Monitor

Introduction

Azure Monitor is a platform service for collecting, analyzing, and acting on telemetry from Azure resources and applications. It records the activity log of every subscription, collects the platform metrics of every resource, and sends resource logs and metrics wherever a diagnostic setting tells it to. For more information, see Azure Monitor overview.

LocalStack for Azure records the activity log and the platform metrics of your emulated resources from what they really do, answers the metrics API, and delivers resource logs and metrics to Log Analytics workspaces through diagnostic settings, as Azure does. The supported APIs are available on our API Coverage section, which provides information on the extent of Monitor’s integration with LocalStack.

Getting started

This guide is designed for users new to Azure Monitor and assumes basic knowledge of the Azure CLI and our lstk az proxy. It reads a storage account’s platform metrics, sends its logs to a workspace, and exports the activity log.

Launch LocalStack using your preferred method. For more information, see Introduction to LocalStack for Azure. Once the container is running, enable Azure CLI interception by running:

lstk az start-interception

This command points the az CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API. To revert this configuration, run:

lstk az stop-interception

This reconfigures the az CLI to send commands to the official Azure management REST API.

Create the resources

Create a resource group, a Log Analytics workspace, and a storage account:

az group create --name rg-monitor-demo --location westeurope

Output

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-monitor-demo",
  "location": "westeurope",
  ...
  "name": "rg-monitor-demo",
  "properties": {
    "provisioningState": "Succeeded"
  },
  ...
}

az monitor log-analytics workspace create \
  --name ws-monitor-demo \
  --resource-group rg-monitor-demo \
  --location westeurope

Output

{
  ...
  "customerId": "f2c46cd0-949d-4014-b325-83f902ca53bb",
  ...
  "location": "westeurope",
  ...
  "name": "ws-monitor-demo",
  "provisioningState": "Succeeded",
  ...
  "retentionInDays": 30,
  "sku": {
    ...
    "name": "PerGB2018"
  },
  ...
}

az storage account create \
  --name stmonitordemo \
  --resource-group rg-monitor-demo \
  --location westeurope \
  --sku Standard_LRS

Output

{
  ...
  "kind": "StorageV2",
  ...
  "location": "westeurope",
  ...
  "name": "stmonitordemo",
  ...
  "provisioningState": "Succeeded",
  ...
  "sku": {
    "name": "Standard_LRS",
    ...
  },
  ...
}

Read the IDs the next steps use into variables:

WORKSPACE_RESOURCE_ID=$(az monitor log-analytics workspace show \
  --workspace-name ws-monitor-demo \
  --resource-group rg-monitor-demo \
  --query id \
  --output tsv)
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --workspace-name ws-monitor-demo \
  --resource-group rg-monitor-demo \
  --query customerId \
  --output tsv)
STORAGE_ACCOUNT_ID=$(az storage account show \
  --name stmonitordemo \
  --resource-group rg-monitor-demo \
  --query id \
  --output tsv)

Send a resource’s logs to a workspace

List the log and metric categories the storage account’s Blob service offers:

az monitor diagnostic-settings categories list \
  --resource "$STORAGE_ACCOUNT_ID/blobServices/default" \
  --query "value[].{name:name, categoryType:categoryType}" \
  --output table

Output

Name           CategoryType
-------------  --------------
StorageRead    Logs
StorageWrite   Logs
StorageDelete  Logs
Capacity       Metrics
Transaction    Metrics

Create a diagnostic setting that sends its write and delete operations to the workspace. For more information, see Diagnostic settings in Azure Monitor:

az monitor diagnostic-settings create \
  --name send-to-workspace \
  --resource "$STORAGE_ACCOUNT_ID/blobServices/default" \
  --workspace "$WORKSPACE_RESOURCE_ID" \
  --logs '[{"category":"StorageWrite","enabled":true},{"category":"StorageDelete","enabled":true}]'

