You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/purview/how-to-monitor-with-azure-monitor.md
+83-11Lines changed: 83 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,40 +75,112 @@ Follow the steps to create a Diagnostic setting for your Microsoft Purview accou
75
75
76
76
Create a new diagnostic setting to collect platform logs and metrics by following this article: [Create diagnostic settings to send platform logs and metrics to different destinations](../azure-monitor/essentials/diagnostic-settings.md).
Select the destination to a log analytics workspace to send the event to. Create a name for the diagnostic setting, select the applicable log category group and select the right subscription and workspace, then click save. The workspace doesn't have to be in the same region as the resource being monitored. Follow this article to [Create a New Log Analytics Workspace](../azure-monitor/logs/quick-create-workspace.md).
84
+
85
+
### Destination - Log Analytics Workspace
86
+
87
+
Select the destination to a log analytics workspace to send the event to. Create a name for the diagnostic setting, select the applicable log category group and select the right subscription and workspace, then select save. The workspace doesn't have to be in the same region as the resource being monitored. Follow this article to [Create a New Log Analytics Workspace](../azure-monitor/logs/quick-create-workspace.md).
Verify the changes in **Log Analytics Workspace** by perfoming some operations to populate data such as creating/updating/deleting policy. After which you can open the **Log Analytics Workspace**, navigate to **Logs**, enter query filter as **"purviewsecuritylogs"**, then click**"Run"** to execute the query.
93
+
Verify the changes in **Log Analytics Workspace** by performing some operations to populate data such as creating/updating/deleting policy. After which you can open the **Log Analytics Workspace**, navigate to **Logs**, enter query filter as **"purviewsecuritylogs"**, then select**"Run"** to execute the query.
92
94
93
95
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-two-two-diagnostic-setting.png" alt-text="Screenshot showing log results in the Log Analytics Workspace after a query was run." lightbox="./media/how-to-monitor-with-azure-monitor/step-two-two-diagnostic-setting.png":::
94
96
95
-
#### Destination - Storage account
96
-
To log the events to a storage account; create a diagnostic setting name, select the log category,. select the destination as archieve to a storage account, select the right subscription and storage account then click save. A dedicated storage account is recommended for archiving the diagnostic logs. Following this article to [Create a storage account](../storage/common/storage-account-create.md?tabs=azure-portal).
97
+
### Destination - Storage account
98
+
99
+
To log the events to a storage account; create a diagnostic setting name, select the log category, select the destination as archive to a storage account, select the right subscription and storage account then select save. A dedicated storage account is recommended for archiving the diagnostic logs. Following this article to [Create a storage account](../storage/common/storage-account-create.md?tabs=azure-portal).
To see logs in the **Storage Account**, create/update/delete a policy, then open the **Storage Account**, navigate to **Containers**, and click on the container name
104
+
105
+
To see logs in the **Storage Account**, create/update/delete a policy, then open the **Storage Account**, navigate to **Containers**, and select the container name
103
106
104
107
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-two-diagnostic-setting.png" alt-text="Screenshot showing container in storage account where the diagnostic logs have been sent to." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-two-diagnostic-setting.png":::
105
108
106
-
Navigate to the flie and download it to see the logs
109
+
Navigate to the file and download it to see the logs
107
110
108
111
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-three-diagnostic-setting.png" alt-text="Screenshot showing folders with details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-three-diagnostic-setting.png":::
109
112
110
113
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-four-diagnostic-setting.png" alt-text="Screenshot showing details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-four-diagnostic-setting.png":::
111
114
115
+
## Sample Log
116
+
117
+
The event tracks the scan life cycle. A scan operation follows progress through a sequence of states, from Queued, Running and finally a terminal state of Succeeded | Failed | Canceled. An event is logged for each state transition and the schema of the event will have the following properties.
118
+
119
+
```JSON
120
+
{
121
+
"time": "<The UTC time when the event occurred>",
122
+
"properties": {
123
+
"dataSourceName": "<Registered data source friendly name>",
124
+
"dataSourceType": "<Registered data source type>",
125
+
"scanName": "<Scan instance friendly name>",
126
+
"assetsDiscovered": "<If the resultType is succeeded, count of assets discovered in scan run>",
127
+
"assetsClassified": "<If the resultType is succeeded, count of assets classified in scan run>",
128
+
"scanQueueTimeInSeconds": "<If the resultType is succeeded, total seconds the scan instance in queue>",
129
+
"scanTotalRunTimeInSeconds": "<If the resultType is succeeded, total seconds the scan took to run>",
130
+
"runType": "<How the scan is triggered>",
131
+
"errorDetails": "<Scan failure error>",
132
+
"scanResultId": "<Unique GUID for the scan instance>"
133
+
},
134
+
"resourceId": "<The azure resource identifier>",
135
+
"category": "<The diagnostic log category>",
136
+
"operationName": "<The operation that cause the event Possible values for ScanStatusLogEvent category are:
137
+
|AdhocScanRun
138
+
|TriggeredScanRun
139
+
|StatusChangeNotification>",
140
+
"resultType": "Queued – indicates a scan is queued.
141
+
Running – indicates a scan entered a running state.
142
+
Succeeded – indicates a scan completed successfully.
143
+
Failed – indicates a scan failure event.
144
+
Cancelled – indicates a scan was cancelled. ",
145
+
"resultSignature": "<Not used for ScanStatusLogEvent category. >",
146
+
"resultDescription": "<This will have an error message if the resultType is Failed. >",
147
+
"durationMs": "<Not used for ScanStatusLogEvent category. >",
148
+
"level": "<The log severity level. Possible values are:
149
+
|Informational
150
+
|Error >",
151
+
"location": "<The location of the Microsoft Purview account>",
152
+
}
153
+
```
154
+
155
+
The Sample log for an event instance is shown in the below section.
0 commit comments