A virtual machine can slow down long before anyone reports a problem. Azure Monitor gives you a central place to collect and act on telemetry from Azure resources and on-premises environments. Metrics show what is changing; logs help explain why; application traces help locate bottlenecks. Charts, queries, and alerts turn those signals into something an operations team can use. section 3.6
For a VM, start with the signals most likely to reveal trouble:
- CPU utilization can reveal a sustained overload; disk activity can expose an I/O bottleneck or an unexpected process. section 3.6.1
- Network traffic can flag connectivity trouble or an unusual rise in outgoing data. Memory usage can help reveal pressure or a gradual leak, if the diagnostics extension is in use. section 3.6.1
- Metrics appear in Azure Portal charts and dashboards and remain available over time, so you can compare a dip with a deployment or traffic spike. VM Insights combines performance data, events, and recommendations in a tailored view. section 3.6.1
When a chart shows a problem but not its cause, use Log Analytics. VM diagnostic data can include performance counters, operating-system events, heartbeat signals, and configured application logs. These flow into a Log Analytics workspace, where Kusto Query Language (KQL) can filter by time and correlate sources. Workbooks can bring queries, metrics, and visualizations together for a reusable team dashboard. section 3.6.2
Check which VMs reported a heartbeat
Query heartbeat records from the past hour, then count them by computer. A missing heartbeat is a reason to investigate—not a diagnosis on its own. section 3.6.2
Heartbeat | where TimeGenerated > ago(1h) | summarize count() by Computer
This KQL listing filters recent Heartbeat records and summarizes their counts by Computer. section 3.6.2
Alerts let Monitor act without someone watching a dashboard all day. A metric alert can watch a threshold such as CPU above 85% for 10 minutes; a log alert can test a KQL query for repeated login failures; an activity log alert can report a resource change. Dynamic thresholds instead compare current behavior with historical patterns, catching an unusual change that a fixed threshold might miss. An alert can notify a team or trigger a webhook, Azure Function, or automation runbook. section 3.6.3
To create a VM alert in the Azure Portal, open Monitor, choose Alerts, then Create > Alert Rule and select the VM. Choose a condition and an action group for notification or response. Monitoring also applies beyond VMs: a Cosmos DB metric alert can warn when request-unit consumption nears its provisioned limit, giving the team time to consider scaling. Set alerts around conditions someone can act on; collecting a signal is useful, but knowing what to do with it is better. section 3.6.3 section 11.6.2
C:/> az monitor metrics alert create --name "High RU Consumption"
--resource-group AlpacaRG --scopes /subscriptions/
{subscription-id}/resourceGroups/AlpacaRG/providers/Microsoft.DocumentDB/
databaseAccounts/alpacacosmosdbaccount
--condition "avg totalRequestUnits > 900" --window-size 5m
--evaluation-frequency 1m --action {action-group}
This Azure CLI example creates a Cosmos DB request-unit metric alert with a threshold, evaluation window, frequency, and action group. section 11.6.2
