Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Vaardigheden in dit hoofdstuk
- Azure Monitor gebruiken: metrics, logs, KQL en alerts
Know metrics and logs
Metrics are light and fast (CPU %, requests per second). Logs are rich records you query (sign-ins, errors, syslog).
| Metrics | Logs | |
|---|---|---|
| Content | Numbers with a time stamp | Records with many fields |
| Kept by default | 93 days | In a Log Analytics workspace, as long as you set |
| Query with | Metrics explorer | KQL in Log Analytics |
| Good for | Charts, fast alerts | Investigation, correlation, reports |
az monitor metrics list --resource VM_ID --metric "Percentage CPU" --interval PT5M -o tableCollect logs in a workspace
Send logs to a Log Analytics workspace with diagnostic settings (platform resources) and the Azure Monitor Agent with data collection rules (VMs).
az monitor log-analytics workspace create -g rg-mon -n law-prod -l westeurope --retention-time 90
az monitor diagnostic-settings create -n to-law --resource KEYVAULT_ID --workspace law-prod -g rg-mon \
--logs '[{"categoryGroup":"allLogs","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]'
az vm extension set -g rg-web --vm-name vm-web1 --name AzureMonitorLinuxAgent --publisher Microsoft.Azure.MonitorThen create a data collection rule that says which syslog facilities and performance counters to collect from which VMs.
Query logs with KQL
KQL (Kusto Query Language) starts with a table and passes the rows through | steps — like a Linux pipe.
// VMs that did not send a heartbeat in the last 10 minutes
Heartbeat
| summarize LastSeen = max(TimeGenerated) by Computer
| where LastSeen < ago(10m)
// CPU over 80 % in the last hour
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and TimeGenerated > ago(1h)
| summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| where AvgCPU > 80
// Failed SSH logins from syslog
Syslog
| where Facility == "authpriv" and SyslogMessage has "Failed password"
| summarize Tries = count() by HostName, bin(TimeGenerated, 1h)
| order by Tries desc| Operator | Does |
|---|---|
where | Filter rows |
project | Choose columns |
summarize … by … | Count, sum, average per group |
extend | Add a computed column |
order by / top N by | Sort / keep the first N |
ago(1h), bin(TimeGenerated, 5m) | Time helpers |
render timechart | Draw a chart |
Create alerts and action groups
An alert rule watches a signal (metric, log query, activity log). When it fires, an action group notifies people (email, SMS, app) or starts automation (webhook, Logic App, function).
az monitor action-group create -g rg-mon -n ag-ops --short-name ops --action email ops it-ops@example.com
az monitor metrics alert create -g rg-mon -n cpu-high --scopes VM_ID \
--condition "avg Percentage CPU > 85" --window-size 5m --evaluation-frequency 1m --action ag-ops --severity 2
az monitor activity-log alert create -g rg-mon -n rg-deleted --scope /subscriptions/SUB_ID \
--condition category=Administrative and operationName=Microsoft.Resources/subscriptions/resourceGroups/delete --action-group ag-ops| Alert type | Watches |
|---|---|
| Metric alert | A metric over a threshold (fast) |
| Log search alert | The result of a KQL query |
| Activity log alert | Control-plane events (create, delete, service health) |
Op het werk
Alert processing rules silence alerts during planned maintenance, so nobody is woken up for a planned reboot.
Use insights and workbooks
Ready-made views for common resources.
- VM insights: performance and a map of processes and connections.
- Storage / Key Vault / Network insights: health and use.
- Workbooks: your own interactive reports from metrics and KQL.
- Activity log: who did what on the control plane (create, delete, change) — kept 90 days.
- Service Health: Azure outages and planned maintenance in your regions.