Skip to content
5.1AZ-104Intermediate
Est: ~15 mins•Reviewed: 2026-08

Azure Monitor: Log Analytics & KQL Queries

Collect diagnostics, query telemetry with Kusto Query Language (KQL), configure alert rules, and build Azure Monitor workbooks for enterprise observability.

Tags:#Azure Monitor#Log Analytics#KQL#Alerts#Observability#AZ-104
01

Overview

Azure Monitor is Microsoft's centralized platform for collecting, analyzing, and acting on telemetry across cloud and hybrid environments.

It operates across two core data pillars:

  1. Metrics: Lightweight numerical values describing resource attributes at specific timestamps (e.g., VM CPU Percentage, Network Out, Disk IOPS). Stored for 93 days; queried near real-time.
  2. Logs: Structured records organized into tables (e.g., AzureActivity, Heartbeat, Event, Syslog) stored in a Log Analytics Workspace.
  3. Kusto Query Language (KQL): High-performance read-only query language used to search, filter, aggregate, and visualize millions of log records in seconds.
  4. Action Groups & Alerts: Automatically notify on-call engineers via SMS, email, Azure App push, or trigger automated runbooks/logic apps.

---

02

When to Use: Metrics vs Logs

Telemetry TypeLatencyStorage MechanismBest Used For
Azure Monitor Metrics< 1 minuteTime-series databaseRapid auto-scaling triggers, real-time alert rules.
Log Analytics (Logs)1–5 minutesClustered table storageSecurity auditing, historical troubleshooting, root cause analysis via KQL.
Azure Activity LogNear real-timeSubscription-level event logAudits Who did What, When, and from where at the control plane.

---

03

Prerequisites

  • Log Analytics workspace deployed.
  • Monitoring Contributor or Log Analytics Reader role.

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Log Analytics workspaces
│   └── [Target Workspace] > Logs (Interactive KQL query editor)
└── Monitor
    ├── Alerts (Create alert rules, configure Action Groups)
    └── Workbooks (Interactive reporting dashboards)

---

05

Step-by-Step Implementation

Step 1: Essential KQL Queries in Log Analytics

Open your Log Analytics Workspace &gt; Logs and run the following queries:

#### 1. Find Failed VM Heartbeats (Offline Machines):

KUSTO
Heartbeat
| summarize LastCall = max(TimeGenerated) by Computer
| where LastCall < ago(15m)
| project Computer, LastCall

#### 2. Query High CPU Virtual Machines:

KUSTO
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 15m)
| where AvgCPU > 85
| order by TimeGenerated desc

#### 3. Audit Who Deleted an Azure Resource (Activity Log):

KUSTO
AzureActivity
| where OperationNameValue endswith "/delete"
| where ActivityStatusValue == "Success"
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, Resource

Step 2: Create a Metric Alert with Action Group

  1. In Monitor, select Alerts &gt; Click Create &gt; Alert rule.
  2. Scope: Select target Virtual Machine.
  3. Condition:
  • Signal name: Percentage CPU.
  • Threshold: Static | Operator: Greater than | Threshold value: 90%.
  • Check every: 1 minute | Lookback period: 5 minutes.
  1. Actions: Create Action Group &gt; Add email notification (it-oncall@contoso.com).
  2. Severity: Sev 1 (Error). Name: Alert-VM-HighCPU.

---

06

PowerShell Automation

Query Log Analytics Workspace via Azure PowerShell:

PowerShell
# Run a KQL query directly from PowerShell
$WorkspaceId = "workspace-guid-here"
$Query = "Heartbeat | summarize count() by OSType"

Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceId -Query $Query | 
    Select-Object -ExpandProperty Results

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/4 (0%)
Azure VM agent / Azure Monitor Agent (AMA) reports heartbeat to workspace.
KQL queries return expected telemetry without syntax errors.
Alert rule status is Enabled.
Artificially spiking CPU triggers notification email to Action Group within 5 minutes.

---

08

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
No logs appearing in workspaceAzure Monitor Agent (AMA) missing or Data Collection Rule (DCR) not associated.Verify the Data Collection Rule is targeted to the virtual machine.
Alert firing repeatedlyAlert frequency too short without auto-mitigation enabled.Enable Automatically resolve alerts and set lookback aggregation window.

---

09

AZ-104 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. KQL Syntax: Memorize the pipe operator (|). Query flows from left to right: Table | filter | summarize | project.
  2. Activity Log Retention: The Azure Activity Log is retained for 90 days by default for free. To retain longer, export to a Log Analytics workspace or Storage Account.
  3. Action Groups: Action Groups can execute Webhooks, Azure Functions, Logic Apps, Automation Runbooks, and trigger ITSM tickets in addition to SMS/Email.

---

10

Official Documentation