Monitor a Windows Server with Grafana

Deploy a Prometheus and Grafana monitoring stack on a Windows Azure VM.

Introduction

30 Second Summary

Every time a website loads instantly or stays online during a traffic spike, there is a monitoring team watching dashboards behind the scenes. Infrastructure monitoring is one of the most in-demand skills for operations and analyst roles.

In this project, you will deploy a Windows Server in Azure and build a real-time monitoring dashboard using Prometheus and Grafana. You will also create an interview preparation document with 40+ questions grounded in your hands-on experience.

What You'll Build

A complete infrastructure monitoring stack on an Azure Windows Server VM, with Prometheus collecting metrics and Grafana visualizing them in a live dashboard.

By the end of this project, you'll have:

A Windows Server 2022 VM running in Azure on the free tier, accessible from your Mac via Remote Desktop.
A Grafana dashboard with 4 panels tracking CPU, memory, disk, and network metrics, plus alert rules tuned to reduce noise.
An interview preparation document with 40+ questions and answers grounded in your real project experience.
Secret Mission: Add a Windows Services monitoring panel that tracks whether critical services are running or stopped.

Are there any prerequisites?

You need a Mac running macOS 13 or later and a credit or debit card for Azure free account signup. Your card will not be charged.

Create Your Azure Free Account and Windows VM

Every monitoring stack needs a server to keep an eye on. In this project, that server is a Windows Server VM running in the cloud on Azure.

Azure offers a free tier that includes 750 hours per month of a B1S VM for 12 months. In this step, you will create your free account, deploy the VM, and connect to it from your Mac.

In this step, get ready to:

Sign up for a free Azure account.
Create a Windows Server 2022 VM in Azure.
Connect to your VM from your Mac using Remote Desktop.

Sign up for an Azure free account

Before creating any resources, you need an Azure account. The signup requires a phone number, a credit or debit card for identity verification, and a Microsoft or GitHub account.

Open your web browser and go to azure.microsoft.com/free.
Click Start free.
Sign in with your Microsoft account or GitHub account.
Enter your phone number for identity verification.
Enter your credit or debit card details.
Complete the signup process and wait for your account to be ready.
Once your account is ready, navigate to the Azure portal at portal.azure.com.

Will I be charged?

No. Azure requires a card for identity verification only. You will not be charged.

You get $200 in credit for the first 30 days. The B1S VM size is free tier eligible for 12 months, giving you 750 hours per month at no cost.

Create a Windows Server VM

A Virtual Machine is a computer running inside a cloud data center that you control remotely. You can create, resize, or delete it in minutes from your browser.

In the Azure portal, type Virtual machines in the search bar at the top.
Select Virtual machines from the search results.
Click Create.
Select Azure virtual machine.
Under Resource group, click Create new.
Enter monitoring-rg as the name.
Click OK.
For Virtual machine name, enter monitoring-vm.
For Region, select any available region such as (US) East US.
For Image, select Windows Server 2022 Datacenter: Azure Edition - x64 Gen2.
For Size, select Standard_B1s. If it is not listed, click See all sizes and search for B1s.
Under Administrator account, enter azureuser for Username.
Enter a strong password with 12 or more characters for Password and Confirm password.
Write down your password somewhere safe. You will need it to connect via Remote Desktop.
Under Inbound port rules, select Allow selected ports.
In the Select inbound ports dropdown, choose RDP (3389).
Click the Management tab at the top of the page.
Check the box for Enable auto-shutdown.
Click Review + create at the bottom of the page.
Review the summary to confirm your settings.
Click Create.
Wait for the deployment to complete. This takes 1-3 minutes.
Click Go to resource to open your VM's overview page.

You should see the VM overview page showing monitoring-vm with a status of Running.

What did Azure just create?

Azure created a Resource Group containing your VM, a managed disk, a network interface, a public IP address, and a Network Security Group. A Resource Group is a logical container that groups related resources together so you can manage them as a unit.

The NSG acts as a virtual firewall for your VM. The inbound rule you set for port 3389 allows Remote Desktop traffic to reach the VM from the internet.

Auto-shutdown powers down your VM at a set time each day. This prevents you from accidentally burning through your free tier hours.

The overview page also shows your VM's Public IP address. You will use this IP to connect from your Mac in the next substep.

VM not deploying?

Some Azure regions have limited B1S availability for new free accounts. If deployment fails, try selecting a different region such as (US) West US or (Europe) North Europe.

You can also check your quota by searching for Usage + quotas in the portal search bar. If the issue persists, submit a support request through the portal.

Help me troubleshoot my Azure VM deployment failure

Connect to your VM from your Mac

To interact with the Windows Server desktop from your Mac, you need a Remote Desktop client. RDP (Remote Desktop Protocol) sends your keyboard, mouse, and screen data between your Mac and the Windows Server.

Press Cmd+Space to open your Mac's search bar.
Type App Store and press Enter to open it.
In the Mac App Store, search for Windows App.
Click Get to download and install it.

What is Windows App?

Windows App (formerly Microsoft Remote Desktop) is a free RDP client from Microsoft. It requires macOS 13 or later. You use it to view and control your Windows Server desktop from your Mac.

Now grab your VM's public IP address from the Azure portal.

Switch back to your browser with the Azure portal open.
On your monitoring-vm overview page, find the Public IP address field.
Copy the IP address.

Press Cmd+Space to open your search bar.
Type Windows App and press Enter to open it.
Click Add PC (or the + button).
Paste the public IP address you copied into the PC name field.
Click Add.
Double-click the PC you just added to start the connection.
Enter azureuser as the username and the password you created earlier.
If prompted with a certificate warning, click Continue to accept it. This is normal for new connections.

You should see the Windows Server desktop appear inside the Windows App window on your Mac. It looks like a standard Windows desktop with a taskbar at the bottom.

Can't connect to the VM?

Make sure your VM shows a status of Running on the overview page in the Azure portal. If it says Stopped, click Start.
Double-check that you are using the correct public IP address from the VM overview page. The IP can change if the VM is restarted.
Verify your username is exactly azureuser and the password matches what you set during VM creation.

Help me troubleshoot my RDP connection to my Azure Windows VM

Answer your first interview questions

This project builds an interview preparation document alongside your monitoring stack. After each step, you will answer interview questions based on what you just did.

Write your answers in your own words. Reference the specific actions you took, using phrases like "In my project, I..." instead of textbook definitions.

What is a Virtual Machine and how is it different from a physical server?
What is a Resource Group in Azure?
What is a Network Security Group (NSG)?
What is RDP and what port does it use?
What is the difference between a public IP and a private IP?
What is the Azure free tier and what are its limits?
What is Azure Monitor? (awareness level)

Give each question a shot before checking the example answers below.

✔️ I'll give it a go!

Great. Write your answers on paper or in a text file on your Mac. You will compile everything into a formal interview prep document in a later step.

ⓧ Let me check my work

Here are example answers grounded in what you built in this step. Your wording does not need to match exactly, but your answers should reference your own project experience.

What is a Virtual Machine and how is it different from a physical server?
What is a Resource Group in Azure?
What is a Network Security Group (NSG)?
What is RDP and what port does it use?
What is the difference between a public IP and a private IP?
What is the Azure free tier and what are its limits?
What is Azure Monitor? (awareness level)

Your Windows Server is running and accessible from your Mac. Next up, you will install the monitoring stack on it.

Install the Monitoring Stack on Windows

Your Windows Server VM is live and you can see the Windows desktop from your Mac. That's the foundation in place.

