outage Microsoft publishes a post-incident review explaining the cause and what it is doing to prevent a repeat.

You can create Service Health alerts, so that a support team is emailed or texted automatically when Azure posts an outage or maintenance event for the regions the company uses. Technically these are activity log alerts that fire on Service Health events, and they use action groups (described below) to send the notifications. This is how an administrator can hear about a regional networking problem before users notice anything.

Service Health does not report cost recommendations (that is Advisor) or your application's page load times (that is Application Insights). Only Microsoft publishes or resolves events in Service Health and on the status page.

Azure Monitor: Log Analytics, alerts and Application Insights

Azure Monitor is the platform for collecting, analysing and acting on telemetry. It gathers metrics and logs from Azure resources, and also from on-premises machines and other clouds. Non-Azure servers send data through an agent such as the Azure Monitor Agent, often after being connected with Azure Arc (lesson 14). Nothing needs migrating into Azure first.

Metrics and logs are the two kinds of data, and the exam likes to swap them:

• Metrics are numeric values sampled at regular intervals, a time series such as CPU percentage or requests per second. They suit near real-time charts and fast alerts. Metrics explorer charts them, for example a virtual machine's CPU over the last 24 hours.
• Logs are records of events and traces, each with its own set of properties. They suit investigation and correlation across many sources. They are stored in a Log Analytics workspace.

One log source deserves a name: the activity log. It records subscription-level management operations: who created, changed or deleted a resource, and when. An auditor asking who deleted a storage account last week finds the answer here, not in metrics.

Log Analytics is the tool in the Azure portal for writing and running queries against the log data in a Log Analytics workspace. Queries use Kusto Query Language (KQL). Because logs from virtual machines, Azure resources and Application Insights can all land in one workspace, an analyst can search and correlate them together. Log Analytics is part of Azure Monitor, not a replacement for it. Running a query by hand does not notify anyone, which is where alerts come in.

Azure Monitor alerts watch monitoring data and tell you proactively when a condition is met, such as low disk space, so nobody has to stare at dashboards. An alert rule defines what to watch and the condition that triggers it. The main types:

• Metric alerts watch a numeric metric against a threshold: average CPU on a production VM above 90 percent.
• Log search alerts run a Log Analytics query on a schedule and fire when the results meet a condition: more than ten failed operations in five minutes.
• Activity log alerts fire on a management event: anyone deleting a virtual machine in the production subscription. Service Health alerts are a kind of activity log alert.

An action group is the reusable list of who is told and what runs when an alert fires. It can send email, SMS, voice calls or push notifications, and it can trigger automation such as a webhook, a Logic App, an Azure Function or a runbook. The condition belongs to the alert rule; the response belongs to the action group. An action group cannot post to the Azure status page or change an Advisor score.

Application Insights is the application performance monitoring feature of Azure Monitor. It collects telemetry from a running application:

• request rates and server response times;
• failure rates and exceptions;
• calls to dependencies such as databases and external services, and their failures.

Useful features include availability tests, which send requests to a public website from several locations around the world every few minutes and alert if it stops responding, and Application Map, a diagram of an application's components and the calls between them with performance and failure figures on each link.

An application starts sending telemetry once it is instrumented: through an SDK, the Azure Monitor OpenTelemetry Distro or automatic agent-based instrumentation, pointed at the Application Insights resource by a connection string. Apps hosted anywhere can be monitored, including on-premises and in other clouds, and several languages are supported, among them .NET, Java, Node.js and Python. Application Insights is not limited to Azure App Service, and it works inside Azure Monitor rather than replacing it.

What the exam is really asking

• Advisor vs Service Health. Advisor recommends changes to your setup. Service Health reports Azure's issues and maintenance. A question about an outage or maintenance notice is Service Health; a question about cutting cost or adding resilience is Advisor.
• Advisor vs Azure Policy. Advisor suggests; Policy enforces. Advisor never blocks anything.
• Advisor's five categories. Reliability, security, performance, cost, operational excellence. Low CPU for weeks means cost; adding a zone means reliability; relieving throttling means performance.
• Status page vs Service Health vs Resource Health. Public and global; personalised to your services and regions; one resource.
• Service Health vs Application Insights. One sees Microsoft's platform; the other sees your own code and dependencies.
• Metrics vs logs. Numeric time series vs event records. Metrics explorer charts metrics; Log Analytics queries logs with KQL.
• Activity log. Who did what to which resource, and when.
• Alert rule vs action group. The rule holds the condition; the action group says who is told and what runs.
• Reach. Azure Monitor and Application Insights both work beyond Azure.