Merge pull request #289230 from normesta/monitoring-2

Updating monitoring log reference fields

Author: AnnaMHuff

articles/storage/blobs/monitor-blob-storage-reference.md

@@ -1,7 +1,7 @@
 ---
 title: Monitoring data reference for Azure Blob Storage
 description: This article contains important reference material you need when you monitor Azure Blob Storage.
-ms.date: 08/27/2024
+ms.date: 11/05/2024
 ms.custom: horz-monitor
 ms.topic: reference
 author: normesta
@@ -62,12 +62,15 @@ For the metrics supporting dimensions, you need to specify the dimension value t
 
 The following sections describe the properties for Azure Storage resource logs when they're collected in Azure Monitor Logs or Azure Storage. The properties describe the operation, the service, and the type of authorization that was used to perform the operation.
 
+> [!NOTE]
+> The field names listed in each section below are valid when resource logs are sent to Azure storage or to an event hub. When the logs are sent to a Log Analytics workspace, the field names might be different.
+
 ### Fields that describe the operation
 
 ```json
 {
     "time": "2019-02-28T19:10:21.2123117Z",
-    "resourceId": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/mytestrp/providers/Microsoft.Storage/storageAccounts/testaccount1/blobServices/default",
+    "resourceId": "/subscriptions/00001111-aaaa-2222-bbbb-3333cccc4444/resourceGroups/mytestrp/providers/Microsoft.Storage/storageAccounts/testaccount1/blobServices/default",
     "category": "StorageWrite",
     "operationName": "PutBlob",
     "operationVersion": "2017-04-17",
@@ -76,7 +79,7 @@ The following sections describe the properties for Azure Storage resource logs w
     "statusText": "Success",
     "durationMs": 5,
     "callerIpAddress": "192.168.0.1:11111",
-    "correlationId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    "correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd",
     "location": "uswestcentral",
     "uri": "http://mystorageaccount.blob.core.windows.net/cont1/blobname?timeout=10"
 }
@@ -92,17 +95,17 @@ The following sections describe the properties for Azure Storage resource logs w
         "authorization": [
             {
                 "action": "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
-                "denyAssignmentId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+                "denyAssignmentId": "aaaa0000-bb11-2222-33cc-444444dddddd",
                 "principals": [
                     {
-                        "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+                        "id": "aaaaaaaa-bbbb-cccc-1111-222222222222",
                         "type": "User"
                     }
                 ],
                 "reason": "Policy",
                 "result": "Granted",
-                "roleAssignmentId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
-                "roleDefinitionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+                "roleAssignmentId": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
+                "roleDefinitionId": "11bb11bb-cc22-dd33-ee44-55ff55ff55ff",
                 "type": "RBAC"
             }
         ],
@@ -111,12 +114,18 @@ The following sections describe the properties for Azure Storage resource logs w
             "objectKey": "/samplestorageaccount/samplecontainer/sampleblob.png"
            },
         "requester": {
-            "appId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+            "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
             "audience": "https://storage.azure.com/",
-            "objectId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
-            "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
-            "tokenIssuer": "https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+            "objectId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
+            "tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
+            "tokenIssuer": "https://sts.windows.net/2c2c2c2c-3333-dddd-4444-5e5e5e5e5e5e",
+            "uniqueName": "[email protected]"
            },
+        "delegatedResource": {
+            "tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
+            "resourceId": "a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1",
+            "objectId": "a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1"
+          },
         "type": "OAuth"