Now it's time to install the three tools that form your monitoring stack. windows_exporter collects metrics from Windows. Prometheus stores those metrics over time. Grafana turns the data into visual dashboards you can monitor at a glance.

Why self-hosted Prometheus and Grafana?

Cloud-hosted monitoring tools like Grafana Cloud abstract away the data collection layer. Self-hosting teaches you the full pipeline: how metrics get collected, stored, and visualized.

Infrastructure interviews expect you to explain how each piece connects. Running the stack yourself gives you that hands-on understanding.

In this step, get ready to:

Install windows_exporter to collect Windows metrics.
Install and configure Prometheus to scrape and store those metrics.
Install Grafana to visualize your server's health.

Install windows_exporter on your VM

Your monitoring stack needs raw data about the server's health. windows_exporter is a Prometheus exporter that collects CPU, memory, disk, and network metrics from Windows and makes them available over HTTP.

On your Windows VM, open a web browser (Microsoft Edge is pre-installed on the taskbar).
Navigate to the windows_exporter releases page.
Scroll down to the Assets section.
Click the file named windows_exporter-0.31.6-amd64.msi to download it.
Once the download completes, open the downloaded .msi file to run the installer.
Click through the installer prompts, accepting all the defaults.

What does the MSI installer do?

The MSI installer sets up windows_exporter as a Windows Service, which means it starts automatically every time the server boots. It also creates a firewall exception on port 9182 so that Prometheus can reach the metrics endpoint.

Now verify that windows_exporter is running and collecting metrics.

Open a new browser tab on the VM.
Type http://localhost:9182/metrics in the address bar and press Enter.

You should see a page full of text with lines starting with windows_. These are the raw metrics that windows_exporter collects from your server.

Don't see the metrics page?

Double-check the URL is exactly http://localhost:9182/metrics with no typos.
Open Windows Services by pressing the Windows key, typing services.msc, and pressing Enter. Look for "windows_exporter" in the list and confirm its Status column shows "Running".
If the service is stopped, right-click it and select Start.

I installed windows_exporter but can't see metrics at localhost:9182. How do I fix this?

Install and configure Prometheus

Prometheus is the engine that pulls metrics from windows_exporter and stores them over time. You'll download it, write a configuration file that tells it where to find your metrics, and start it up.

On your VM, open a browser and go to the Prometheus download page.
Find the Operating System dropdown and select windows.
Download prometheus-3.11.3.windows-amd64.zip.

The download is a zip file that you need to extract to a specific location on the C: drive.

Open File Explorer and navigate to your Downloads folder.
Right-click the downloaded zip file and select Extract All.
Set the destination to C:\ and click Extract.
After extraction, you will see a folder named prometheus-3.11.3.windows-amd64 inside C:\.
Right-click that folder, select Rename, and change the name to prometheus so the final path is C:\prometheus.

Prometheus needs a configuration file that tells it where to find your metrics. The default config that comes with the download points to Prometheus itself, so you need to replace it.

Open the file C:\prometheus\prometheus.yml in Notepad by right-clicking it and selecting Open with, then Notepad.
Select all the existing text with Ctrl+A and delete it.
Paste the following configuration:

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: "windows"
    static_configs:
      - targets: ["localhost:9182"]
        labels:
          instance: "monitoring-vm"

What does this configuration do?

scrape_interval: 15s tells Prometheus to collect metrics every 15 seconds.
job_name: "windows" names this collection target so you can identify it in the Prometheus UI.
targets: ["localhost:9182"] points Prometheus to the windows_exporter running on the same machine.
instance: "monitoring-vm" adds a friendly label to your metrics so you can filter by server name.

Save the file by pressing Ctrl+S.

✔️ Awesome, I've got everything!

Great. Make sure you saved prometheus.yml before moving on.

ⓧ I'd like to double check the full code

Here is the complete prometheus.yml file for comparison.

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: "windows"
    static_configs:
      - targets: ["localhost:9182"]
        labels:
          instance: "monitoring-vm"

Now start Prometheus so it begins collecting metrics from windows_exporter.

Press the Windows key on your keyboard and type PowerShell.
Right-click Windows PowerShell and select Run as administrator.
Start Prometheus by running these commands:

cd C:\prometheus
.\prometheus.exe

What happens when you run this?

Prometheus starts in the foreground and begins scraping metrics from windows_exporter every 15 seconds. You will see log output scrolling in the PowerShell window.

Keep this PowerShell window open for the rest of the project. Closing it stops Prometheus.

Open a new browser tab on the VM and go to http://localhost:9090.
Click Status in the top navigation bar.
Click Targets.

You should see one target listed under the "windows" job. The State column shows UP in green, which means Prometheus is successfully scraping metrics from windows_exporter.

Target shows DOWN or is missing?

Make sure windows_exporter is still running. Open services.msc and confirm "windows_exporter" shows a status of "Running".
Verify your prometheus.yml has the correct target: localhost:9182.
If you edited the config after starting Prometheus, stop it in PowerShell with Ctrl+C and run .\prometheus.exe again.

My Prometheus target shows DOWN. How do I troubleshoot this?

Install Grafana

Grafana is the visualization layer of your monitoring stack. It connects to Prometheus, runs queries, and displays the results as dashboard panels you can monitor in real time.

On your VM, open a browser and go to the Grafana download page.
Under Edition, make sure OSS (open source) is selected.
Select Windows as the operating system.
Download the Windows .msi installer.
Run the downloaded .msi file and click through the installer prompts, accepting all the defaults.

What does the Grafana installer do?

The installer sets up Grafana as a Windows Service that starts automatically. It listens on port 3000 by default. You do not need to start Grafana manually.

Open a new browser tab on the VM and go to http://localhost:3000.
Enter admin in the Email or username field.
Enter admin in the Password field.
Click Log in.
Grafana prompts you to change the default password. Enter a new password and click Submit.

Remember your new Grafana password

Write down the password you chose. You will need it to log back into Grafana if your browser session expires.

You should see the Grafana home screen with a welcome banner. All three monitoring tools are now running on your server.

Can't reach localhost:3000?

Grafana may take up to a minute to start after installation. Wait 30 seconds and refresh the page.
Open Services (services.msc) and look for "Grafana". If its status shows "Stopped", right-click it and select Start.

Grafana won't load at localhost:3000 after installing. What should I check?

Practice your interview answers

You just installed three monitoring tools and learned how they connect. Interviewers for infrastructure roles ask about these exact concepts.

For each question below, think about how you would answer using what you did in this step. Write down 2-3 sentence answers in your own words, referencing your actual project experience.

Why practice now?

You will compile all your answers into a formal interview prep document in Step 5. Practicing after each step keeps your experience fresh and your answers specific.

Windows systems questions:

What are Windows Services? How do you start, stop, or restart one?
What is the difference between a process and a service?
What is PowerShell and how is it different from Command Prompt?
What is Task Manager and how do you check CPU/memory usage?
What is Event Viewer and when would you use it?

Try answering these before checking the sample responses.

✔️ I'll give it a go!

Use phrases like "In my project, I..." or "When I installed the monitoring stack, I..." to ground every answer in what you actually did.

ⓧ Maybe a little help...

