1. Why Architects Care About APM

• SLI/SLO tracking — Measure request duration (p95/p99), error rate, and availability against defined targets.
• Dependency mapping — Automatically discover which services call which databases, APIs, and queues.
• Cost of outages — Mean-time-to-detect (MTTD) and mean-time-to-resolve (MTTR) directly tied to observability maturity.
• Capacity planning — Trend analysis on request volume, CPU saturation, and queue depth informs scaling decisions.

2. Auto-Instrumentation vs SDK

Best practice: Start with auto-instrumentation for baseline coverage; add SDK for custom business telemetry.

3. Key Telemetry Types

• Requests — Inbound HTTP calls; track response time, status code, success/failure.
• Dependencies — Outbound calls to SQL, HTTP APIs, Redis, Service Bus — auto-captured.
• Exceptions — Unhandled + tracked exceptions with full stack traces.
• Traces — Diagnostic log messages (ILogger, log4j, console) correlated to requests.
• Custom events — Business-level signals (e.g., "OrderPlaced", "PaymentDeclined").
• Custom metrics — Pre-aggregated numeric values (e.g., cart size, queue depth).
• Page views / Browser — Client-side performance via JavaScript snippet.

4. Distributed Tracing & Correlation

• operation_Id — Single correlation ID shared across ALL services in one transaction (W3C Trace Context).
• operation_ParentId — Links child spans to their parent, forming a tree.
• Application Insights propagates context automatically via HTTP headers (traceparent).
• End-to-end transaction view — Visualises the full call tree with timing per span; pinpoints the slow leg instantly.
• Cross-component correlation works across App Services, Functions, AKS, and even non-Azure services using OpenTelemetry.

5. Application Map

• Auto-discovered topology showing components, dependencies, and external services.
• Nodes colour-coded: 🟢 healthy, 🟡 degraded, 🔴 failing — instant failure hotspot identification.
• Edge labels show call count, average duration, and failure rate — latency bottlenecks at a glance.
• Click any node to drill into metrics, failures, and performance for that component.
• Cloud role name — Set via SDK/config to distinguish microservices in the map.

6. Live Metrics & Smart Detection

• Live Metrics Stream — Real-time (1-second latency) view of requests, failures, CPU, and memory. No sampling. Ideal for incident response.
• Filter live stream to specific server instances or operations during active investigation.
• Smart Detection — ML-based anomaly alerts: sudden failure rate spikes, abnormal response time growth, memory leaks.
• Smart Detection sends proactive email notifications — no manual alert rules needed for common patterns.
• Combine with Azure Monitor alert rules for SLO-breach notifications (e.g., p95 latency > 2s for 5 min).

7. Workspace-Based vs Classic

• Always use workspace-based — Telemetry stored in a Log Analytics workspace; enables cross-resource queries and unified RBAC.
• Classic (standalone) is deprecated; new resources default to workspace-based.
• Benefits: longer retention options (up to 730 days), commitment tier discounts, integration with Sentinel and Workbooks.
• Connection string (not instrumentation key alone) is the modern authentication method — supports regional ingestion endpoints.

🧪 Knowledge Check