     },
 }
@@ -130,10 +139,10 @@ The following sections describe the properties for Azure Storage resource logs w
 ```json
 {
     "properties": {
-        "accountName": "testaccount1",
-        "requestUrl": "https://testaccount1.blob.core.windows.net:443/upload?restype=container&comp=list&prefix=&delimiter=/&marker=&maxresults=30&include=metadata&_=1551405598426",
+        "accountName": "contoso",
+        "requestUrl": "https://contoso.blob.core.windows.net:443/upload?restype=container&comp=list&prefix=&delimiter=/&marker=&maxresults=30&include=metadata&_=1551405598426",
         "userAgentHeader": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134",
-        "referrerHeader": "blob:https://portal.azure.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+        "referrerHeader": "blob:https://portal.azure.com/00001111-aaaa-2222-bbbb-3333cccc4444",
         "clientRequestId": "",
         "etag": "",
         "serverLatencyMs": 63,
@@ -157,7 +166,11 @@ The following sections describe the properties for Azure Storage resource logs w
         "smbFileId" : " 0x9223442405598953",
         "smbSessionID" : "0x8530280128000049",
         "smbCommandMajor" : "0x6",
-        "smbCommandMinor" : "DirectoryCloseAndDelete"
+        "smbCommandMinor" : "DirectoryCloseAndDelete",
+        "downloadRange" : "bytes=4-4194307",
+        "accessTier": "None",
+        "sourceAccessTier": "Hot",
+        "rehydratePriority":"High"
     }
 }
 ```

includes/azure-storage-logs-properties-authentication.md

@@ -2,7 +2,7 @@
  author: normesta
  ms.service: storage
  ms.topic: include
- ms.date: 05/26/2023
+ ms.date: 11/05/2024
  ms.author: normesta
 ---
 
@@ -28,3 +28,8 @@
 |**requester / tokenIssuer** | The OAuth token issuer. <br> For example: `https://sts.windows.net/72f988bf-86f1-41af-91ab-222222222222/`.|
 |**requester / upn** | The User Principal Name (UPN) of requestor. <br> For example: `[email protected]`. |
 |**requester / userName** | This field is reserved for internal use only.|
+|**requester / uniqueName** | The unique name of the requester. For example: `[email protected]`. |
+|**delegatedResource / tenantId**| The Microsoft Entra tenant ID of the Azure resource ID which accesses storage on-behalf-of the storage resource owner (for example: `aaaabbbb-0000-cccc-1111-dddd2222eeee`). |
+|**delegatedResource / resourceId**|The Azure resource ID which accesses storage on behalf of the storage resource owner (for example: `/subscriptions/<sub>/resourcegroups/<rg>/providers/Microsoft.Compute/virtualMachines/<vm-name>`)|
+|**delegatedResource / objectId**|The Microsoft Entra object ID of the Azure resource ID which accesses storage on behalf of the storage resource owner (for example: `aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb`).|
+

includes/azure-storage-logs-properties-service.md

@@ -2,7 +2,7 @@
  author: normesta
  ms.service: storage
  ms.topic: include
- ms.date: 09/28/2020
+ ms.date: 10/25/2024
  ms.author: normesta
 ---
 
@@ -36,4 +36,8 @@
 |**smbFileId** | The **FileId** associated with the file or directory.  Roughly analogous to an NTFS FileId. For example: `0x9223442405598953` |
 |**smbSessionID** | The SMB2 **SessionId** established at session setup time. For example: `0x8530280128000049` |
 |**smbCommandMajor	uint32** | Value in the **SMB2_HEADER.Command**. Currently, this is a number between 0 and 18 inclusive. For example: `0x6` |
-|**smbCommandMinor** | The subclass of **SmbCommandMajor**, where appropriate. For example: `DirectoryCloseAndDelete` |
+|**smbCommandMinor** | The subclass of **SmbCommandMajor**, where appropriate. For example: `DirectoryCloseAndDelete` |
+|**accessTier**|The access tier of an existing blob when an operation such as `GetBlob` or `GetBlobProperties` is used (for example: `Hot`). Can also be the access tier provided in the `x-ms-access-tier` header for operations such as `SetBlobTier`, `PutBlob`, `PutBlockList`, or `CopyBlob`. |
+|**sourceAccessTier**|The access tier of the source blob of a copy operation (for example: `Hot`).|
+|**rehydrationPriority**|The priority used to rehydrate an archived blob (for example: `High` or `Standard`).|
+|**downloadRange**|Indicates that only a part of the blob (the specified byte range) was requested and transferred. For example, if the value of `downloadRange` field is `bytes=0-1023`, then the request retrieved the first `1024` bytes of the blob (from byte offset 0 to 1023).|