Windows Services: "Windows Services are background programs that run without a user interface. I installed windows_exporter as a service. I can manage services by opening services.msc, right-clicking a service, and selecting Start, Stop, or Restart."
Process vs Service: "A process is any running program. A service is a special type of process that runs in the background, starts automatically with Windows, and does not need a user to be logged in. windows_exporter and Grafana both run as services on my VM."
PowerShell: "I used PowerShell to run Prometheus. PowerShell is more powerful than Command Prompt. It supports scripting, pipelines, and can manage Windows systems. Command Prompt only runs basic DOS commands."
Task Manager: "Task Manager shows running processes and real-time CPU, memory, disk, and network usage. I can open it with Ctrl+Shift+Esc. The Performance tab shows overall system health, which is what my Grafana dashboard also monitors but with historical data."
Event Viewer: "Event Viewer (eventvwr.msc) shows Windows system logs including errors, warnings, and informational events. If a service crashes or a login fails, it gets logged there. I would check Event Viewer when troubleshooting an issue that does not appear in Prometheus metrics."

Monitoring concepts questions:

What is infrastructure monitoring and why does it matter?
What is an exporter in Prometheus? How does scraping work?
What is the difference between a metric and a log?
What is a port? Why does Grafana use 3000, Prometheus 9090, and windows_exporter 9182?
What is a firewall rule and why did windows_exporter need one?
What is TCP vs UDP?

Give these a try on your own before looking at the sample responses.

✔️ I'll give it a go!

Remember to reference your actual setup. Mention the specific tools, ports, and configurations you used.

ⓧ Maybe a little help...

Infrastructure monitoring: "Infrastructure monitoring tracks the health of servers, networks, and cloud resources. In my project, I monitor CPU, memory, disk, and network. Without monitoring, you only find problems when users complain. With monitoring, you catch issues before they affect users."
Exporters and scraping: "An exporter is a program that collects metrics from a system and exposes them on an HTTP endpoint. windows_exporter collects Windows metrics and exposes them at localhost:9182/metrics. Prometheus scrapes (pulls) those metrics every 15 seconds based on my prometheus.yml configuration."
Metric vs log: "A metric is a numerical measurement at a point in time, like CPU at 45% right now. A log is a text record of an event, like 'User azureuser logged in at 10:30 AM'. Prometheus collects metrics. Tools like Loki or the Windows Event Viewer handle logs."
Ports: "A port is a number that identifies a specific service on a computer. Different tools use different ports so they do not conflict. Grafana uses 3000, Prometheus uses 9090, and windows_exporter uses 9182. These are configurable defaults."
Firewall rules: "A firewall blocks unauthorized network traffic. The windows_exporter MSI installer created a firewall exception so Prometheus can reach port 9182. Without it, Prometheus could not scrape the metrics."
TCP vs UDP: "TCP is a reliable protocol that guarantees delivery. It is used for HTTP, RDP, and most monitoring traffic. UDP is faster but does not guarantee delivery. It is used for DNS lookups and video streaming. All my monitoring tools use TCP."

Your monitoring stack is fully installed and collecting data. Next up, you'll connect Grafana to Prometheus and build a dashboard that shows your server's CPU, memory, disk, and network metrics in real time.

Build Your Infrastructure Dashboard

Your monitoring stack is installed and collecting data. Prometheus is pulling metrics from windows_exporter every 15 seconds, but right now those numbers are just raw text on a page.

In this step, you will connect Grafana to Prometheus and build a real-time dashboard with four panels. Each panel tracks a critical server health metric: CPU, memory, disk, and network.

In this step, get ready to:

Connect Prometheus as a data source in Grafana.
Create a dashboard with four monitoring panels using PromQL queries.
Save your dashboard and explore live metrics at different time ranges.

Add Prometheus as a data source

Grafana needs to know where to pull its data from. A data source tells Grafana which database to query when you build panels and dashboards.

In your Windows VM browser, go to http://localhost:3000 to open Grafana (if it is not already open).
In the left sidebar, click Connections.
Click Data sources.
Click Add data source.
Select Prometheus from the list.
In the Prometheus server URL field, enter http://localhost:9090.
Scroll to the bottom and click Save & test.

You should see a green banner that says "Successfully queried the Prometheus API".

What is a data source in Grafana?

A data source is the connection between Grafana and a database. Grafana supports many data sources like Prometheus, InfluxDB, and Elasticsearch.

You configured Prometheus at localhost:9090 because both Grafana and Prometheus are running on the same VM. Grafana will send PromQL queries to Prometheus whenever you load a dashboard panel.

Seeing a red error instead of green?

Make sure the URL is exactly http://localhost:9090 with no trailing slash. Check that Prometheus is still running in your PowerShell window.

If the PowerShell window was closed, reopen it as Administrator and run Prometheus again from C:\prometheus.

Help me troubleshoot my Prometheus data source connection in Grafana

Create your dashboard with four panels

A dashboard is a collection of panels arranged on a single page. Each panel runs a PromQL query against Prometheus and displays the result as a graph.

You will create four panels covering the four key server health metrics: CPU, memory, disk, and network.

In the left sidebar, click Dashboards.
Click New and select New Dashboard.
On the empty dashboard, click + Add visualization.
Select Prometheus as the data source.

The panel editor opens. This is where you write your PromQL query and configure the visualization.

What is PromQL?

PromQL stands for Prometheus Query Language. It is purpose-built for querying time-series data.

You write PromQL expressions to calculate things like "average CPU usage over the last minute" or "percentage of disk space used". Each panel on your dashboard runs a PromQL query and visualizes the result as a graph.

Your first panel will track CPU usage.

In the panel editor, switch to Code mode by clicking the Code button next to Builder at the top of the query section.
Enter the following PromQL query for CPU usage:

100 - (avg(rate(windows_cpu_time_total{mode="idle"}[1m])) * 100)

What does this query do?

The windows_cpu_time_total metric tracks how much time each CPU core spends in different modes like idle, user, and privileged. The rate() function calculates the per-second rate of change over a 1-minute window.

By filtering for mode="idle" and subtracting from 100, you get the percentage of CPU time that is actively doing work.

Click Run queries (or press Shift+Enter) to see the graph populate with data.
In the Panel options section on the right side, change the Title to CPU Usage %.
Confirm the visualization type is set to Time series (this is the default).
Click Apply in the top-right corner to add the panel to your dashboard.

You should see a line graph showing your VM's CPU usage over time.

Now create the second panel for memory usage.

On your dashboard, click Add in the top bar and select Visualization.
Select Prometheus as the data source.
Switch to Code mode and enter this PromQL query:

100 - (windows_memory_available_bytes / windows_memory_physical_total_bytes * 100)

What does this query do?

The windows_memory_available_bytes metric is how much physical memory is currently free. The windows_memory_physical_total_bytes metric is the total installed RAM.

Dividing available by total gives the free percentage. Subtracting from 100 gives you the used percentage.

Click Run queries to see the graph populate.
Set the Title to Memory Usage.
Confirm the visualization type is Time series.
Click Apply.

Two panels down, two to go. Next is disk space.

Click Add in the top bar and select Visualization.
Select Prometheus as the data source.
Switch to Code mode and enter this PromQL query:

100 - (windows_logical_disk_free_bytes{volume="C:"} / windows_logical_disk_size_bytes{volume="C:"} * 100)

What does this query do?

The windows_logical_disk_free_bytes metric tells you how many bytes are free on a volume. The windows_logical_disk_size_bytes metric is the total size.

The volume="C:" label filter limits the query to the C: drive only. Subtracting the free percentage from 100 gives the used percentage.

Click Run queries to verify data appears.
Set the Title to Disk Space Used.
Confirm the visualization type is Time series.
Click Apply.

