Monitoring
CoreLog Analytics
Log workspace, KQL querying, and analysis workflow.
Key points
- Workspace and query experience for Azure Monitor Logs.
- KQL filters, joins, summaries, and time windows analyze ingested table data.
- Data appears only after a supported collection path sends it to the workspace.
Best-known use cases
- Find repeated failures across several resources.
- Aggregate request or operation logs over a time window.
What candidates often confuse it with
- Log Analytics vs metrics explorer: query detailed records vs chart numeric time series.
- Workspace creation vs diagnostic setting: provide destination vs route data into it.
Key takeaway
Use Log Analytics for detailed cross-resource log queries after confirming the required data is collected.
Related services
- Azure Monitor
- Azure Monitor alerts, action groups, and alert processing rules
- Azure Monitor Insights
Relevant exam tasks
- D5.1.S1 — Interpret metrics in Azure Monitor
- D5.1.S2 — Configure log settings in Azure Monitor
- D5.1.S3 — Query and analyze logs in Azure Monitor
- D5.1.S4 — Set up alert rules, action groups, and alert processing rules in Azure Monitor
- D5.1.S5 — Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights