Hey friends, you know that monitoring
your cloud services is vital,
but it can be complex.
Azure offers so many options to help you,
but how do you know which
ones to use for your scenario?
Azure Barry is back, to tell me what
to choose. Today on Azure Friday.
Hey friends, I'm Scott
Hanselman and it's Azure Friday.
We're here with Azure Barry. How are you, Sir?
I am very good, thank you.
I'm great, you've done a great
job on online on your blog,
on videos over the years,
telling people about all the different
things that Azure has available,
but being very prescriptive,
this is what's great about you and
why I like your content is your very
prescriptive about if you have these
problems you're going to build a
flow chart of sorts and you explain
this is the Azure feature or the
Azure service that is available and
monitoring is a big complicated issue
right now and you're going to help me
demystify a lot of those things today.
Absolutely.
Alright, so there's there's Azure monitoring.
There's different ways to log,
there's application insights.
How many different things are going on?
How many different ways are
there to look at an application,
who there is?
I don't know like 7 different services,
probably a bit more,
but there is definitely seven that I'm
going to go through to that you can use
to monitor your application and also
your subscription and multiple applications,
so an overview of all your applications.
But these services exist
for different reasons.
It's not that there's duplication,
it's that their specific use cases and
reasons to use these different things,
and we do.
Need to understand what our business need
is and then map it to the correct service,
right? Absolutely yeah.
Different services have different
requirements for when you have
different requirements for your app.
You use different services.
Some services are meant for
just monitoring one app.
Some services are meant
for monitoring security.
For instance very cool.
Alright,
let's do it.
So in Azure you have multiple options
for monitoring your applications.
Now one of those is application
insights and application Insights is
actually a feature of Azure Monitor,
which we'll see in a bit and you
use Azure application insights
to monitor a single application,
and that's in a web application or
can also be a desktop application
and then next you have Visual Studio
app Center that's also meant for
monitoring a single application
and use this to monitor or you
guess it a mobile application.
And then you also have Azure
Network watcher and you use this
well to kind of watch your network
so to troubleshoot network issues
to find the next hop,
troubleshoot IP addresses,
troubleshoot VM access issues,
things like that.
And then there's Azure Monitor which
I just talked about and Azure monitor
has as a feature application insights
but also other monitoring tools
and Azure monitor is really meant
as an overall monitoring system,
so you use that to monitor multiple
applications or for instance.
All your applications within a
subscription or within the Resource Group.
And then next is also the security center,
which is kind of a monitoring service.
I think it definitely is because
it monitors actively all
of your services and then it tells you which
services are less secure than other services.
And then it also suggests things that you can
do to improve the security of those services.
And then an extension of that basically
is Azure advisor that also includes
those recommendations of security center.
But as your advisor monitors all
of your services as well and comes
up with other recommendations,
not only security, but also for
performance availability and for costs.
And then the final service for monitoring
your applications in Azure is Azure Sentinel.
Azure Sentinel is a security based service.
It kind of also does what security center
does, but it can go a lot further and
we'll see what that actually is in a bit.
So how would you go about choosing
between these services?
Well, what I do is I first ask
the question or what is the scope
that I need to monitor as in,
is that a single application or is that more?
Is that maybe all of my subscription?
Or let's say my?
Resource Group and then after I determined
that I can take a look at the functionality
that I actually need for monitoring my
application because that can be different.
For instance, I could need a security system.
So you would look at the
security Center for instance.
Or I might need to monitor usage and you
would look at a different service there.
So let's take a look at what is
the scope that I need to monitor?
These services,
application insights and Epicenter,
Visual Studio app center you juice
to monitor application level.
So a single application you'd monitor
with the services and if you need more
so you need to monitor your subscription
or resource group or another pairing of
services then you would use Azure monitor.
Network Watcher,
Security Center advisor and also Azure
Sentinel because it's also an over
arching service that monitored can
monitor your whole subscription there.
Now let's take a look at some of
the functionality Ann will dive
into some of these services here,
so here is Azure Application Insights,
which is now actually a feature
of Azure monitor.
What would you use this for while you
use this to monitor web and also desktop
applications in detail in very much
details and I'll show you in a bit what
that actually looks like in the Azure
portal so you can monitor and alert
also on many things like availability
so you can have this thing monitor
the availability of let's say in Azure.
App Service web app and then send you an
alert when the availability goes down,
which is very useful.
Or performance also failures usage,
as in how many people visit my
application where those people from
and even what type of operating
system do they use when they do that?
