Merge pull request #9405 from MicrosoftDocs/main

Auto push to live 2025-07-23 18:07:43

Author: Simonx Xu

support/azure/azure-monitor/activity-logs/config-export/troubleshoot-activity-log-download-issues.md

@@ -0,0 +1,44 @@
+---
+title: Troubleshoot Activity Log Download Issues
+description: Troubleshooting guide for Azure activity log download issues
+ms.date: 07/22/2025
+ms.reviewer: v-liuamson; v-gsitser
+ms.service: azure-monitor
+ms.custom: I can’t configure export of Activity Logs
+---
+
+# Troubleshooting activity log download issues
+
+When users try to download activity logs from Microsoft Azure, they might receive error messages that indicate that the CSV file wasn't prepared. This issue often occurs if the requested logs exceed a certain volume and cause the process to fail. Understanding the root cause and implementing the right solutions can help resolve this issue efficiently.
+
+## Common issues and solutions
+
+- **Issue**: The download process fails because an excessive number of logs are requested. This activity generates a "file not found" error.
+- **Solution**: Reduce the range of time during which logs are requested to minimize the volume and prevent errors.
+
+### Instructions to resolve download failures
+
+1. Check the error message to verify that it relates to the CSV file preparation failure.
+2. Navigate to the Azure portal, and access the **Activity Logs** section. Reduce the time range that you're trying to download logs for. This change can help decrease the number of logs that are processed.
+3. Clear your browser cache to make sure that no outdated data is causing issues.
+4. If possible, break down the log requests into smaller batches to avoid overwhelming the system.
+5. Make sure that the storage account where the logs are stored is reachable and correctly configured.
+
+## FAQ: Azure activity log download
+
+**Q1: Why does the download fail?**
+
+**A1:** The download might fail if the number of requested logs is excessive and prevents the system from being able to process the logs.
+
+**Q2: How can I avoid download failures?**
+
+**A2:** To avoid this issue, prevent the system from being overwhelmed. To do this, reduce the time range for the download, and request logs in smaller batches.
+
+## References
+
+- [Azure Activity Logs Overview](/azure/azure-monitor/essentials/activity-log)
+- [Azure Storage documentation](/azure/storage/)
+- [Azure Monitor documentation](/azure/azure-monitor/)
+- [Azure portal guide](/azure/azure-portal/)
+
+If the issue persists after you follow these steps, open a support case for further assistance.

support/azure/azure-monitor/activity-logs/config-export/troubleshoot-export-of-audit-logs-to-another-tenant.md

@@ -0,0 +1,46 @@
+---
+title: Troubleshoot Export of Audit Logs to Another Tenant
+description: This article provides guidance to resolve permissions-related errors when you export audit logs to another tenant.
+ms.date: 07/22/2025
+ms.reviewer: v-liuamson; v-gsitser
+ms.service: azure-monitor
+ms.custom: I can’t configure export of Activity Logs
+---
+
+# Troubleshoot export of audit logs to another tenant
+
+When users try to export audit logs from one tenant to another by using Microsoft Azure Lighthouse, they might experience permissions-related errors. This article provides guidance to resolve these issues.
+
+## Common issues and solutions
+
+- **Issue**: Permissions errors occur when a user configures diagnostic settings for exporting audit logs.
+- **Root cause**: The user lacks the required permissions on the target workspace or has an incorrect role assignment.
+
+### Instructions to resolve export issues
+
+1. Verify the user's permissions:
+   1. Make sure that the user has the necessary permissions to perform actions on the target workspace.
+   1. Navigate to the Azure portal, and check the user's role assignments in the **Access Control (IAM)** section.
+
+2. Reset the guest invitation:
+   1. If the user is a guest, reset the invitation status to ensure proper linkage between home and resource tenants.
+   1. Follow the steps in [Reset Guest Invitation Status](/entra/external-id/reset-redemption-status).
+
+3. Check the role assignments:
+   1. Verify that the user has the appropriate roles assigned, such as **Log Analytics Contributor** or **Reader**.
+   1. Use the Azure portal to assign roles, if it's necessary.
+
+4. Review ARM template role definitions:
+   1. Make sure that the ARM template that's used for deployment specifies the correct `RoleDefinitionId` value.
+   1. Adjust the template as necessary to include the required permissions.
+
+5. Test the configuration:
+   1. Test the configuration to make sure that logs are exported successfully.
+   1. Monitor the Azure activity logs for any more error messages or warnings.
+
+## References
+
+- [Manage Access to Log Analytics workspaces](/azure/azure-monitor/logs/manage-access?tabs=portal#workspace-permissions)
+- [Azure role assignments](/azure/role-based-access-control/role-assignments-portal)
+
+If the issue persists after you follow these steps, open a support case for further assistance.

