For a clearer picture

Month: September 2018

Part 4 – Metrics

Part 4 – Metrics

Key information
  • Metrics are collected at one-minute frequency unless specified otherwise in the metric’s definition.
  • Stored for 90 days. You can copy metrics to Log Analytics for long term trending but that will incur storage costs.

There are standard metrics for almost every resource and you don’t have to do anything to enable them. Deploy your resource, sit back and wait for those metrics to start being collected.

There are a list of available metrics by resource and I’ve linked to the those for virtual machines here.

You can set the time period to display, the metric(s) and the resources. So with a few clicks of the mouse you can pin metrics tile to a dashboard to provide rich visualisations.

And as you can see from the above screenshot, you can also export the data to excel which would allow to build additional visualisations through Power View, Power BI or your other favourite visualisation \ analytical tool e.g. Tableau.

Rather than me go through each and every resource show casing the metrics available, I’d suggest taking a look through the above URL for the resource you are interested in and checking out the available “free” metrics.

Part 3 – Azure Activity Logs

Part 3 – Azure Activity Logs

Key Information

Activity Log data is retained for 90 days. You can export this e.g. to Azure Storage but that will start incurring charges which breaks our “free” criteria.

Azure Activity Logs action operations (PUT, POST, DELETE) as listed here.

So if I want to find out who deleted one of my Azure Application Insight web tests, I filtered on the resource group in the last month with delete as part of the operation.

I can download this data to csv free of charge but the two other options listed – Export to Event Hub and Logs (Log Analytics) – will incur charges so we will park those for a later article.

If you select an entry then in the bottom half of the portal you will be able to see more detailed summary details plus take an extract of the audit in json format which will give you more details about the activity e.g. the IP address from where the delete took place:

"authorization": {
"action": "microsoft.insights/webtests/delete",
"scope": "/subscriptions/**Sub ID**/ai-scomgsm-prod-rg/providers/microsoft.insights/webtests/MyWebTest"
"caller": "",
"channels": "Operation",
"claims": {
"aud": "",
"iss": "** Tenant Id **/",
"iat": "**",
"nbf": "**",
"exp": "**",
"": "1",
"aio": "**",
"": "pwd",
"appid": "**",
"appidacr": "2",
"e_exp": "262800",
"groups": "**",
"ipaddr": "** IP Address **",
"name": "** User **",
"": "** Tenant Id **",
"": "** User **",
"": "** User **",
"uti": "JZLmyAWzPkqofdcUdSYCAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10"
"correlationId": "24f963b3-701e-4e71-80ae-6123bc0aba8b",
"description": "",
"eventDataId": "fb1f9e5f-39ca-4db4-9410-1d0a247d86d7",
"eventName": {
"value": "EndRequest",
"localizedValue": "End request"
"category": {
"value": "Administrative",
"localizedValue": "Administrative"
"eventTimestamp": "2018-09-19T19:57:51.6021772Z",
"id": "/subscriptions/**Sub ID**/resourcegroups/ai-scomgsm-prod-rg/providers/microsoft.insights/webtests/MyWebTest/events/fb1f9e5f-39ca-4db4-9410-1d0a247d86d7/ticks/636729838716021772",
"level": "Informational",
"operationId": "3b93f5a5-feb5-4b6d-b16b-5dbef60e4e51",
"operationName": {
"value": "microsoft.insights/webtests/delete",
"localizedValue": "Delete web test"
"resourceGroupName": "ai-scomgsm-prod-rg",
"resourceProviderName": {
"value": "microsoft.insights",
"localizedValue": "Microsoft Insights"
"resourceType": {
"value": "microsoft.insights/webtests",
"localizedValue": "microsoft.insights/webtests"
"resourceId": "/subscriptions/**Sub ID**/resourcegroups/ai-scomgsm-prod-rg/providers/microsoft.insights/webtests/MyWebTest",
"status": {
"value": "Succeeded",
"localizedValue": "Succeeded"
"subStatus": {
"value": "",
"localizedValue": ""
"submissionTimestamp": "2018-09-19T19:58:19.1075243Z",
"subscriptionId": "**Sub ID**",
"properties": {
"statusCode": "OK",
"serviceRequestId": "29756e97-65ce-436f-b2ec-3f83d31a600a"
"relatedEvents": []

In the middle of the json; you’ll see category: administrative. There are a variety of different categories available which are discussed in detail here.

