Monitor

# Create workspace
az monitor log-analytics workspace create \
  --workspace-name myWorkspace \
  --resource-group myRG \
  --location eastus \
  --retention-time 90     # days (default 30, max 730)

# Show workspace ID
az monitor log-analytics workspace show \
  --workspace-name myWorkspace -g myRG \
  --query customerId -o tsv

# List workspaces
az monitor log-analytics workspace list -g myRG -o table

# Enable diagnostics for a resource (e.g. a storage account)
RESOURCE_ID=$(az storage account show --name mystorageacct -g myRG --query id -o tsv)
WORKSPACE_ID=$(az monitor log-analytics workspace show --workspace-name myWorkspace -g myRG --query id -o tsv)

az monitor diagnostic-settings create \
  --name myDiagSettings \
  --resource $RESOURCE_ID \
  --workspace $WORKSPACE_ID \
  --logs '[{"category":"StorageRead","enabled":true},{"category":"StorageWrite","enabled":true}]' \
  --metrics '[{"category":"Transaction","enabled":true}]'

# VM — enable via agent (Azure Monitor Agent)
az vm extension set \
  -g myRG --vm-name myVM \
  --name AzureMonitorLinuxAgent \
  --publisher Microsoft.Azure.Monitor \
  --version 1.0

# List diagnostic settings for a resource
az monitor diagnostic-settings list --resource $RESOURCE_ID

// Errors in the last hour
AppExceptions
| where TimeGenerated > ago(1h)
| summarize count() by outerMessage
| order by count_ desc

// Top slow HTTP requests
AppRequests
| where Success == false or DurationMs > 2000
| project TimeGenerated, Name, DurationMs, ResultCode
| order by DurationMs desc
| take 50

// VM CPU usage
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| render timechart

// Kubernetes pod restarts
KubePodInventory
| where PodStatus == "Running"
| summarize max(PodRestartCount) by Name, Namespace
| where max_PodRestartCount > 3

// Azure Activity Log — destructive operations
AzureActivity
| where OperationNameValue endswith "DELETE" and ActivityStatusValue == "Success"
| project TimeGenerated, Caller, ResourceGroup, ResourceId
| order by TimeGenerated desc

# Run a KQL query via CLI
az monitor log-analytics query \
  --workspace myWorkspace -g myRG \
  --analytics-query "Heartbeat | summarize count() by Computer | take 10" \
  -o table

# List metric definitions for a resource
az monitor metrics list-definitions \
  --resource $RESOURCE_ID -o table

# Get metric values
az monitor metrics list \
  --resource $RESOURCE_ID \
  --metric "Percentage CPU" \
  --interval PT5M \
  --start-time 2024-06-01T00:00:00Z \
  --end-time 2024-06-01T01:00:00Z \
  --aggregation Average \
  -o table

# Create a metric alert (CPU > 80% for 5 min)
az monitor metrics alert create \
  --name high-cpu-alert \
  --resource-group myRG \
  --scopes $(az vm show -g myRG -n myVM --query id -o tsv) \
  --condition "avg Percentage CPU > 80" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --severity 2 \
  --description "VM CPU over 80%" \
  --action $(az monitor action-group show -g myRG -n myActionGroup --query id -o tsv)

# Create a log alert (errors > 10 in 15 min)
az monitor scheduled-query create \
  --name error-alert \
  -g myRG \
  --scopes $(az monitor log-analytics workspace show -g myRG -n myWorkspace --query id -o tsv) \
  --condition "count > 10" \
  --condition-query "AppExceptions | where TimeGenerated > ago(15m)" \
  --evaluation-frequency PT5M \
  --window-size PT15M \
  --severity 1 \
  --action-groups $(az monitor action-group show -g myRG -n myActionGroup --query id -o tsv)

# List alerts
az monitor metrics alert list -g myRG -o table

# Enable / disable an alert
az monitor metrics alert update --name high-cpu-alert -g myRG --enabled false

# Create action group with email + webhook
az monitor action-group create \
  --name myActionGroup -g myRG \
  --short-name myAG \
  --action email alice alice@example.com \
  --action webhook myWebhook https://hooks.example.com/alert

# Add SMS
az monitor action-group update \
  --name myActionGroup -g myRG \
  --add-action sms bob 1 5555551234

# Test an action group
az monitor action-group test-notifications create \
  --name myActionGroup -g myRG \
  --alert-type servicehealth \
  --email-receiver name=alice emailAddress=alice@example.com useCommonAlertSchema=true

# Create Application Insights
az monitor app-insights component create \
  --app myApp -g myRG \
  --location eastus \
  --kind web \
  --workspace $(az monitor log-analytics workspace show -g myRG -n myWorkspace --query id -o tsv)

# Get instrumentation key (classic) / connection string (recommended)
az monitor app-insights component show \
  --app myApp -g myRG \
  --query connectionString -o tsv

# Query App Insights logs
az monitor app-insights query \
  --app myApp -g myRG \
  --analytics-query "requests | where success == false | summarize count() by name"

const { ApplicationInsights } = require('@microsoft/applicationinsights-web');
// or for Node.js:
const appInsights = require('applicationinsights');
appInsights.setup(process.env.APPLICATIONINSIGHTS_CONNECTION_STRING)
  .setAutoDependencyCorrelation(true)
  .setAutoCollectRequests(true)
  .setAutoCollectExceptions(true)
  .start();

# List workbooks in a group
az monitor workbook list -g myRG -o table

# Create from ARM template (workbooks are ARM resources)
az deployment group create \
  -g myRG \
  --template-file workbook-template.json