support/azure/azure-monitor/activity-logs/config-export/understanding-and-managing-diagnostic-settings-retention.md

@@ -0,0 +1,45 @@
+---
+title: Understanding and Managing Diagnostic Settings Retention
+description: Provides guidance for understanding and managing diagnostic settings retention.
+ms.date: 07/22/2025
+ms.reviewer: v-liuamson; v-gsitser
+ms.service: azure-monitor
+ms.custom: I can’t configure export of Activity Logs
+---
+
+# Understanding and managing diagnostic settings retention
+
+When you manage Azure resources, you might experience issues that are related to the transition from diagnostic settings storage retention to Azure Storage lifecycle management. This article provides guidance to handle these issues effectively.
+
+## Common issues and solutions
+
+- **Issue**: Users might notice that templates aren't displayed when they try to verify resources that are affected by the transition from legacy solutions to diagnostic settings.
+- **Root cause**: The automatic switch from activity log solutions to diagnostic settings might cause confusion if users don't fully understand diagnostic settings retention.
+
+### Instructions to resolve diagnostic settings issues
+
+1. Determine how resources are affected:
+   1. Navigate to the Azure portal > **All Services**.
+   1. Select **Resource Manager**.
+   1. Select **Deploy**, and then select **Templates** in the left pane.
+   1. Check whether any resources are affected by the transition.
+
+2. To determine whether legacy solutions are in use, run the following PowerShell command:
+
+     ```powershell
+     $WorkspaceName = Get-AzOperationalInsightsWorkspace
+     foreach ($Name in $WorkspaceName) {
+         Get-AzOperationalInsightsDataSource -Kind AzureActivityLog -ResourceGroupName $Name.ResourceGroupName -WorkspaceName $Name.Name
+     }
+     ```
+
+   If no output is returned, legacy solutions aren't in use, and no further action is required.
+
+3. Understand that the transition to diagnostic settings is automatic. If your environment is already using diagnostic settings, no additional steps are necessary.
+
+## References
+
+- [Azure Monitor activity logs](/azure/azure-monitor/platform/activity-log?tabs=powershell#legacy-collection-methods)
+- [Azure Storage lifecycle management](/azure/storage/blobs/storage-lifecycle-management-concepts)
+
+If the issue persists after you follow these steps, open a support case for further assistance.

support/azure/azure-monitor/toc.yml

@@ -17,10 +17,16 @@ items:
         href: activity-logs/config-export/exporting-directory-level-activity-logs-to-event-hub.md
       - name: Resolving Log Limit Issues in Azure Function Apps
         href: activity-logs/config-export/resolving-log-limit-issues-in-azure-function-apps.md
+      - name: Understanding and Managing Diagnostic Settings Retention
+        href: activity-logs/config-export/understanding-and-managing-diagnostic-settings-retention.md  
       - name: Centralized Configuration of Activity Logs to Event Hub
         href: activity-logs/config-export/centralized-configuration-of-activity-logs-to-event-hub.md
       - name: Troubleshoot Azure CLI Configuration Issues
         href: activity-logs/config-export/troubleshoot-azure-cli-configuration-issues.md
+      - name: Troubleshoot Export of Audit Logs to Another Tenant
+        href: activity-logs/config-export/troubleshoot-export-of-audit-logs-to-another-tenant.md
+      - name: Troubleshoot Activity Log Download Issues
+        href: activity-logs/config-export/troubleshoot-activity-log-download-issues.md
 - name: Application Insights
   items:
   - name: OpenTelemetry troubleshooting