You can also set up a pings and
multi step web tests where you
say well I want my website
to be tested from let's say 5
geographical locations and I want
to test the homepage and the about
page and after that I want to go
to the episode page for instance
and then you can then Alert me.
When that goes wrong,
or even when that goes right.
And Azure Azure application Insights,
as it is a feature of Azure monitor,
it sends all of its data to
a log analytics workspace,
which is a bucket that collects
data that Azure monitor users.
And we'll see that in one
of the next slides as well,
but that looks like you could also
continuously export the data of
Azure application insights into,
let's say, a blob storage for instance,
that you can use later to analyze.
Jason format and this thing also
comes with an application map which
is more of my favorite features
of Azure Application Insights.
And I'll show you that why that
is actually one of my favourites.
So this here is Azure Application
Insights in the Azure portal this
is monitoring one of my websites
and it can do a lot of things like
you see availability and failures.
Let's just look at the failures because
things don't always go so well now
it's all right here in the last 24 hours.
Most of my failures here are attacks
that I get where other bolts or
something they're pinging me and they're
looking for URLs that don't exist.
But let's see what happens when I.
Increase the range and look at more failures.
see I have a lot more failures here
like a file not found exception
and from here I can actually drill
down in debt into that exception.
I can see it like this.
She's very cool because now I can
actually see the whole stack trace
of the exception which can help me to
debug it and to actually find what's
happening in my application so that I
can fix it and then don't have that anymore,
which is very cool.
And then my favorite feature like I said,
is the application map.
So this is a website that I have
that also connects to a database and
also to an API like you see here and
you can see those connections right
here and you can see how many calls
happened within a certain timeframe.
In this case that's last hour,
but also when things go wrong you can
see that here and then things go right.
You can see that here as well,
including the performance between
all of those components like this,
which is very cool.
So that is application insights.
Now let's go back.
And zoom into another service
which is Azure Monitor.
Now Azure Monitor collects data
from all of your Azure services.
In Azure.
There are lots of things that generate
data and log files and metrics,
so Azure resources like the services
that run your application and your
databases applications themselves
like the dot net application
for instance that you run that also has
internal logs and things like that.
There are virtual machine agents
that you can install that can
derive data from that virtual
machine and sent it also somewhere.
And there's also data from
data collector API's.
Now all of this data goes into
a logs log analytics workspace
which what I said was a bucket
that basically just collects data
and in Azure monitor you use this.
In Azure monitor logs,
which is what this data store is
called in Azure monitor and the
other data store for Azure Monitor
is called Azure Monitor metrics
and this thing collects metrics
time series based metrics.
So things like.
Memory usage,
CPU usage where Azure monitor
logs stores logs like web server
logs for instance and then within
Azure monitor you can analyze
both of these data sources.
So with the log analytics feature
of Azure monitor you actually can
diagnose the data in Azure monitor
logs and you could use then the
kusto query language to do that and
with the Metrics Explorer feature in
Azure monitor you would go through
all of the metrics so the time series data.
CPU usage and memory usage.
Things like that within the Azure monitor,
metrics Data Store and with these
functionalities you can get lots of
insights and you can create dashboards
and reports within Azure monitor.
Works book Workbooks which are reports
insights which are intelligent
thinks that bubble up which as a
monitor says hey I found something
that might be interesting to you
and you can also alert on those
things as in when something goes
wrong when you have failures,
let's say then Azure monitor can let
you know that that's actually happening.
So again,
let's see that in action so that
you have a little bit of context.
What that looks like this here
is Azure monitor within the Azure
portal and it is then connected to
an Azure log analytics workspace and
it also has a metrics store that's
all automatically done for you there.
Now this is connected to all
sorts of applications and also
to application insights here.
And it can tell me lots of stuff
like for instance when I click
here on storage accounts it.
Can tell me some insights
about my storage accounts.
For instance,
here are some of my storage accounts and
it tells me the transaction timeline,
how many transactions happened
for D storage accounts,
what the latency was and if and how
many errors there were for instance.
And Additionally I can also hook
up more data sources to flow data
into the log analytics workspace
that an Azure monitor can use.
I can do that from here.
There's lots of services that.
I have within my subscription
and I can simply.
Create diagnostic settings to then
start funneling all that data to
the log analytics workspace and
or to the metrics store so that
Azure monitor can then use that and
query that data which is very cool.
Now, so that's the functionality of
application insights and also Azure Monitor.
And then before we go and
compare all the services,
also want to talk about Azure Security
Center versus Azure Sentinel because
that might be confusing there.