Output

{
  ...
  "logs": [
    {
      "category": "StorageWrite",
      "enabled": true,
      "retentionPolicy": {
        "days": 0,
        "enabled": false
      }
    },
    {
      "category": "StorageDelete",
      "enabled": true,
      "retentionPolicy": {
        "days": 0,
        "enabled": false
      }
    }
  ],
  ...
  "name": "send-to-workspace",
  ...
  "workspaceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-monitor-demo/providers/Microsoft.OperationalInsights/workspaces/ws-monitor-demo"
}

Create and delete a blob container. Both requests send a record to the workspace:

az storage container create \
  --name monitor-demo \
  --account-name stmonitordemo \
  --auth-mode key
az storage container delete \
  --name monitor-demo \
  --account-name stmonitordemo \
  --auth-mode key

Output

{
  "created": true
}
{
  "deleted": true
}

Query the records in the workspace:

az monitor log-analytics query \
  --workspace "$WORKSPACE_ID" \
  --analytics-query "StorageBlobLogs | project OperationName, StatusCode | order by OperationName asc"

Output

[
  {
    "OperationName": "CreateContainer",
    "StatusCode": "201",
    "TableName": "PrimaryResult"
  },
  {
    "OperationName": "DeleteContainer",
    "StatusCode": "202",
    "TableName": "PrimaryResult"
  }
]

Note

The emulator delivers a record within seconds of the request. On Azure, the first records of a new diagnostic setting can take up to 90 minutes to arrive, and the same holds for the activity log export below.

Read platform metrics

Every resource has platform metrics, with or without a diagnostic setting. List the metrics of the storage account:

az monitor metrics list-definitions \
  --resource "$STORAGE_ACCOUNT_ID" \
  --query "[].name.value" \
  --output tsv

Output

UsedCapacity
Availability
Egress
Ingress
MigrationProgress
ReplicationLagSeconds
SuccessE2ELatency
SuccessServerLatency
Transactions

Read the transactions of the last hour, the requests of the previous step among them. The emulator counts a request at once, where Azure can take a few minutes to show it:

az monitor metrics list \
  --resource "$STORAGE_ACCOUNT_ID" \
  --metric Transactions \
  --aggregation Total \
  --interval PT1H

Output

{
  ...
  "interval": "PT1H",
  "namespace": "Microsoft.Storage/storageAccounts",
  ...
  "timespan": "2026-11-06T11:03:02Z/2026-11-06T12:03:02Z",
  "value": [
    {
      ...
      "name": {
        ...
        "value": "Transactions"
      },
      ...
      "timeseries": [
        {
          "data": [
            {
              "timeStamp": "2026-11-06T11:03:00Z",
              "total": 2.0
            }
          ],
          ...
        }
      ],
      ...
      "unit": "Count"
    }
  ]
}

Read and export the activity log

The activity log records every write, delete, and action on your resources. List the operations on the resource group:

az monitor activity-log list \
  --resource-group rg-monitor-demo \
  --offset 1h \
  --query "[].{operation:operationName.localizedValue, status:status.value}" \
  --output table

Output

Operation                                     Status
--------------------------------------------  ---------
List Storage Account Keys                     Succeeded
List Storage Account Keys                     Started
List Storage Account Keys                     Succeeded
List Storage Account Keys                     Started
Create or update resource diagnostic setting  Succeeded
Create or update resource diagnostic setting  Started
Create/Update Storage Account                 Succeeded
Create/Update Storage Account                 Accepted
Create/Update Storage Account                 Started
Create Workspace                              Succeeded
Create Workspace                              Started
Create Resource Group                         Succeeded
Create Resource Group                         Started

Export the subscription’s activity log to the workspace with a subscription diagnostic setting:

az monitor diagnostic-settings subscription create \
  --name export-activity-log \
  --location westeurope \
  --workspace "$WORKSPACE_RESOURCE_ID" \
  --logs '[{"category":"Administrative","enabled":true}]'

