Azure Monitor 数据平台Azure Monitor data platform

在当今运行分布式应用程序(依赖于云和本地服务)的复杂计算环境中启用观测功能,需要从分布式系统的每个层和每个组件收集操作数据。Enabling observability across today's complex computing environments running distributed applications that rely on both cloud and on-premises services, requires collection of operational data from every layer and every component of the distributed system. 需要能够对这些数据执行深入的见解分析,并将其整合到可提供不同透视图的单个窗格,这样才能为组织中的众多利益干系人提供支持。You need to be able to perform deep insights on this data and consolidate it into a single pane of glass with different perspectives to support the multitude of stakeholders in your organization.

Azure Monitor 会将各种源中的数据收集并聚合到一个通用数据平台,在该平台中,可以使用这些数据进行分析、实现可视化和发出警报。Azure Monitor collects and aggregates data from a variety of sources into a common data platform where it can be used for analysis, visualization, and alerting. Azure Monitor 基于多个源中的数据提供一致的体验,让你深入洞察所有受监视的资源,甚至是其他服务在 Azure Monitor 中存储的数据。It provides a consistent experience on top of data from multiple sources, which gives you deep insights across all your monitored resources and even with data from other services that store their data in Azure Monitor.

Azure Monitor 概述

Azure Monitor 中的观测数据Observability data in Azure Monitor

指标、日志和分布式跟踪通常称作观测功能的三大支柱。Metrics, logs, and distributed traces are commonly referred to as the three pillars of observability. 监视工具必须收集并分析这些不同类型的数据,才能对受监视系统进行充分的观测。These are the different kinds of data that a monitoring tool must collect and analyze to provide sufficient observability of a monitored system. 若要实现观测功能,可以关联多个支柱提供的数据,并聚合整个受监视资源集中的数据。Observability can be achieved by correlating data from multiple pillars and aggregating data across the entire set of resources being monitored. 由于 Azure Monitor 将多个源中的数据存储在一起,因此可以使用一组通用的工具来关联和分析这些数据。Because Azure Monitor stores data from multiple sources together, the data can be correlated and analyzed using a common set of tools. 它还将数据与多个 Azure 订阅和租户相关联,并为其他服务托管数据。Azure Monitor 还可关联多个 Azure 订阅和租户中的数据,并托管其他服务的数据。It also correlates data across multiple Azure subscriptions and tenants, in addition to hosting data for other services.

Azure 资源会生成大量的监视数据。Azure resources generate a significant amount of monitoring data. Azure Monitor 将这些数据连同其他源中的监视数据一起整合到指标或日志平台。Azure Monitor consolidates this data along with monitoring data from other sources into either a Metrics or Logs platform. 每个平台已针对特定的监视方案进行优化,各自支持 Azure Monitor 中的不同功能。Each is optimized for particular monitoring scenarios, and each supports different features in Azure Monitor. 使用数据分析、可视化或警报等功能需要了解数据的差异,以便能够以最经济高效的方式实现所需的方案。Features such as data analysis, visualizations, or alerting require you to understand the differences so that you can implement your required scenario in the most efficient and cost effective manner. Azure Monitor 中的见解功能(例如 Application Insights)提供分析工具让你专注于特定的监视方案,而无需了解这两种数据之间的差异。Insights in Azure Monitor such as Application Insights have analysis tools that allow you to focus on the particular monitoring scenario without having to understand the differences between the two types of data.


指标是数字值,用于描述系统某些方面在特定时间点的情况。Metrics are numerical values that describe some aspect of a system at a particular point in time. 指标是定期收集的,使用时间戳、名称、值以及一个或多个定义标签进行标识。They are collected at regular intervals and are identified with a timestamp, a name, a value, and one or more defining labels. 可以使用各种算法聚合指标、将其与其他指标进行比较,以及分析随时间推移的指标趋势。Metrics can be aggregated using a variety of algorithms, compared to other metrics, and analyzed for trends over time.

