Azure Monitor collects and analyzes metrics, logs, traces, events, and changes across Azure and applications. Log Analytics workspaces query log tables with KQL. Application Insights provides application performance monitoring, commonly through OpenTelemetry. Good observability begins with user objectives and actionable alerts—not with sending every possible log forever.
Correlate signals with resource IDs, environment, service, region, version, tenant pseudonym, operation ID, and trace ID.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Open the resource → Diagnostic settings → Add diagnostic setting. Choose only required log/metric categories and an approved Log Analytics, Storage, or Event Hubs destination. Categories differ by resource. Save, generate a test event, and query the destination after ingestion delay.
Apply settings at scale with Policy deployIfNotExists, but monitor remediation and workspace cost.
Example application errors by operation:
Table names vary by workspace mode and instrumentation. Use the schema browser and write queries against stable structured fields, not message parsing alone.
Instrument server requests, dependencies, background jobs, model/search calls, and business outcomes with OpenTelemetry. Export to Application Insights/Azure Monitor using supported distributions. Propagate W3C trace context through queues and events. Add attributes carefully; high-cardinality or personal fields can increase cost and privacy risk.
For AI systems, record prompt/model version, deployment, token counts, retrieval/result IDs, tool names/status, safety decision, and latency—not full protected prompts by default.
A service-level indicator measures a user-relevant outcome. A service-level objective sets the target over a window. Example: 99.9% of authorized Northstar answer requests succeed in 30 days with p95 latency below the product target. An error budget is the allowed unreliability.
Alert on burn rate: how quickly the service consumes the error budget. Page on urgent user impact; create tickets for slower degradation. Avoid paging for every CPU spike.
An alert rule evaluates a metric, log query, activity event, or smart condition. An action group sends email/SMS/push, calls a webhook, ITSM, Function, or Logic App. Make routing redundant, test it, and avoid putting secrets in webhook URLs.
Every alert needs owner, severity, user impact, runbook, suppression/grouping, and test. If no action exists, it is a dashboard signal—not a page.
Deploy workspaces, Application Insights, diagnostic settings, data collection rules/endpoints, action groups, alert rules, workbooks, and role assignments in Bicep/Terraform. Version dashboards and queries. Do not make manual portal dashboards the sole operational knowledge.