Crisp answer: Azure Monitor is the umbrella platform for all Azure observability. It collects metrics and logs from Azure resources. Log Analytics is the log store and query engine. Application Insights is the application performance monitoring layer built on top.
The data types:
Metrics: Numerical time-series data. Collected automatically from Azure
resources (CPU%, disk IOPS, request count). Stored for 93 days.
Fast — near-real-time, queryable in metrics explorer.
Logs: Structured or unstructured text events sent to a Log Analytics
workspace. Retained for 30-730 days (configurable). Queried
with KQL (Kusto Query Language).
Traces: Distributed request traces from Application Insights.
End-to-end view of a request across multiple services.
Log Analytics workspace:
Central store for all log data. Resources send diagnostic logs here.
Multiple workspaces per tenant (separate by environment: prod/dev).
Diagnostic settings: configure which logs and metrics each resource
sends to which workspace.
Common log tables:
AzureActivity — Azure Resource Manager operations (who changed what)
SecurityEvent — Windows security logs (logins, policy changes)
Syslog — Linux system logs
ContainerLog — AKS container stdout/stderr
KubeEvents — Kubernetes events
InsightsMetrics — VM performance metrics from Azure Monitor Agent
AzureDiagnostics — NSG flow logs, SQL audit logs, Key Vault logs
KQL — the query language:
// Find all failed login attempts in the last hour
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4625
| summarize count() by Account, Computer
// Top 10 VMs by CPU usage
InsightsMetrics
| where TimeGenerated > ago(1h)
| where Namespace == "Processor" and Name == "UtilizationPercentage"
| summarize avg(Val) by Computer
| top 10 by avg_Val desc
// AKS pod restarts in the last 24h
KubeEvents
| where TimeGenerated > ago(24h)
| where Reason == "BackOff"
| summarize count() by Name, Namespace
| sort by count_ desc
// Alert on errors in application logs
AppTraces
| where TimeGenerated > ago(5m)
| where SeverityLevel == 3 // Error
| summarize count() by cloud_RoleName
Alerts:
Metric alert: fires when a metric crosses a threshold
(CPU > 90% for 5 minutes)
Log alert: fires when a KQL query returns results
(any 401 errors in last 5 minutes)
Activity log alert: fires on Azure Resource Manager events
(someone deletes a resource group)
Action groups: what happens when alert fires
- Email/SMS notification
- Webhook (PagerDuty, Slack)
- Azure Function (auto-remediation)
- ITSM connector (ServiceNow ticket)
Application Insights:
APM (Application Performance Monitoring) for web applications.
SDK installed in the application or auto-instrumented (Java, .NET, Node).
Key features:
- Request rate, failure rate, response time
- Dependency tracking (SQL queries, external HTTP calls)
- Exception tracking with stack traces
- User flow analysis
- Availability tests (ping from multiple regions every 5 minutes)
- Live Metrics: real-time streaming of requests and failures
What to say in the interview:
"I use Azure Monitor as the central observability platform with all resources sending diagnostic logs to a central Log Analytics workspace per environment. For day-to-day ops I write KQL queries for things like failed authentication events, container restarts in AKS, and resource changes via AzureActivity. For alerting I combine metric alerts for infrastructure thresholds with log alerts for application errors, all routing to an action group that posts to our Slack channel. Application Insights sits on top for any web workloads, giving us end-to-end request tracing. At RHS I centralised observability by migrating from ad-hoc monitoring to a single Log Analytics workspace, which meant the security team could also run their queries from the same data source."