Cosmos monitoring setup

cosmosSite.monitoringSetup.intro

Tier matrix

Tier	Cost	Production impact	Unlocks
TIER C · ALWAYS-ON Local samples	US$ 0	None	RU Budget (app-only), Throttling RCA (429 from headers), Hot Partitions heat, Query Cost — all from captured response headers. Sees only NoSqlStudio traffic.
TIER B · FREE Azure Monitor	US$ 0	None — reads platform metrics from ARM, never touches Cosmos data plane.	Aggregate RU Budget, Throughput Optimizer, Throttling count, Hot Partitions per PartitionKeyRangeId — covers production traffic.
TIER A · PAID Log Analytics	~US$ 2.50 / GB ingest + retention	Documented as minimal by Microsoft; ingestion stream runs continuously.	Full per-shape KQL in app, Diagnostic Logs pane, per-shape Throttling RCA, composite-index recommendations from real workload traces.

Path 1

FREE — Azure Monitor + Local samples

cosmosSite.monitoringSetup.path1.intro

Part A — Azure portal / CLI

1. Create a Service Principal

cosmosSite.monitoringSetup.path1.step1Body

CLI equivalent:

az ad sp create-for-rbac \
  --name nosqlstudio-cosmos-reader \
  --role "Monitoring Reader" \
  --scopes /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>

cosmosSite.monitoringSetup.path1.step2Title

cosmosSite.monitoringSetup.path1.step2Body

az role assignment create \
  --assignee <APP_ID> \
  --role "Monitoring Reader" \
  --scope /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>

3. Copy the Cosmos Resource ID

cosmosSite.monitoringSetup.path1.step3Body

az cosmosdb show -n <ACCOUNT_NAME> -g <RG_NAME> --query id -o tsv

Part B — NoSqlStudio

Connect to your Cosmos account in NoSqlStudio.
cosmosSite.monitoringSetup.path1.partBStep2
cosmosSite.monitoringSetup.path1.partBStep3
cosmosSite.monitoringSetup.path1.partBStep4
cosmosSite.monitoringSetup.path1.partBStep5
cosmosSite.monitoringSetup.path1.partBStep6

Part C — Verify

cosmosSite.monitoringSetup.path1.partCBody

Path 2

PAID — add Log Analytics

cosmosSite.monitoringSetup.path2.intro

Part A — Create a Log Analytics workspace

az monitor log-analytics workspace create \
  -g <RG_NAME> -n nosqlstudio-cosmos-logs \
  --retention-time 30 \
  --location <REGION>

Part B — Put cost guardrails in place BEFORE enabling logs

cosmosSite.monitoringSetup.path2.partBBullet1
cosmosSite.monitoringSetup.path2.partBBullet2
cosmosSite.monitoringSetup.path2.partBBullet3

az monitor log-analytics workspace update \
  -g <RG_NAME> -n nosqlstudio-cosmos-logs \
  --quota 1

Part C — Enable Diagnostic Settings on the Cosmos account

cosmosSite.monitoringSetup.path2.partCBody

cosmosSite.monitoringSetup.path2.partCBullet1
cosmosSite.monitoringSetup.path2.partCBullet2
cosmosSite.monitoringSetup.path2.partCBullet3
cosmosSite.monitoringSetup.path2.partCBullet4

cosmosSite.monitoringSetup.path2.partCDestination

az monitor diagnostic-settings create \
  --name to-loganalytics \
  --resource $(az cosmosdb show -n <ACCOUNT> -g <RG> --query id -o tsv) \
  --workspace $(az monitor log-analytics workspace show -g <RG> -n nosqlstudio-cosmos-logs --query id -o tsv) \
  --logs '[{"category":"MongoRequests","enabled":true}]' \
  --export-to-resource-specific true

cosmosSite.monitoringSetup.path2.partDTitle

az role assignment create \
  --assignee <APP_ID> \
  --role "Log Analytics Reader" \
  --scope $(az monitor log-analytics workspace show -g <RG> -n nosqlstudio-cosmos-logs --query id -o tsv)

Part E — Copy the Workspace ID (GUID)

cosmosSite.monitoringSetup.path2.partEBody

az monitor log-analytics workspace show \
  -g <RG_NAME> -n nosqlstudio-cosmos-logs \
  --query customerId -o tsv

Part F — NoSqlStudio

cosmosSite.monitoringSetup.path2.partFStep1
cosmosSite.monitoringSetup.path2.partFStep2
Click Save.

Part G — Verify

cosmosSite.monitoringSetup.path2.partGBody

Quick decision table

Scenario	Recommendation
Dev cluster, test environment	Path 1 (FREE). Skip Log Analytics.
Production cluster, healthy — want basic observability	Path 1 (FREE).
Active incident — need to know WHICH query spiked at 14:32	Path 1 + 2 temporarily. Disable Diagnostic Setting after the investigation.
Compliance — log retention required for N days	Path 1 + 2 permanent. Daily cap mandatory.
No Azure budget at all	TIER C (Local samples) only. Leave Cloud Credentials empty. Workspace falls back automatically — only loses Diagnostic Logs (KQL).

Troubleshooting — “I created the Diagnostic Setting but no data is flowing”

A brand-new Diagnostic Setting sometimes refuses to start emitting events for 30+ minutes (or never), even though the management plane reports it as “active”. This is a known quirk of Azure Monitor when a previous setting on the same resource was recently deleted, or when only a single log category is enabled.

How to confirm you are stuck in this state

cosmosSite.monitoringSetup.troubleshooting.sub1Body

cosmosSite.monitoringSetup.troubleshooting.sub1Code

The workaround that unsticks it

cosmosSite.monitoringSetup.troubleshooting.sub2Body

cosmosSite.monitoringSetup.troubleshooting.sub2Code

cosmosSite.monitoringSetup.troubleshooting.sub2Note

When even the workaround doesn’t work

cosmosSite.monitoringSetup.troubleshooting.sub3List

Disabling later to stop paying

cosmosSite.monitoringSetup.disable.step1
Azure: Cosmos account → Diagnostic settings → delete the setting. Stops the ingestion stream.
Optional: delete the Log Analytics workspace if it's not used for anything else. Otherwise leave it — retention cost drops to zero as no new logs flow in.