One more panel to go. The last one tracks incoming network traffic.

Click Add in the top bar and select Visualization.
Select Prometheus as the data source.
Switch to Code mode and enter this PromQL query:

rate(windows_net_bytes_received_total[1m])

What does this query do?

The windows_net_bytes_received_total metric is a counter that tracks the total bytes received by each network interface. Counters only go up, so you use rate() to convert the ever-increasing total into a per-second throughput value.

The [1m] range tells Prometheus to look at the last 1 minute of data to calculate the rate.

Click Run queries to verify data appears.
Set the Title to Network Bytes Received.
Confirm the visualization type is Time series.
Click Apply.

Your dashboard now has four panels. Grafana arranges them in rows by default.

Drag the panels to arrange them in a 2x2 grid: CPU and Memory on the top row, Disk and Network on the bottom row.
Resize each panel by dragging its bottom-right corner so all four panels fit evenly on screen.

Seeing "No data" on a panel?

Check that you are in Code mode (not Builder) when pasting queries. Builder mode can misinterpret raw PromQL.

Also verify that Prometheus is selected as the data source at the top of the query section. If Prometheus itself is not running, you will see no data on all panels. Check your PowerShell window to confirm Prometheus is still active.

Help me debug my Grafana panel that shows no data

Save and explore your dashboard

Your four panels are showing live data from the VM. Save the dashboard so you do not lose your work.

Click the save icon (disk icon) in the top-right corner of the dashboard.
Enter Windows Server Health as the dashboard name.
Click Save.

Your dashboard is saved. Now explore how the time range changes what you see.

In the top-right corner, click the time range picker (it shows "Last 6 hours" by default).
Select Last 15 minutes and watch the graphs zoom into recent data.
Change the time range to Last 1 hour to see a broader view.

Why do time ranges matter?

In real monitoring, you use short ranges (15 minutes) to troubleshoot active incidents. You use longer ranges (1 hour, 1 day, 1 week) to spot trends like gradually increasing memory usage or disk space slowly filling up.

This is the same workflow you would use daily as an operations analyst. Open the dashboard, check for anomalies, and drill into specific time windows when something looks off.

What about the interview questions for this step?

This project includes interview preparation questions at the end. The questions for this step cover dashboards, PromQL, time-series databases, data sources, key server metrics, and device onboarding. You will write your answers in Step 5 when you create your Interview Preparation Document.

Your dashboard is live and showing the four most critical server health metrics. Next up, you will configure alert rules that automatically detect when CPU or disk metrics cross dangerous thresholds.

Configure Alerts and Tune for Noise Reduction

Your dashboard gives you a window into your server's health, but only when you are actively looking at it. If CPU spikes at 2 AM, nobody is watching the dashboard.

Alerts solve this problem by watching your metrics around the clock. In this step, you will create two alert rules in Grafana that fire when CPU usage stays too high or disk space runs too low. You will also tune these alerts to ignore brief spikes and write an operational runbook documenting everything.

In this step, get ready to:

Create alert rules for high CPU usage and low disk space.
Tune alert thresholds with evaluation intervals and pending periods to reduce noise.
Write an operational runbook documenting your monitoring setup.

Create a high CPU alert rule

Your first alert will detect sustained high CPU usage. A brief spike is normal, but if CPU stays above 80% for five straight minutes, something needs attention.

In Grafana at http://localhost:3000, click Alerts & IRM in the left sidebar.
Click Alert rules.
Click + New alert rule.

What is an alert rule?

An alert rule tells Grafana when to raise an alarm. It includes a PromQL query, a threshold condition, and timing settings that control how often the rule is checked and how long the condition must persist before firing.

In the Rule name field at the top, enter High CPU Usage.
Scroll down to the Define query and condition section.
Select Prometheus as the data source.
In the query editor, click the Code button (next to Builder) to switch to code mode.
Enter this PromQL query:

100 - (avg by (instance) (irate(windows_cpu_time_total{mode="idle"}[2m])) * 100)

What does this query do?

The windows_cpu_time_total metric tracks how much time the CPU spends in each mode (idle, user, interrupt, etc.). This query calculates the rate of idle time over the last 2 minutes, converts it to a percentage, and subtracts from 100.

The result is the percentage of time the CPU is busy. A value of 85 means the CPU is working 85% of the time.

In the Alert condition section below the query, set the threshold to IS ABOVE 80.
Scroll down to the Set folder and labels section.
Click + New folder and enter Infrastructure alerts.
Scroll down to the Set evaluation behavior section.
Click + New evaluation group.
Enter cpu-alerts as the evaluation group name.
Set the Evaluation interval to 1m.
Set the Pending period to 5m.

What is the pending period?

The pending period is how long the condition must be continuously true before the alert fires. Grafana checks the CPU query every 1 minute. If CPU is above 80%, the alert enters a Pending state.

Only after 5 consecutive minutes above the threshold does the alert transition to Firing. This prevents a brief 30-second CPU spike from triggering a false alarm.

At the top right of the page, click Save rule and exit.

You should see your High CPU Usage rule listed on the Alert rules page with its current state.

Don't see the Save button?

Make sure you have selected a folder for the alert rule. Grafana requires a folder before it lets you save. Select the Infrastructure alerts folder you created, or use any existing folder.

Help me save my alert rule in Grafana.

Create a low disk space alert rule

Your second alert detects when disk space drops dangerously low. A server that runs out of disk space can crash without warning, so this alert gives you time to act.

On the Alert rules page, click + New alert rule again.
In the Rule name field, enter Low Disk Space.
In the Define query and condition section, select Prometheus as the data source.
Switch to Code mode and enter this PromQL query:

100 * windows_logical_disk_free_bytes{volume="C:"} / windows_logical_disk_size_bytes{volume="C:"}

What does this query do?

This query divides the free bytes on the C: drive by the total drive size, then multiplies by 100 to get the percentage of free space remaining.

When this number drops below 20, only 20% of the disk is free. That means the disk is getting dangerously full.

In the Alert condition section, set the threshold to IS BELOW 20.
In the Set folder and labels section, select the Infrastructure alerts folder you created earlier.
Scroll down to the Set evaluation behavior section.
Click + New evaluation group.
Enter disk-alerts as the evaluation group name.
Set the Evaluation interval to 5m.
Set the Pending period to 10m.

Why is the pending period longer for disk space?

Disk space changes more slowly than CPU spikes. A 10-minute pending period prevents alerts from firing during temporary disk operations like Windows updates or log rotation that consume space before cleaning up.

The evaluation group also checks less frequently (every 5 minutes instead of 1). Disk space does not fluctuate as rapidly as CPU, so checking every 5 minutes is more than sufficient.

Click Save rule and exit.

You should now see both High CPU Usage and Low Disk Space listed on your Alert rules page.

Alert showing as Pending immediately?

If your CPU alert enters the Pending state right away, that means CPU is currently above 80%. On a B1S VM with limited resources, this can happen during normal operations. The alert will not transition to Firing until the condition persists for the full 5-minute pending period.

Help me understand my alert states in Grafana.

Write your operational runbook

A runbook is a documented procedure that any team member can follow when an alert fires. Instead of relying on one person's memory, it walks through exactly what to check and who to contact.

