In this lesson, I want to think about, well, what do we care about?
Yes,
every type of Azure resource and service within that
resource might have different metrics, different logs available,
but the actual importance of them will vary by the type of resource,
by the application.
If, for example, I just have a virtual machine,
if I have an application that's more skewed towards memory‑centric,
I might care more about, well, is the memory hitting some bottleneck?
So it's not even just based on the resource, it's how I'm using the resource.
So it's therefore critical to identify what are the key
indicators we care about for the performance and even
failure prediction for our resource.
Now, this is going to vary depending on every type of workload.
I would recommend you research your particular workload for
recommendations on what you should care about.
But what I would say,
and I always say this, is start with Azure Monitor Insights.
It's a curated set of information by the people
that create that type of resource.
It's going to give me the best place to start for what I typically
care about. And then if I'm creating alerts off of Log Analytics,
we'll go and look at the alerts topic again.
This is going to give me a great set of starting information. Here I'm in
Azure Monitor, and we'll see we have the Insights section.
We even have an Insights Hub for the different types of service we have.
And I could start with, sure, Virtual Machines.
Here I can go and dive into a particular virtual machine, and
it's going to give me information about,
well,
overall health, what it considers based on the metrics it's
looking at, and for all of these things,
I could actually go and trigger different types of alerting.
So from here,
I can actually say yes, I'm going to enable alert on this and it would tell
me. I can look at what it considers are the important performance counters
within this. And for all of these, notice,
there's alerts,
and from here I can actually dive in and see any alerts
fired for this particular resource.
I could also go ahead and look at particular workbooks. If
we go back over to this resource, let's close that down for
a second, if we View Workbooks, I could look at,
well,
workbooks for performance. And then from the workbook, if I actually hit Edit
because I can clone my own, I can really do anything I want with this, when I
do the Edit command, I can now look at, well,
how is it doing these things?
I could actually say well let's edit this, and over here I can see
the Log Analytics query is actually running.
I could now take this,
run it in Log Analytics, and create an alert rule directly off of this.
Likewise, if we jump back over, well, maybe I care about Containers, i.e.
Kubernetes. One of the great things insights for Kubernetes does, if I
actually look at the monitored cluster, yes, once again,
it shows me the key pieces of information I should probably care about,
but it even has recommended alerts.
And from here, I could just go and turn these things on,
and it will actually go and create the alert rule for me.
I can configure the action group I want if I'm doing it directly via
alert rules or, remember, we can use action rules to trigger alerts
based on the actual alert events generated.
So this makes it even easier for me to know, well,
what should I likely care about. If I look at
Application Insights, once again, well,
what are the key things it thinks I should really care about?
Also, I have the great App Dashboard that I can think about, well,
these are all the types of information available to me. Once
again, I can dive in and look all of these, I can look at various
workbooks associated with App Insights,
work out what it's doing, and I can trigger alerts off of
that. Now another great thing I can think about with App
Insights is it has Smart Detection, so it will actually think about, well,
based on what I'm seeing in machine learning, here are some
things related to performance, related to failures that I
think you should actually be aware of.
So in terms of what I care about,
it's going to vary by service, but I definitely recommend hey,
start with insights and really work from there.
And, of course, don't forget about Log Analytics directly. Now,
absolutely,
I could just go and look at all the different types of
queries that exist, I can base it on, for example,
resource type,
different categories, but I really think the topic is super useful. Here
it's a curated set of queries that it thinks are most applicable to
alerting, different types of app logs by severity,
app services, audit logs relating to a delete operations that's going to go
and hook into what comes from things like the activity log.
All these different types of information I might care about that
is very common for me to want to alert off of.
So I go and look at these, even chart CPU usage trends, and,
again, I can run it or load it to the editor. I can hit Run to see, well,
what's it actually going to generate, and then I can create those alert rules
directly off of that data based on the values that I decide I want to use.
Again, it can be based on the number of results,
or it could be based on some kind of metric
measurement, based on a number of breaches,
etc. So I have all of those capabilities available to me.