There is also another in depth knowledge article here – – so I’m not going to go into any more detail at this stage. These are very thorough articles which delve deep into what you can do with the Activity Log data that is available.

Part 2 – Azure Service Health

Part 2 – Azure Service Health

Key information
  • History is retained for 90 days at no additional cost.

Azure Service Health gives the following information:

  • Service issues – Problems in the Azure services that affect you right now.
  • Planned maintenance – Upcoming maintenance that can affect the availability of your services in the future.
  • Health advisories – Changes in Azure services that require your attention. Examples include when Azure features are deprecated or if you exceed a usage quota.
Service Issues

In the screenshot below you can see that Azure Application Insights has an issue with additional details on possible impact and the ability to track using a CR bar code straight to the Azure App on my iPhone.

I can also print out more information about the issue to pdf and there is a link that I can share with appropriate support teams and insert into my incident management solution.

Planned Maintenance

Upcoming maintenance that will impact your Azure resources.

Health Advisories

Upcoming changes to Azure which will impact your Azure deployments such as a service been deprecated. Usage quotas being breached will also show here.

Health History

And here we can see the history which goes back 3 months.

Resource Health

Resource Health allows you to select resources to view their current health state – here my IOT hub is healthy. Possible options are:

  • Healthy (with any events of the last 24 hours available to view)
  • Unavailable
    • Platform events triggered by Azure infrastructure
    • Non-Platform events triggered by end users e.g. shutting down a virtual machine.
  • Degraded if there are performance issues but the resource is available

Health Alerts

These are off limits for my mini-series as they will incur charges. But I’ll cover alerting in a future article and it obviously makes sense to make use of this functionality.

Part 1 – Azure Monitoring for free

Part 1 – Azure Monitoring for free

Yes; free. No gimmicks. No dodgy sales calls. No cracked license keys. Totally free Azure monitoring from Microsoft themselves.

OK. Let us start off by agreeing what we mean by free. When you buy a car you expect to get the wheels, the steering wheel and the brakes as well as many other components as part of the overall cost of the car. Imagine going to drive away from the forecourt just as the dealer takes the wheels off and tells you they cost extra. That wouldn’t be cricket. And it wouldn’t be much of a car either.

Same idea with Azure. When you “buy” a resource; you get some monitoring functionality as part of the cost of the resource. That is what I mean by free. Although the grammar guardians mightwell prefer me to say “at no additional cost” it doesn’t sound so catchy as a title.

At Ignite 2018 Microsoft announced a re-imagining of the Azure Portal and they did a great job of it. What had become a slightly confusing collection of monitoring options suddenly had a much more intuitive layout.

But what might not be entirely clear from the portal is what is free and what you really do need to pay for.

That is where this series of articles comes in. To ensure that you don’t accidentally enable functionality that incur costs that neither you, nor your bosses, expect.

Hopefully it is good news that as soon as you start using Azure, Azure Monitor starts recording what activities are taking place against the resource and providing a base level of performance metrics for that resource. Note – this is the Cloud. Everything is subject to change at very little notice and, when it involves increasing prices, in incredibly small print on obscure pages. This series is correct of October 5th, 2018. Please let me know if you spot something is out of date and I’ll amend it. Thanks.

So we’ll be looking at:

  • Service Health – which highlights problems with Azure Services that impact you now
  • Activity Logs – which record when resources are created or modified
  • Metrics – which tell you how the resource is performing and the resources that it’s consuming.
  • Lessons Learned.