On your Windows VM desktop, right-click an empty area.
Select New, then Text Document.
Rename the file to Monitoring_Runbook.txt.
Double-click the file to open it in Notepad.
Copy the following runbook content into the file:

===========================================
INFRASTRUCTURE MONITORING RUNBOOK
===========================================
Last Updated: [[TODAYS_DATE="today's date"]]
Author: [[YOUR_NAME="your name"]]

WHAT IS MONITORED
-----------------
Server: monitoring-vm (Azure B1S Windows Server 2022)
Metrics: CPU usage, Memory usage, Disk space, Network throughput

TOOL ACCESS
-----------
Grafana Dashboard: http://localhost:3000
  Username: admin
  Dashboard: Windows Server Health

Prometheus: http://localhost:9090
  Targets page: http://localhost:9090/targets

Windows Exporter Metrics: http://localhost:9182/metrics

ALERT RULES
-----------
1. High CPU Usage
   Threshold: Above 80% for 5 continuous minutes
   Evaluation: Every 1 minute
   Action: Check Task Manager for high-CPU processes.

2. Low Disk Space
   Threshold: Below 20% free space for 10 continuous minutes
   Evaluation: Every 5 minutes
   Action: Check disk usage with File Explorer. Run Disk Cleanup if needed.

ESCALATION
----------
Level 1: Check this runbook and attempt resolution
Level 2: Escalate to infrastructure team lead
Level 3: Escalate to senior systems administrator

TROUBLESHOOTING
---------------
Problem: Prometheus target shows DOWN
Solution: Open services.msc, find windows_exporter, check if running. If stopped, right-click and Start.

Problem: Grafana shows No data
Solution: Check Prometheus at http://localhost:9090. Check data source in Grafana.

Problem: Alert firing too frequently
Solution: Increase the For duration in the alert rule.

Why do teams write runbooks?

A runbook ensures that anyone on the team can respond to an incident, even at 3 AM. The documented procedure lists what to check, what thresholds mean, and who to escalate to if the problem persists.

In interviews, saying "I wrote a runbook covering alert thresholds, escalation steps, and troubleshooting procedures" shows real operational maturity. This is a deliverable you can reference directly.

Replace the placeholders for today's date and your name at the top of the file.
Save the file by pressing Ctrl+S.

Your runbook is now saved on the Desktop at C:\Users\azureuser\Desktop\Monitoring_Runbook.txt.

File saved as Monitoring_Runbook.txt.txt?

Windows sometimes hides file extensions and adds a second .txt when you rename. Open File Explorer, click the View tab, and check File name extensions to see the full filename. Remove the extra .txt if needed.

Help me fix my runbook filename on Windows.

✔️ Awesome, I've got everything!

Great. Double check you have saved the file before moving on.

ⓧ I'd like to double check the full code

Here is the complete runbook content. Make sure your file matches this exactly (apart from your name and date).

===========================================
INFRASTRUCTURE MONITORING RUNBOOK
===========================================
Last Updated: [Today's Date]
Author: [Your Name]

WHAT IS MONITORED
-----------------
Server: monitoring-vm (Azure B1S Windows Server 2022)
Metrics: CPU usage, Memory usage, Disk space, Network throughput

TOOL ACCESS
-----------
Grafana Dashboard: http://localhost:3000
  Username: admin
  Dashboard: Windows Server Health

Prometheus: http://localhost:9090
  Targets page: http://localhost:9090/targets

Windows Exporter Metrics: http://localhost:9182/metrics

ALERT RULES
-----------
1. High CPU Usage
   Threshold: Above 80% for 5 continuous minutes
   Evaluation: Every 1 minute
   Action: Check Task Manager for high-CPU processes.

2. Low Disk Space
   Threshold: Below 20% free space for 10 continuous minutes
   Evaluation: Every 5 minutes
   Action: Check disk usage with File Explorer. Run Disk Cleanup if needed.

ESCALATION
----------
Level 1: Check this runbook and attempt resolution
Level 2: Escalate to infrastructure team lead
Level 3: Escalate to senior systems administrator

TROUBLESHOOTING
---------------
Problem: Prometheus target shows DOWN
Solution: Open services.msc, find windows_exporter, check if running. If stopped, right-click and Start.

Problem: Grafana shows No data
Solution: Check Prometheus at http://localhost:9090. Check data source in Grafana.

Problem: Alert firing too frequently
Solution: Increase the For duration in the alert rule.

You now have a complete alerting setup with noise reduction and a documented runbook. Next up, you will compile all your interview questions into a single preparation document.

Create Your Interview Preparation Document

You now have a fully operational monitoring stack with alerts that fire intelligently, plus an operational runbook documenting everything.

In this final step, you will turn all of that hands-on experience into an interview weapon. You will create a single document containing 40 interview questions and answers, every one of them grounded in what you actually built. This is not textbook theory. These are real answers backed by real project work.

In this step, get ready to:

Create an interview preparation document on your Windows VM.
Write personalized answers for 40 interview questions across 6 categories.
Review and practice your answers aloud.

Create the document

Your interview prep document will live on the VM's Desktop, right next to your runbook. Every answer will reference something you built in this project.

On your Windows VM, click the search icon in the taskbar.
Type Notepad and press Enter to open it.
Type the following header into the blank document:

===========================================
INTERVIEW PREPARATION DOCUMENT
Infrastructure Monitoring & Operations Analyst
===========================================
Name: [Your Name]
Project: Monitor a Windows Server with Grafana and Prometheus on Azure
Date: [Today's Date]

What does this header include?

Replace [Your Name] with your actual name and [Today's Date] with today's date. This gives the document a professional structure that interviewers appreciate.

Click File, then Save As.
Navigate to the Desktop folder in the left sidebar.
Name the file Interview_Prep.txt and click Save.
Minimize Notepad and check the Desktop. You should see Interview_Prep.txt next to your Monitoring_Runbook.txt.

Organize and write your answers

Throughout this project, you encountered interview questions at the end of each step. Now you will consolidate all 38 of those questions into one document, organized into 5 categories.

The key is to write every answer in your own words. Use phrases like "In my project, I..." or "When I built my monitoring stack, I..." to ground each answer in your real experience.

First person makes all the difference

Interviewers can tell the difference between a memorized textbook answer and a real project answer. "I created a VM called monitoring-vm in Azure" is far more convincing than "A VM is a virtualized server."

Open Interview_Prep.txt in Notepad if it is not already open.
Below the header, add the Section 1 and Section 2 content. Use the example answers below as a starting point, then personalize them in your own words:

===========================================
SECTION 1: AZURE AND NETWORKING (Q1-Q7)
===========================================

Q1: What is a Virtual Machine and how is it different from a physical server?
A: I created a VM called monitoring-vm in Azure. It runs Windows Server 2022 but shares physical hardware with other VMs. Unlike a physical server, I can create, resize, or delete it in minutes from a browser.

Q2: What is a Resource Group in Azure?
A: When I created my VM, Azure automatically created a resource group containing the VM, its disk, network interface, public IP, and NSG. It is a logical container that groups related resources for easier management.

Q3: What is a Network Security Group (NSG)?
A: When I set up the VM, I allowed inbound RDP on port 3389. The NSG acts as a virtual firewall controlling what traffic can reach my VM. Without the RDP rule, I could not connect from my Mac.

Q4: What is RDP and what port does it use?
A: RDP is Remote Desktop Protocol, running on port 3389 by default. I used it to connect from my Mac to the Windows Server VM using the Windows App client.

Q5: What is the difference between a public IP and a private IP?
A: My VM has a public IP I used to connect from my Mac over the internet. It also has a private IP (like 10.0.0.4) only reachable within the Azure virtual network.