Both security monitoring
services now which one does?
What if you look at the security
lifecycle within a company you have
these steps within the process.
You have collect and prevent which
are the steps that you use to get
an inventory of all the services and
resources that you use to run your
application and store your data and
get a handle on how securities are
and try to make them more secure.
And then there is detection of incidents
where you try to detect what is happening,
if if there is a breach for instance,
or you have a vulnerability you try
to detect these things and also
actively hunt for incidents and
then once you have an incident when
she when you found an incident.
Then you can investigate them and
analyze them to see what where they
came from and how severe they are.
And finally,
then you respond to the incident
by fixing the vulnerability.
For instance, maybe cleaning some things up,
maybe emailing users, you name it,
lots of things that you might
do with the security incident,
and you can also automate that stuff.
Now if you look at Azure Security Center,
where does that fit within this process?
That fits right in here that does most
of the collection and preventing and
also a little bit of the detection,
but it's very good at collecting
and preventing so it will create an
inventory of all of your services
and it will then tell you actionable
recommendations of what you can
actually do to make them more secure,
which is very cool.
And then Azure Sentinel also does that,
but it's focuses more on the overall picture,
so it's also very good at detecting
incidents and then investigating
them and then responding to them.
It can also prevent so provide you
with recommendations, but it's not.
It's four days,
so it's not as good at that as
security center is.
So I would say you security Center
for collection and preventing and
then Azure Sentinel for everything
else basically now again.
Let's take a small look at what
the tent looks like.
Here in the Azure portal we
see the Azure advisor service.
Now everybody has access to Azure advisor.
It's a free thing that you can use
if you have not seen this yet,
please click on it because it will tell you.
Lots of recommendations for free about
your Azure subscriptions that you can follow,
and if you take a look here I can
have recommendations for cost,
reliability, operational excellence,
performance and also for security,
which if you look at it,
it's not going very well for my subscription.
So if I click on this,
these are also the security
recommendations that Azure Security Center
would show me and these are recommendations
that I can very easily then implement
to improve the security of my services.
So this thing, for instance, has a quick fix,
which means that I can basically just
say I want to implement this for all
of these services and remediate it,
and then that would work, which is very cool.
So we've now seen.
Functionality of application insights.
Azure Monitor and also what kind
of the differences between Azure
Security Center and Azure Sentinel.
Now let's lay all of these services
against each other and see how they
stack up so we have app Insights,
Visual Studio, app Center,
network watcher, Azure Monitor,
security Center, Azure advisor,
and Azure Sentinel.
Now if you want to monitor a web or a
desktop application so a single application,
then you would use application insights.
And if you want to.
Amateur a mobile application.
Then you would use Azure Visual Studio
app Center if you want to investigate
and respond to security issues then
you would use Azure Sentinel because
that's specialized in that area
and if you want to inspect network
traffic to diagnose problems then you
would choose Azure Network watcher.
And next,
if you want to get an overview of
all of your monitoring data like
we just saw in the Azure portal,
you would use Azure Monitor which can
then use the custom query language
and also create reports and workbooks
to alert you on all that's going on
within your subscription billing.
And if you want to monitor and
prevent security issues then you
would use security center because
that's what that thing is good at.
And finally,
if you want to get an overview of actionable
recommendations then you would choose.
Azure advisor,
so this is kind of a guide that
hopefully helps you to pick the
right service to monitor your
application within Azure.
This is such a clean way,
I really admire the way that you
expressed this because I find myself
asking the same kind of questions
and sometimes I will use the wrong
one because I'm familiar with it.
I'll think that App Insight
solves all my problems.
Or I'll go to Azure Monitor,
which is great and it gives you an
overview of all the monitoring data,
but it's just so overwhelming it
doesn't give me the insight that I want.
It just gives me, you know,
an infinitely queryable log.
So I appreciate you breaking
it down so cleanly.
Yeah, I definitely hope it helps.
So it's good to know that all
of these things have a specific
functionality that they're meant for,
and you know they have a bit of overlap.
But still,
once you know which one is
meant for which task,
then you can cleanly make a
choice for which one to use when.
Fantastic,
so I'm learning all about options
for monitoring in Azure you can
check out Azure Berry Online on
its blog on Twitter and as well
as many courses on Pluralsight.
Thanks so much.
Hey, thanks for watching this
episode of Azure Friday.
Now I need you to like it.
Comment on it,
tell your friends, retweet it.
Watch more as your Friday.