|
1 | 1 | --- |
2 | 2 | title: Centralized Configuration of Activity Logs to Event Hub |
3 | | -description: Step-by-step guidance on how to set up Azure Activity Logs to be centrally exported to a single Event Hub. |
| 3 | +description: Provides guidance to set up Azure Activity Logs to be centrally exported to a single Event Hub. |
4 | 4 | ms.date: 07/17/2025 |
5 | 5 | ms.reviewer: v-liuamson; v-gsitser |
6 | 6 | ms.service: azure-monitor |
7 | 7 | ms.custom: I can’t configure export of Activity Logs |
8 | 8 | --- |
9 | 9 |
|
10 | | -# Centralized Configuration of Activity Logs to Event Hub |
| 10 | +# Centralized Configuration of Aactivity Logs to Event Hub |
11 | 11 |
|
12 | 12 | ## Introduction |
13 | 13 |
|
14 | | -This article provides guidance on setting up Azure Activity Logs to be centrally exported to a single Event Hub. This setup is useful for organizations looking to streamline log management across multiple Azure subscriptions and forward logs to third-party SIEM solutions. |
| 14 | +This article provides guidance for setting up Azure Activity Logs to be centrally exported to a single hub in Azure Event Hubs. This setup is useful for organizations that want to streamline log management across multiple Azure subscriptions and forward logs to third-party SIEM solutions. |
15 | 15 |
|
16 | | -Organizations often require a centralized approach to manage Activity Logs across numerous subscriptions. This guide outlines the steps to configure Azure Policies to automate the streaming of these logs to a specified Event Hub, addressing common challenges and considerations. |
| 16 | +Organizations often require a centralized approach to manage Activity Logs across numerous subscriptions. This guide discusses common challenges and considerations for configuring Azure Policies to automate streaming these logs to a specified event hub. |
17 | 17 |
|
18 | | -## Step-by-Step Instructions to Configure Activity Logs |
| 18 | +## Instructions to configure Activity Logs |
19 | 19 |
|
20 | 20 | 1. **Create an Azure Policy for Activity Logs:** |
21 | | - - Navigate to the Azure portal and access the **Azure Policy** service. |
22 | | - - Create a new policy definition using the JSON provided in the community example. This policy should automate the enablement of activity log diagnostics settings across all subscriptions under a management group. |
| 21 | + - Navigate to the Azure portal, and access the **Azure Policy** service. |
| 22 | + - Create a policy definition by using the JSON file that's provided in the community example. This policy should automate the enablement of activity log diagnostic settings across all subscriptions under a management group. |
23 | 23 |
|
24 | 24 | 2. **Assign the Policy to Management Group:** |
25 | | - - Assign the newly created policy to the desired management group containing the required subscriptions. |
26 | | - - Ensure that the policy is set to send data to the specified Event Hub. |
| 25 | + - Assign the newly created policy to the desired management group that contains the required subscriptions. |
| 26 | + - Make sure that the policy is set to send data to the specified Event Hub. |
27 | 27 |
|
28 | 28 | 3. **Configure Log Analytics Workspace:** |
29 | | - - Access the **Log Analytics Workspace** in the Azure portal. |
30 | | - - Set up data export rules to forward logs from the Log Analytics Workspace to the Event Hub. Specify the source table as `AzureActivity` and the destination as the central Event Hub. |
| 29 | + - Access **Log Analytics Workspace** in the Azure portal. |
| 30 | + - Set up data export rules to forward logs from the Log Analytics Workspace to the event hub. Specify the source table as `AzureActivity` and the destination as the central event hub. |
31 | 31 |
|
32 | | -4. **Verify Event Hub Configuration:** |
33 | | - - Ensure the Event Hub is configured to handle the expected log volume from all subscriptions. |
34 | | - - Review performance benchmarks and adjust the Event Hub tier if necessary to manage logs efficiently. |
| 32 | +4. **Verify event hub configuration:** |
| 33 | + - Make sure that the event hub is configured to handle the expected log volume from all subscriptions. |
| 34 | + - Review performance benchmarks and adjust the event hub tier if it's necessary to manage logs efficiently. |
35 | 35 |
|
36 | | -5. **Monitor and Adjust:** |
37 | | - - Regularly monitor the Event Hub's performance and log flow. |
38 | | - - Adjust configurations as needed to optimize performance and cost. |
| 36 | +5. **Monitor and adjust:** |
| 37 | + - Regularly monitor the event hub performance and log flow. |
| 38 | + - Adjust configurations as neecessary to optimize performance and cost. |
39 | 39 |
|
40 | | -## Common Issues and Solutions |
| 40 | +## Common issues and solutions |
41 | 41 |
|
42 | | -- **Performance Concerns:** If the Event Hub struggles with the log volume, consider upgrading the tier or distributing logs across multiple hubs. |
43 | | -- **Policy Limitations:** Azure Policy may require manual steps for each subscription. Ensure all configurations are correctly applied. |
| 42 | +- **Performance concerns:** If the event hub experiences difficulty in handling the log volume, consider upgrading the tier or distributing logs across multiple hubs. |
| 43 | +- **Policy Limitations:** Azure Policy might require manual steps for each subscription. Make sure that all configurations are correctly applied. |
44 | 44 |
|
45 | 45 | ## Reference |
46 | 46 |
|
47 | 47 | - [Azure Policy Assignment to Enable Activity Log on Subscription](https://learn.microsoft.com/azure/policy-assignment-to-enable-activity-log-on-subscription) |
48 | 48 | - [Azure Event Hubs Overview](https://learn.microsoft.com/azure/event-hubs/event-hubs-about) |
49 | 49 |
|
50 | | -If the issue persists after following the solution steps, please open a support case for further assistance. |
| 50 | +If the issue persists after you follow these steps, open a support case for further assistance. |
0 commit comments