Q6: What is the Azure free tier and what are its limits?
A: Azure gives $200 credit for 30 days and 750 hours/month of B1S VMs free for 12 months. I used B1S specifically because it is free tier eligible.

Q7: What is Azure Monitor?
A: Azure Monitor is Microsoft's built-in observability service for collecting metrics and logs. In my project, I used Prometheus and Grafana because the job requires open-source monitoring tool experience.

===========================================
SECTION 2: WINDOWS SYSTEMS AND MONITORING (Q8-Q18)
===========================================

Q8: What are Windows Services? How do you manage them?
A: Windows Services are background programs that run without a user interface. I installed windows_exporter as a service. I manage services via services.msc by right-clicking to Start, Stop, or Restart.

Q9: What is the difference between a process and a service?
A: A process is any running program. A service is a special process that runs in the background, starts automatically, and does not need a logged-in user. windows_exporter and Grafana both run as services.

Q10: What is PowerShell and how is it different from Command Prompt?
A: I used PowerShell to run Prometheus. PowerShell supports scripting, pipelines, and system management. Command Prompt only runs basic DOS commands.

Q11: What is Task Manager and how do you check CPU/memory?
A: Task Manager (Ctrl+Shift+Esc) shows running processes and real-time CPU, memory, disk, and network usage. My Grafana dashboard monitors the same metrics but with historical data.

Q12: What is Event Viewer and when would you use it?
A: Event Viewer (eventvwr.msc) shows Windows system logs. If a service crashes or login fails, it gets logged there. I check it for issues not visible in Prometheus metrics.

Q13: What is infrastructure monitoring and why does it matter?
A: It tracks health of servers, networks, and cloud resources. I monitor CPU, memory, disk, and network. Without monitoring, you only find problems when users complain. With it, you catch issues proactively.

Q14: What is an exporter in Prometheus? How does scraping work?
A: An exporter collects metrics and exposes them on an HTTP endpoint. windows_exporter exposes metrics at localhost:9182/metrics. Prometheus pulls (scrapes) those every 15 seconds based on my prometheus.yml config.

Q15: What is the difference between a metric and a log?
A: A metric is a number at a point in time (CPU at 45%). A log is a text event record ("User logged in at 10:30"). Prometheus handles metrics. Event Viewer and tools like Loki handle logs.

Q16: What is a port? Why do different tools use different ports?
A: A port identifies a specific service on a computer. Grafana uses 3000, Prometheus 9090, windows_exporter 9182. Different ports prevent conflicts.

Q17: What is a firewall rule and why did windows_exporter need one?
A: A firewall blocks unauthorized traffic. The MSI installer created a firewall exception for port 9182 so Prometheus can reach the metrics endpoint.

Q18: What is TCP vs UDP?
A: TCP guarantees reliable delivery (used for HTTP, RDP, monitoring). UDP is faster but unreliable (used for DNS, video). All my monitoring tools use TCP.

Why two sections at once?

Sections 1 and 2 cover the foundational skills from your first two steps. They address the "tell me about your experience" questions that open most infrastructure interviews.

Read through each answer and adjust it to match your own experience. If you used a different admin username or hit a specific issue during setup, mention that. Authentic details stand out.

Press Ctrl+S to save your progress.
Below Section 2, add the Section 3 and Section 4 content:

===========================================
SECTION 3: DASHBOARDS AND PROMQL (Q19-Q24)
===========================================

Q19: What is a dashboard vs. an alert?
A: A dashboard is a visual display of metrics over time for trend analysis. An alert is an automated notification when a threshold is crossed. My dashboard shows CPU trends. My alert fires when CPU exceeds 80% for 5 minutes.

Q20: What is PromQL?
A: PromQL is Prometheus Query Language. I used it to write queries for each dashboard panel showing CPU, memory, disk, and network metrics.

Q21: What is a time-series database?
A: It stores data points indexed by timestamp. Prometheus stores my server metrics so I can view how CPU changed over the last hour, day, or week.

Q22: What is a data source in Grafana?
A: A data source is where Grafana pulls data from. I configured Prometheus at localhost:9090. Grafana also supports InfluxDB, Elasticsearch, and Azure Monitor.

Q23: What metrics matter most on a Windows server?
A: CPU (overloaded?), memory (running out of RAM?), disk space (filling up?), and network throughput (bottleneck?). These are my 4 dashboard panels.

Q24: How do you onboard a new device to monitoring?
A: Install the exporter on the device, add its IP:port as a target in prometheus.yml, reload Prometheus, and verify the target shows UP on the Targets page.

===========================================
SECTION 4: ALERTING AND OPERATIONS (Q25-Q30)
===========================================

Q25: What is a threshold? Give an example.
A: A threshold triggers an action when crossed. My CPU threshold is 80%. My disk threshold is 20% free. If crossed for the configured duration, the alert fires.

Q26: What does "alert noise" mean and how do you reduce it?
A: Alert noise is when alerts fire too often for non-critical issues. I reduced it with a "For" duration. CPU must stay above 80% for 5 continuous minutes before firing. Brief spikes are ignored.

Q27: What is the difference between "Evaluate every" and "For"?
A: "Evaluate every" is check frequency (every 1 minute). "For" is how long the condition must persist before firing (5 minutes). The alert only fires after 5 consecutive checks show high CPU.

Q28: What is a runbook?
A: A documented procedure for handling incidents. Mine lists monitored systems, tool URLs, thresholds, escalation steps, and troubleshooting procedures so anyone can respond.

Q29: What is an SLA?
A: Service Level Agreement. A commitment like 99.9% uptime. Monitoring proves SLA compliance. No alerts firing means the system is meeting its SLA.

Q30: What is SNMP?
A: Simple Network Management Protocol. An older protocol for monitoring network devices. Prometheus uses HTTP exporters instead. LogicMonitor supports both SNMP and HTTP.

What do these sections cover?

Section 3 covers the dashboard-building skills from Step 3. Section 4 covers the alerting and operational knowledge from Step 4. Together, they demonstrate you can build monitoring from scratch and manage it in production.

Press Ctrl+S to save your progress.
Below Section 4, add the Section 5 content. This section covers scenario-based troubleshooting questions:

===========================================
SECTION 5: TROUBLESHOOTING SCENARIOS (Q31-Q38)
===========================================

Q31: "A user reports the application is slow. What steps do you take?"
A: Check Grafana dashboard for CPU, memory, disk stress. If CPU is high, check Task Manager for the responsible process. If metrics are normal, investigate network or application-level issues.

Q32: "CPU is at 95%. What do you check first?"
A: Task Manager to identify the top process. Check if it is a scheduled task or unexpected. Check Grafana for sudden spike vs gradual trend. Spike means runaway process. Trend means resource shortage.

Q33: "Alert fires at 3 AM for low disk space. Walk me through your response."
A: Open runbook, connect via RDP, check disk usage, identify large files/temp folders, run Disk Cleanup. If disk is genuinely filling up, escalate to infrastructure team for root cause analysis.

Q34: "How to tell if a network issue is server-side or client-side?"
A: Check server network metrics in Grafana. If normal, issue is client-side or in between. Ping the server from client to check latency/packet loss. High server network usage means server saturation.

Q35: "Prometheus target shows DOWN. How do you troubleshoot?"
A: Check if windows_exporter is running in services.msc. If stopped, restart it. If running, check firewall on port 9182. Verify target URL in prometheus.yml. Check Prometheus logs for errors.

Q36: What is DNS and how does it work?
A: DNS translates domain names to IP addresses. portal.azure.com resolves to Azure's IP. If DNS fails, users cannot reach websites by name.