Output

{
  ...
  "location": "global",
  "logs": [
    {
      "category": "Administrative",
      "enabled": true
    }
  ],
  "name": "export-activity-log",
  ...
  "workspaceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-monitor-demo/providers/Microsoft.OperationalInsights/workspaces/ws-monitor-demo"
}

Update the resource group’s tags, a write the export records, and query the AzureActivity table:

az group update --name rg-monitor-demo --tags purpose=docs

Output

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-monitor-demo",
  "location": "westeurope",
  ...
  "name": "rg-monitor-demo",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": {
    "purpose": "docs"
  },
  ...
}

az monitor log-analytics query \
  --workspace "$WORKSPACE_ID" \
  --analytics-query "AzureActivity | where ResourceGroup =~ 'rg-monitor-demo' and OperationNameValue =~ 'Microsoft.Resources/subscriptions/resourceGroups/write' | project OperationNameValue, ActivityStatusValue, ResourceGroup | order by ActivityStatusValue asc"

Output

[
  {
    "ActivityStatusValue": "Start",
    "OperationNameValue": "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/WRITE",
    "ResourceGroup": "RG-MONITOR-DEMO",
    "TableName": "PrimaryResult"
  },
  {
    "ActivityStatusValue": "Success",
    "OperationNameValue": "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/WRITE",
    "ResourceGroup": "RG-MONITOR-DEMO",
    "TableName": "PrimaryResult"
  }
]

A subscription diagnostic setting applies to the whole subscription. Delete it when you’re done:

az monitor diagnostic-settings subscription delete \
  --name export-activity-log \
  --yes

Delete the resources

Delete the diagnostic setting and the resource group:

az monitor diagnostic-settings delete \
  --name send-to-workspace \
  --resource "$STORAGE_ACCOUNT_ID/blobServices/default"
az group delete --name rg-monitor-demo --yes

Features

The Azure Monitor emulator supports the following features:

• Activity log: Every write, delete, and action on your resources leaves the events Azure records, with the caller, the correlation ID that ties an operation’s events together, the status, and the display name of the operation. The list API supports the $filter patterns Azure accepts, $select, and paging.
• Activity log export: A subscription’s diagnostic setting exports the activity log to the AzureActivity table of a Log Analytics workspace.
• Diagnostic settings: Create, get, update, and delete diagnostic settings on a resource or a subscription, and list a resource’s log and metric categories. A setting refuses a category the resource type doesn’t have, as Azure does, and delivers the resource’s logs and metrics to its workspace.
• Platform metrics: Every resource records the platform metrics Azure defines for its type, from what it does, once a minute. The metrics API answers their definitions, namespaces, and values, with aggregations, intervals, dimension filters, and splitting.
• Alert rules and action groups: Create, get, update, list, and delete metric alerts, activity log alerts, scheduled query rules, and action groups.
• Autoscale settings, data collection rules, web tests, and workbooks: Create, get, update, list, and delete autoscale settings, data collection rules and endpoints with their associations, availability web tests, and workbooks and workbook templates.

Log categories

The emulator accepts every diagnostic log category of a resource type, and produces the following ones from what your resources do:

