The first monitoring on a new cloud account should not be a dashboard. It should be four alerts that tell you when money, access, capacity or availability go wrong, in that order. Dashboards come later, when there is history to look at. This guide lists what to set up in the first hour after provisioning, why the order matters, and what thresholds make sense before you have any baseline, using Azure and Vultr as examples of a hyperscaler and a developer-focused provider.
Alert 1: the bill
Runaway cost is the most common first incident on a new account, and it is silent. Set a budget alert before creating anything else. Azure provides budgets with email and action-group notifications under Cost Management; Vultr lets you set billing alerts in the control panel. Choose a threshold that is embarrassingly low, such as twice what you expect to spend in the first month, and raise it as real usage becomes clear.
If the account carries a credit balance, such as the Azure $1k Credit Account or the Vultr $250 Credit Account listed on the marketplace, alert on the remaining balance as well, because credits running out mid-month is its own surprise. The cost control guide covers the full set of spending guardrails.
Alert 2: who did what
Activity logs record every control-plane action: who created a server, who changed a firewall rule, who generated an API key. Azure’s Activity Log captures subscription-level events; Vultr keeps account activity in its panel and exposes actions through its API. Turn logging on, ship it somewhere durable, and alert on a short list of high-risk events.
- New user, role assignment or API key created
- MFA disabled or recovery details changed
- Firewall or security group opened to the internet
- Resource deleted in production
- Sign-in from an unfamiliar location
These alerts are your early warning for a compromised credential, which is why the security baseline puts them alongside MFA.
Alert 3: host capacity
Install a metrics agent on every server and collect the basics: CPU, memory, disk space, disk I/O wait and network. Azure Monitor collects these for virtual machines; on Vultr, most teams use an open-source agent shipping to a hosted or self-run collector. Without a baseline, use conservative static thresholds and tune them after a few weeks.
| Metric | Starting threshold | Why |
|---|---|---|
| Disk space | Alert at 80 percent used | Full disks cause the strangest failures |
| Memory | Alert on sustained swap use | Swapping precedes an out-of-memory kill |
| CPU | Alert above 90 percent for 15 minutes | Brief spikes are normal; sustained load is not |
| I/O wait | Alert when consistently high | Points to a storage-bound workload |
These thresholds also feed right-sizing decisions later; see choosing instance sizes.
Alert 4: is it up
An external uptime check from outside the provider’s network is the only alert that sees what your users see. Check the public endpoint every minute or two from at least two locations, and alert after two consecutive failures to avoid noise. Include a check that exercises the application, not just a TCP port: a health endpoint that touches the database is worth far more than a ping.
Route alerts to a human
Every alert above needs a destination someone reads. Email is fine for billing; a paging channel is needed for uptime and security. Decide who is on call, even if the answer is “the founder, always,” and write it down.
What to leave for month two
Application performance monitoring, distributed tracing, log analytics and custom dashboards all have value, and none of them belong in the first hour. Add them once the four alerts have been quiet for a few weeks and you know what normal looks like. The exception is structured application logging, which is cheap to add early and painful to retrofit.
Provider notes
On Azure, Cost Management budgets, Activity Log alerts and Azure Monitor cover the first three items natively; the Buy Azure Account listings range from the Azure Pay-As-you-Go Account to large credit tiers, and all expose the same tooling. On Vultr, billing alerts and account activity live in the control panel, and host metrics need an agent; the Buy Vultr Account page lists three credit balances that give room to run the agent stack while you tune thresholds.