Q37: What is latency vs bandwidth?
A: Latency is travel time (milliseconds). Bandwidth is max data capacity. High latency makes RDP laggy. Low bandwidth makes file transfers slow.

Q38: What is the Windows Registry?
A: A database of Windows and application configuration settings. Changing wrong keys can break the system. Most monitoring tasks do not require registry edits.

Why are scenario questions so important?

Section 5 is where interviews get real. Interviewers describe a problem and ask how you would respond. Your answers reference the exact tools you used: your Grafana dashboard for metrics, Task Manager for processes, your runbook for escalation, and services.msc for service health.

Press Ctrl+S to save your progress.

Document getting long and hard to navigate?

Use Ctrl+F in Notepad to search for section headers or question numbers. If you accidentally deleted a line, press Ctrl+Z to undo.

Help me organize my interview prep document.

Add bonus questions and review

The final section contains two bonus questions that go beyond individual concepts. They test whether you understand the bigger picture of why you chose these tools and how you would scale the setup.

Below Section 5, add the final Section 6 content:

===========================================
SECTION 6: BONUS QUESTIONS (Q39-Q40)
===========================================

Q39: Why did you choose Prometheus and Grafana?
A: Industry-standard open-source tools. Prometheus uses a scalable pull-based model. Grafana supports multiple data sources. Experience transfers to enterprise tools like LogicMonitor.

Q40: What would you do differently for 50 servers instead of 1?
A: Add all as targets in prometheus.yml, organize dashboards by server groups, use Grafana variables for filtering, and set up email/Slack notification channels.

Why do these bonus questions matter?

Q39 shows you understand tool selection, not just tool usage. Q40 shows you can think beyond the scope of your project and reason about production-scale operations. These are the kinds of answers that separate candidates.

Press Ctrl+S to save the completed document.
Scroll through the entire document from top to bottom. You should see 6 clearly labeled sections containing 40 questions with first-person answers.
Read 3 to 5 of your answers out loud. Hearing yourself say the words helps you practice for the actual interview.

Personalize before your interview

Before any interview, revisit this document and tweak answers to match the specific job description. If the role mentions LogicMonitor, emphasize your Grafana dashboard experience as a direct parallel. If it mentions SLA compliance, highlight your alert tuning and runbook.

✔️ Awesome, I've got everything!

Make sure you have saved Interview_Prep.txt on your Desktop. You should have all 40 questions across 6 sections.

ⓧ I'd like to double check the full document

Here is the complete Interview_Prep.txt for reference. Compare your document against this and fill in anything you missed.

===========================================
INTERVIEW PREPARATION DOCUMENT
Infrastructure Monitoring & Operations Analyst
===========================================
Name: [Your Name]
Project: Monitor a Windows Server with Grafana and Prometheus on Azure
Date: [Today's Date]

===========================================
SECTION 1: AZURE AND NETWORKING (Q1-Q7)
===========================================

Q1: What is a Virtual Machine and how is it different from a physical server?
A: I created a VM called monitoring-vm in Azure. It runs Windows Server 2022 but shares physical hardware with other VMs. Unlike a physical server, I can create, resize, or delete it in minutes from a browser.

Q2: What is a Resource Group in Azure?
A: When I created my VM, Azure automatically created a resource group containing the VM, its disk, network interface, public IP, and NSG. It is a logical container that groups related resources for easier management.

Q3: What is a Network Security Group (NSG)?
A: When I set up the VM, I allowed inbound RDP on port 3389. The NSG acts as a virtual firewall controlling what traffic can reach my VM. Without the RDP rule, I could not connect from my Mac.

Q4: What is RDP and what port does it use?
A: RDP is Remote Desktop Protocol, running on port 3389 by default. I used it to connect from my Mac to the Windows Server VM using the Windows App client.

Q5: What is the difference between a public IP and a private IP?
A: My VM has a public IP I used to connect from my Mac over the internet. It also has a private IP (like 10.0.0.4) only reachable within the Azure virtual network.

Q6: What is the Azure free tier and what are its limits?
A: Azure gives $200 credit for 30 days and 750 hours/month of B1S VMs free for 12 months. I used B1S specifically because it is free tier eligible.

Q7: What is Azure Monitor?
A: Azure Monitor is Microsoft's built-in observability service for collecting metrics and logs. In my project, I used Prometheus and Grafana because the job requires open-source monitoring tool experience.

===========================================
SECTION 2: WINDOWS SYSTEMS AND MONITORING (Q8-Q18)
===========================================

Q8: What are Windows Services? How do you manage them?
A: Windows Services are background programs that run without a user interface. I installed windows_exporter as a service. I manage services via services.msc by right-clicking to Start, Stop, or Restart.

Q9: What is the difference between a process and a service?
A: A process is any running program. A service is a special process that runs in the background, starts automatically, and does not need a logged-in user. windows_exporter and Grafana both run as services.

Q10: What is PowerShell and how is it different from Command Prompt?
A: I used PowerShell to run Prometheus. PowerShell supports scripting, pipelines, and system management. Command Prompt only runs basic DOS commands.

Q11: What is Task Manager and how do you check CPU/memory?
A: Task Manager (Ctrl+Shift+Esc) shows running processes and real-time CPU, memory, disk, and network usage. My Grafana dashboard monitors the same metrics but with historical data.

Q12: What is Event Viewer and when would you use it?
A: Event Viewer (eventvwr.msc) shows Windows system logs. If a service crashes or login fails, it gets logged there. I check it for issues not visible in Prometheus metrics.

Q13: What is infrastructure monitoring and why does it matter?
A: It tracks health of servers, networks, and cloud resources. I monitor CPU, memory, disk, and network. Without monitoring, you only find problems when users complain. With it, you catch issues proactively.

Q14: What is an exporter in Prometheus? How does scraping work?
A: An exporter collects metrics and exposes them on an HTTP endpoint. windows_exporter exposes metrics at localhost:9182/metrics. Prometheus pulls (scrapes) those every 15 seconds based on my prometheus.yml config.

Q15: What is the difference between a metric and a log?
A: A metric is a number at a point in time (CPU at 45%). A log is a text event record ("User logged in at 10:30"). Prometheus handles metrics. Event Viewer and tools like Loki handle logs.

Q16: What is a port? Why do different tools use different ports?
A: A port identifies a specific service on a computer. Grafana uses 3000, Prometheus 9090, windows_exporter 9182. Different ports prevent conflicts.

Q17: What is a firewall rule and why did windows_exporter need one?
A: A firewall blocks unauthorized traffic. The MSI installer created a firewall exception for port 9182 so Prometheus can reach the metrics endpoint.

Q18: What is TCP vs UDP?
A: TCP guarantees reliable delivery (used for HTTP, RDP, monitoring). UDP is faster but unreliable (used for DNS, video). All my monitoring tools use TCP.

===========================================
SECTION 3: DASHBOARDS AND PROMQL (Q19-Q24)
===========================================

Q19: What is a dashboard vs. an alert?
A: A dashboard is a visual display of metrics over time for trend analysis. An alert is an automated notification when a threshold is crossed. My dashboard shows CPU trends. My alert fires when CPU exceeds 80% for 5 minutes.

Q20: What is PromQL?
A: PromQL is Prometheus Query Language. I used it to write queries for each dashboard panel showing CPU, memory, disk, and network metrics.

Q21: What is a time-series database?
A: It stores data points indexed by timestamp. Prometheus stores my server metrics so I can view how CPU changed over the last hour, day, or week.