Resource type	Log categories
Microsoft.ApiManagement/service	GatewayLogs
Microsoft.App/managedEnvironments	ContainerAppConsoleLogs, ContainerAppSystemLogs
Microsoft.AppConfiguration/configurationStores	Audit, HttpRequest
Microsoft.Cdn/profiles	FrontDoorAccessLog
Microsoft.ContainerInstance/containerGroups	ContainerEvent, ContainerInstanceLog
Microsoft.ContainerRegistry/registries	ContainerRegistryLoginEvents, ContainerRegistryRepositoryEvents
Microsoft.ContainerService/managedClusters	kube-audit, kube-audit-admin, cloud-controller-manager, csi-azuredisk-controller, csi-azurefile-controller, csi-snapshot-controller
Microsoft.DBforMySQL/flexibleServers	MySqlAuditLogs, MySqlSlowLogs
Microsoft.DBforPostgreSQL/flexibleServers	PostgreSQLLogs
Microsoft.EventGrid/topics, Microsoft.EventGrid/domains	DataPlaneRequests, DeliveryFailures, PublishFailures
Microsoft.EventGrid/systemTopics	DeliveryFailures
Microsoft.EventHub/namespaces	OperationalLogs, RuntimeAuditLogs
Microsoft.Insights/components	AppAvailabilityResults, AppBrowserTimings, AppDependencies, AppEvents, AppExceptions, AppMetrics, AppPageViews, AppRequests, AppTraces
Microsoft.KeyVault/vaults	AuditEvent
Microsoft.OperationalInsights/workspaces	Audit
Microsoft.ServiceBus/namespaces	OperationalLogs, RuntimeAuditLogs
Microsoft.Sql/servers/databases	Errors, SQLSecurityAuditEvents
Microsoft.Storage/storageAccounts/blobServices, fileServices, queueServices, tableServices	StorageDelete, StorageRead, StorageWrite
Microsoft.Web/sites, Microsoft.Web/sites/slots	AppServiceConsoleLogs, AppServiceHTTPLogs, AppServicePlatformLogs, FunctionAppLogs

The other categories, and the categories of the other resource types, stay empty, because the emulator doesn’t see the activity they record. For example, a Cosmos DB account’s requests reach its data plane without passing through the emulator’s request handling, and no network traffic flows through network security groups or load balancers.

Configuration

Environment variable	Default	Description
LS_AZURE_ACTIVITY_LOG_MAX_EVENTS	10000	The most activity log events the emulator keeps per subscription. Past it, the oldest go first.
LS_AZURE_MONITOR_METRICS_WINDOW_MINUTES	60	How long the emulator keeps a resource’s platform metrics, in minutes.
LS_AZURE_METRICS_MAX_SERIES	10000	The most metric series (a resource’s metric with one set of dimension values) the emulator keeps.
LS_AZURE_LOG_ANALYTICS_DELIVERY	1	Whether the emulator collects resource logs and platform metrics for diagnostic settings. Set it to 0 to turn the collection off.

Limitations

• No data persistence across restarts: The activity log, the platform metrics, the diagnostic settings, and every other resource are held in memory and lost when the emulator stops.
• Short retention: The emulator keeps a resource’s platform metrics for LS_AZURE_MONITOR_METRICS_WINDOW_MINUTES minutes and up to LS_AZURE_ACTIVITY_LOG_MAX_EVENTS activity log events per subscription, where Azure keeps metrics for 93 days and the activity log for 90 days.
• Only workspace destinations deliver: A diagnostic setting that names a storage account, an event hub, or a partner solution is stored and returned, but the emulator delivers only to Log Analytics workspaces.
• Some activity log categories stay empty: The emulator records the Administrative category. The Security, ServiceHealth, ResourceHealth, Alert, Recommendation, and Policy categories are accepted and stay empty.
• Activity log names and events: The emulator names an operation’s events as Azure’s list of provider operations names the operation. Azure’s activity log names a few differently, such as Update resource group for the write of a new resource group, and records an Accepted event for some operations the emulator completes at once, such as a workspace’s create.
• Alert rules are not evaluated: Metric alerts, activity log alerts, and scheduled query rules are stored, but never evaluated, so no alert fires and no action group is notified.
• Autoscale rules are not evaluated: Autoscale settings are stored, but never scale their target.
• Workbook revision history: Revisions always return the current version of a workbook.
• Components purge: The purge endpoint accepts requests and returns an operation ID, but purges nothing.

Samples

Explore end-to-end examples in the LocalStack for Azure Samples repository.

API Coverage

116 of 288 operations implemented

Formats for tools and AIPage MarkdownCoverage MarkdownCoverage JSONCoverage catalog

Operation ▲	Implemented ▼

PreviousPage 1 of 0Next