Monitor and maintain Azure resources
Metrics, logs, and the activity log differ
Platform metrics are numeric, near real time, and retained for 93 days; you can alert on them but cannot query them with KQL. Resource logs flow to a Log Analytics workspace and are queried with KQL; interactive retention defaults to 30 days and can extend to 730, with long-term archival to a storage account. The activity log records control-plane events such as who created, changed, or deleted a resource, and keeps 90 days on its own; route it with a diagnostic setting to keep it longer or alert on it.
Diagnostic settings and agents
A diagnostic setting sends a resource's logs and metrics to one or more destinations: Log Analytics workspace, storage account, Event Hubs, or a partner solution. The Azure Monitor Agent, configured through data collection rules, replaces the legacy Log Analytics agent. Application Insights adds request, dependency, and exception telemetry for applications.
Alerting
An alert rule combines a signal (metric, log query, or activity log), a condition, a severity from 0 to 4, and an action group that delivers email, SMS, voice, push, webhook, Logic App, runbook, or ITSM actions. Alert processing rules suppress notifications during maintenance windows. Service Health alerts cover platform incidents, Resource Health covers a specific resource, and Advisor offers recommendations.
Backup and network diagnostics
Azure Backup uses a Recovery Services vault, backup policies, and soft delete. Network Watcher provides IP flow verify, next hop, connection troubleshoot, and packet capture.
Worked rule of thumb
Use metric alerts for simple numeric thresholds evaluated quickly and cheaply, and log alerts for multi-condition or stateful checks. If a question asks how to prove a VM cannot reach a database endpoint, the answer is usually Network Watcher IP flow verify or connection troubleshoot.