Q22: What is a data source in Grafana?
A: A data source is where Grafana pulls data from. I configured Prometheus at localhost:9090. Grafana also supports InfluxDB, Elasticsearch, and Azure Monitor.

Q23: What metrics matter most on a Windows server?
A: CPU (overloaded?), memory (running out of RAM?), disk space (filling up?), and network throughput (bottleneck?). These are my 4 dashboard panels.

Q24: How do you onboard a new device to monitoring?
A: Install the exporter on the device, add its IP:port as a target in prometheus.yml, reload Prometheus, and verify the target shows UP on the Targets page.

===========================================
SECTION 4: ALERTING AND OPERATIONS (Q25-Q30)
===========================================

Q25: What is a threshold? Give an example.
A: A threshold triggers an action when crossed. My CPU threshold is 80%. My disk threshold is 20% free. If crossed for the configured duration, the alert fires.

Q26: What does "alert noise" mean and how do you reduce it?
A: Alert noise is when alerts fire too often for non-critical issues. I reduced it with a "For" duration. CPU must stay above 80% for 5 continuous minutes before firing. Brief spikes are ignored.

Q27: What is the difference between "Evaluate every" and "For"?
A: "Evaluate every" is check frequency (every 1 minute). "For" is how long the condition must persist before firing (5 minutes). The alert only fires after 5 consecutive checks show high CPU.

Q28: What is a runbook?
A: A documented procedure for handling incidents. Mine lists monitored systems, tool URLs, thresholds, escalation steps, and troubleshooting procedures so anyone can respond.

Q29: What is an SLA?
A: Service Level Agreement. A commitment like 99.9% uptime. Monitoring proves SLA compliance. No alerts firing means the system is meeting its SLA.

Q30: What is SNMP?
A: Simple Network Management Protocol. An older protocol for monitoring network devices. Prometheus uses HTTP exporters instead. LogicMonitor supports both SNMP and HTTP.

===========================================
SECTION 5: TROUBLESHOOTING SCENARIOS (Q31-Q38)
===========================================

Q31: "A user reports the application is slow. What steps do you take?"
A: Check Grafana dashboard for CPU, memory, disk stress. If CPU is high, check Task Manager for the responsible process. If metrics are normal, investigate network or application-level issues.

Q32: "CPU is at 95%. What do you check first?"
A: Task Manager to identify the top process. Check if it is a scheduled task or unexpected. Check Grafana for sudden spike vs gradual trend. Spike means runaway process. Trend means resource shortage.

Q33: "Alert fires at 3 AM for low disk space. Walk me through your response."
A: Open runbook, connect via RDP, check disk usage, identify large files/temp folders, run Disk Cleanup. If disk is genuinely filling up, escalate to infrastructure team for root cause analysis.

Q34: "How to tell if a network issue is server-side or client-side?"
A: Check server network metrics in Grafana. If normal, issue is client-side or in between. Ping the server from client to check latency/packet loss. High server network usage means server saturation.

Q35: "Prometheus target shows DOWN. How do you troubleshoot?"
A: Check if windows_exporter is running in services.msc. If stopped, restart it. If running, check firewall on port 9182. Verify target URL in prometheus.yml. Check Prometheus logs for errors.

Q36: What is DNS and how does it work?
A: DNS translates domain names to IP addresses. portal.azure.com resolves to Azure's IP. If DNS fails, users cannot reach websites by name.

Q37: What is latency vs bandwidth?
A: Latency is travel time (milliseconds). Bandwidth is max data capacity. High latency makes RDP laggy. Low bandwidth makes file transfers slow.

Q38: What is the Windows Registry?
A: A database of Windows and application configuration settings. Changing wrong keys can break the system. Most monitoring tasks do not require registry edits.

===========================================
SECTION 6: BONUS QUESTIONS (Q39-Q40)
===========================================

Q39: Why did you choose Prometheus and Grafana?
A: Industry-standard open-source tools. Prometheus uses a scalable pull-based model. Grafana supports multiple data sources. Experience transfers to enterprise tools like LogicMonitor.

Q40: What would you do differently for 50 servers instead of 1?
A: Add all as targets in prometheus.yml, organize dashboards by server groups, use Grafana variables for filtering, and set up email/Slack notification channels.

Secret mission

Add Windows Services Monitoring

Can you extend your monitoring dashboard to track whether critical Windows services are running or stopped? In infrastructure operations, a stopped service can cause outages before anyone notices. Your mission is to add a services panel, configure an alert for stopped services, and document everything in your runbook.

Before you go

Clean Up Your Resources

This project uses an Azure free tier B1S Windows VM, which is free for 750 hours per month for 12 months. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Cost warning

The Azure free tier gives you 750 hours per month of B1S VMs for 12 months. If your free tier expires or you exceed the 750-hour limit, Azure will start charging for the VM.

If you are not planning to use the VM again soon, choose Pause or Delete to avoid unexpected charges.

Resources you used:

Azure Resource Group (containing your VM, disk, network interface, public IP, and NSG).
Windows Server 2022 VM (monitoring-vm).
Prometheus installed at C:\prometheus.
windows_exporter installed as a Windows service.
Grafana installed as a Windows service on port 3000.
Monitoring_Runbook.txt and Interview_Prep.txt on the VM Desktop.
Windows App for Mac (RDP client).

Keep everything running

No action needed. Choose this if you are still actively building or plan to continue with another project on the same VM.

The B1S VM is free for 750 hours per month, which covers about 31 days of continuous running.
With Auto-shutdown enabled (configured in Step 1), you will stay well within the free tier limits.
Prometheus needs to be running in its PowerShell window to collect metrics. If you restart the VM, you will need to start Prometheus again from C:\prometheus.
Grafana and windows_exporter run as Windows services, so they start automatically when the VM boots.

Pause - I'll come back to this later

Stop the VM to deallocate its compute resources and pause all charges. Your files and installed software remain intact.

In the Azure portal, go to Virtual machines and select monitoring-vm.
Click Stop at the top of the VM overview page.
Wait for the status to change to Stopped (deallocated). This confirms the VM is no longer using compute resources.
To resume later, come back to the VM overview page and click Start. Your VM's public IP address may change, so copy the new one before reconnecting.

Delete - I don't want to use this again

Remove all project resources permanently. This deletes the VM, its disk, network configuration, public IP, and everything inside the resource group.

Before deleting, download your Interview_Prep.txt and Monitoring_Runbook.txt files from the VM to your Mac. You can copy the text and paste it into a local file.
In the Azure portal, search for Resource groups in the top search bar.
Select the resource group that was created with your VM.
Click Delete resource group at the top of the page.
Type the resource group name to confirm, then click Delete. This removes the VM, disk, network, and public IP permanently.
Optionally, remove the Windows App from your Mac if you no longer need it.

Mission accomplished

That's a Wrap!

Nice work! You just built a professional infrastructure monitoring stack and a battle-tested interview preparation document.

You've learned how to:

Deploy a Windows Server 2022 VM in Azure and install a complete Prometheus + windows_exporter + Grafana monitoring stack.
Build a real-time Grafana dashboard with four panels tracking CPU, memory, disk, and network metrics, plus configure alert rules with tuning to reduce noise.
Write an operational runbook and create an interview preparation document with 40+ questions and answers grounded in your hands-on project experience.
Secret Mission: Add Windows Services monitoring to track whether critical services like Windows Update and DNS Client are running or stopped.

Ready to quiz yourself?