Azure Monitor 中的指标存储在时序数据库中,该数据库经过优化,可用于分析带时间戳的数据。Metrics in Azure Monitor are stored in a time-series database which is optimized for analyzing time-stamped data. 因此,指标特别适合用于警报和快速检测问题。This makes metrics particularly suited for alerting and fast detection of issues. 它们可以告知系统的运行状况,但通常需要与日志相结合才能识别问题的根本原因。They can tell you how your system is performing but typically need to be combined with logs to identify the root cause of issues.

在 Azure 门户中使用 Azure 指标资源管理器可以通过指标进行交互式分析。Metrics are available for interactive analysis in the Azure portal with Azure Metrics Explorer. 可将指标添加到 Azure 仪表板,以结合其他数据生成可视化效果,以及用于近实时警报They can be added to an Azure dashboard for visualization in combination with other data and used for near-real time alerting.

Azure Monitor 中的指标中详细了解 Azure Monitor 指标,包括其数据源。Read more about Azure Monitor Metrics including their sources of data in Metrics in Azure Monitor.


日志是系统中发生的事件。Logs are events that occurred within the system. 它们可以包含不同类型的数据,并可以结构化,或者采用带时间戳的自由文本格式。They can contain different kinds of data and may be structured or free form text with a timestamp. 当环境中的事件生成日志条目时,可以偶发性地创建日志;负载较重的系统通常会生成更多的日志卷。They may be created sporadically as events in the environment generate log entries, and a system under heavy load will typically generate more log volume.

Azure Monitor 中的日志存储在基于 Azure 数据资源管理器的 Log Analytics 工作区中,Azure 数据资源管理器可提供强大的分析引擎和丰富查询语言Logs in Azure Monitor are stored in a Log Analytics workspace that's based on Azure Data Explorer which provides a powerful analysis engine and rich query language. 日志通常提供足够的信息来提供所要识别的问题的完整上下文,在识别问题的根本原因时很有价值。Logs typically provide enough information to provide complete context of the issue being identified and are valuable for identifying root case of issues.


区分 Azure Monitor 日志和 Azure 中的日志数据源很重要。It's important to distinguish between Azure Monitor Logs and sources of log data in Azure. 例如,Azure 中的订阅级别事件将写入活动日志,你可以从 Azure Monitor 菜单查看该日志。For example, subscription level events in Azure are written to an activity log that you can view from the Azure Monitor menu. 大多数资源将操作信息写入资源日志,你可以将其转发到不同的位置。Most resources will write operational information to a resource log that you can forward to different locations. Azure Monitor 日志是一种日志数据平台,它收集活动日志和资源日志以及其他监视数据,以便对整个资源集进行深入分析。Azure Monitor Logs is a log data platform that collects activity logs and resource logs along with other monitoring data to provide deep analysis across your entire set of resources.

可以在 Azure 门户中配合 Log Analytics 以交互方式使用日志查询,或者将结果添加到 Azure 仪表板,以结合其他数据生成可视化效果。You can work with log queries interactively with Log Analytics in the Azure portal or add the results to an Azure dashboard for visualization in combination with other data. 还可以创建日志警报,以根据计划查询的结果触发警报。You can also create log alerts which will trigger an alert based on the results of a schedule query.

Azure Monitor 中的日志中详细了解 Azure Monitor 日志,包括其数据源。Read more about Azure Monitor Logs including their sources of data in Logs in Azure Monitor.

分布式跟踪Distributed traces

跟踪是通过分布式系统跟进用户请求的相关事件系列。Traces are series of related events that follow a user request through a distributed system. 跟踪可用于确定应用程序代码的行为,以及不同事务的性能。They can be used to determine behavior of application code and the performance of different transactions. 日志通常是由分布式系统的单个组件创建的,而跟踪可以度量应用程序在整套组件中的运行状况和性能。While logs will often be created by individual components of a distributed system, a trace measures the operation and performance of your application across the entire set of components.

