AZ-104 Part 5 — Monitor & Backup

The observability picture

Resources ---> Azure Monitor
                 ├── Metrics (numbers, time-series)   -> charts, alerts, autoscale
                 └── Logs    (events, KQL queries)    -> Log Analytics workspace
                                                        └── Sentinel (SIEM/SOAR)

Metrics vs Logs — the exam's favourite question

• Metrics — numeric samples every 60 s (CPU%, latency…). Cheap, near-real-time.
• Logs — flexible events (audit logs, custom text). Queried with KQL.

// KQL example: web app 5xx errors in last hour
AppRequests
| where TimeGenerated > ago(1h)
| where ResultCode startswith "5"
| summarize count() by bin(TimeGenerated, 5m)

Alerts

Signal (metric or log query)
     |
Condition (> 80%, count > 10, …)
     |
Action Group (email, SMS, webhook, Function, runbook)

Autoscale

Autoscale watches a metric on a VMSS or App Service Plan and adds/removes instances. Rules pair up: scale-out on high CPU, scale-in on low CPU.

Azure Backup

• Recovery Services Vault — the container for backup data.
• Backup Policy — frequency + retention.
• Supports Azure VMs, SQL in Azure VM, Azure Files, on-prem via MARS agent.

az backup vault create -g myrg -n prod-vault -l eastus

Azure Site Recovery (ASR)

Replicates whole VMs to a secondary region for full-region DR. RPO measured in minutes, RTO in hours. Different from Backup: backup restores files, ASR fails over machines.

Azure Sentinel (bonus for security-savvy)

Cloud-native SIEM+SOAR: ingests logs (Azure, AWS, on-prem), analytics rules generate incidents, playbooks (Logic Apps) auto-respond.

Real-world example

A B2B SaaS runs on 3 VMs in India. You:

1. Enable Backup with 30-day retention → protects against accidental deletes.
2. Enable Site Recovery to Singapore → survives an India region outage.
3. Ship logs to a Log Analytics workspace with an alert on 5xx > 20/min → e-mails on-call.
4. Add Sentinel analytics for suspicious sign-ins → catches account takeovers.

Exam gotchas

• Metrics = numeric, near-real-time. Logs = flexible, KQL-queryable.
• Backup ≠ ASR: Backup restores files/DBs; ASR fails over regions.
• A Log Analytics workspace is billed per-GB ingested.
• Sentinel sits on top of a Log Analytics workspace.