Azure Monitor 中的分布式跟踪是使用 Application Insights SDK 启用的,跟踪数据连同 Application Insights 收集的其他应用程序日志数据一起存储。Distributed tracing in Azure Monitor is enabled with the Application Insights SDK, and trace data is stored with other application log data collected by Application Insights. 因此,可以在用于处理其他日志数据(包括日志查询、仪表板和警报)的相同分析工具中使用跟踪数据。This makes it available to the same analysis tools as other log data including log queries, dashboards, and alerts.

什么是分布式跟踪?中详细了解分布式跟踪。Read more about distributed tracing at What is Distributed Tracing?.

Azure Monitor 指标与日志的比较Compare Azure Monitor Metrics and Logs

下表比较了 Azure Monitor 中的指标和日志。The following table compares Metrics and Logs in Azure Monitor.

属性Attribute 指标Metrics 日志Logs
优点Benefits 轻型数据,支持警报等近实时方案。Lightweight and capable of near-real time scenarios such as alerting. 非常适合用于快速检测问题。Ideal for fast detection of issues. 使用丰富查询语言进行分析。Analyzed with rich query language. 非常适合用于深入分析和识别根本原因。Ideal for deep analysis and identifying root cause.
数据Data 仅限数字值Numerical values only 文本或数值数据Text or numeric data
结构Structure 标准属性集,包括采样时间、受监视的资源、数字值。Standard set of properties including sample time, resource being monitored, a numeric value. 某些指标包含多个维度用于进一步的定义。Some metrics include multiple dimensions for further definition. 取决于日志类型的唯一属性集。Unique set of properties depending on the log type.
集合Collection 定期收集。Collected at regular intervals. 可以在事件触发记录进行创建时偶发性地收集。May be collected sporadically as events trigger a record to be created.
在 Azure 门户中查看View in Azure portal 指标资源管理器Metrics Explorer Log AnalyticsLog Analytics
数据源包括Data sources include 从 Azure 资源收集的平台指标。Platform metrics collected from Azure resources.
Application Insights 监视的应用程序。Applications monitored by Application Insights.
应用程序或 API 定义的自定义指标。Custom defined by application or API.
应用程序和资源日志。Application and resource logs.
监视解决方案。Monitoring solutions.
代理和 VM 扩展。Agents and VM extensions.
应用程序请求和异常。Application requests and exceptions.
Azure 安全中心。Azure Security Center.
数据收集器 API。Data Collector API.

收集监视数据Collect monitoring data

不同的 Azure Monitor 数据源会写入 Log Analytics 工作区(日志)和/或 Azure Monitor 指标数据库(指标)。Different sources of data for Azure Monitor will write to either a Log Analytics workspace (Logs) or the Azure Monitor metrics database (Metrics) or both. 某些源直接写入这些数据存储,而某些源则会写入 Azure 存储等其他位置,这需要指定某种配置来填充日志或指标。Some sources will write directly to these data stores, while others may write to another location such as Azure storage and require some configuration to populate logs or metrics.

有关填充每种数据类型的不同数据源的列表,请参阅 Azure Monitor 中的指标Azure Monitor 中的日志See Metrics in Azure Monitor and Logs in Azure Monitor for a listing of different data sources that populate each type.

将数据流式传输到外部系统Stream data to external systems

除了使用 Azure 中的工具分析监视数据以外,可能还需要将这些数据转发到外部工具,例如某个安全信息和事件管理 (SIEM) 产品。In addition to using the tools in Azure to analyze monitoring data, you may have a requirement to forward it to an external tool such as a security information and event management (SIEM) product. 通常,这种转发是通过 Azure 事件中心直接从受监视资源完成的。This forwarding is typically done directly from monitored resources through Azure Event Hubs. 可将某些源配置为直接向事件中心发送数据,同时,可以使用另一个进程(例如逻辑应用)来检索所需的数据。Some sources can be configured to send data directly to an event hub while you can use another process such as a Logic App to retrieve the required data. 有个详细信息,请参阅将 Azure 监视数据流式传输到事件中心供外部工具使用See Stream Azure monitoring data to an event hub for consumption by an external tool for details.

后续步骤Next steps