You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/purview/how-to-monitor-with-azure-monitor.md
+32-78Lines changed: 32 additions & 78 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -67,90 +67,44 @@ The following table contains the list of metrics available to explore in the Azu
67
67
| Scan Failed | Automated scan | Sum <br> Count | Aggregate the failed data source scans over time period |
68
68
| Scan time taken | Automated scan | Min <br> Max <br> Sum <br> Avg | Aggregate the total time taken by scans over time period |
69
69
70
-
## Diagnostic Logs to Azure Storage account
70
+
## Sending Diagnostic Logs
71
71
72
-
Raw telemetry events are emitted to Azure Monitor. Events can be logged to a customer storage account of choice for further analysis. Exporting of logs is done via the Diagnostic settings for the Microsoft Purview account on the Azure portal.
72
+
Raw telemetry events are emitted to Azure Monitor. Events can be sent to a Log Analytics Workspace, archived to a customer storage account of choice, streamed to an event hub or sent to a partner solution for further analysis. Exporting of logs is done via the Diagnostic settings for the Microsoft Purview account on the Azure portal.
73
73
74
-
Follow the steps to create a Diagnostic setting for your Microsoft Purview account.
74
+
Follow the steps to create a Diagnostic setting for your Microsoft Purview account and send to your preferred destination.
75
75
76
-
1. Create a new diagnostic setting to collect platform logs and metrics by following this article: [Create diagnostic settings to send platform logs and metrics to different destinations](../azure-monitor/essentials/diagnostic-settings.md). Select the destination only as Azure storage account.
76
+
1. Create a new diagnostic setting to collect platform logs and metrics by following this article: [Create diagnostic settings to send platform logs and metrics to different destinations](../azure-monitor/essentials/diagnostic-settings.md).
2. Select the destination to a log analytics workspace to send the event to. Create a name for the diagnostic setting, select the applicable log category group and select the right subscription and workspace, then click save. The workspace doesn't have to be in the same region as the resource being monitored. Follow this article to [Create a New Log Analytics Workspace](..//services-hub/health/log_analytics_workspace).
Verify the changes in **Log Analytics Workspace** by perfoming some operations to populate data such as creating/updating/deleting policy. After which you can open the **Log Analytics Workspace**, navigate to **Logs**, enter query filter as **"purviewsecuritylogs"**, then click **"Run"** to execute the query.
88
+
89
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-two-two-diagnostic-setting.png" alt-text="Screenshot showing log results in the Log Analytics Workspace after an query was run." lightbox="./media/how-to-monitor-with-azure-monitor/step-two-otwo-diagnostic-setting.png":::
90
+
91
+
#### Destination - Storage account
92
+
3. To log the events to a storage account; create a diagnostic setting name, select the log category,. select the destination as archieve to a storage account, select the right subscription and storage account then click save. A dedicated storage account is recommended for archiving the diagnostic logs. Following this article to [Create a storage account](../storage/common/storage-account-create.md?tabs=azure-portal).
To see logs in the **Storage Account**, create/update/delete a policy, then open the **Storage Account**, navigate to **Containers**, and click on the container name
99
+
100
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-two-diagnostic-setting.png" alt-text="Screenshot showing container in storage account where the diagnostic logs have been sent to." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-two-diagnostic-setting.png":::
101
+
102
+
Navigate to the flie and download it to see the logs
103
+
104
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-three-diagnostic-setting.png" alt-text="Screenshot showing folders with details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-three-diagnostic-setting.png":::
105
+
106
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-four-diagnostic-setting.png" alt-text="Screenshot showing details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-four-diagnostic-setting.png":::
79
107
80
-
2. Log the events to a storage account. A dedicated storage account is recommended for archiving the diagnostic logs. Following this article to [Create a storage account](../storage/common/storage-account-create.md?tabs=azure-portal).
Allow up to 15 minutes to start receiving logs in the newly created storage account. [See data retention and schema of resource logs in Azure Storage account](../azure-monitor/essentials/resource-logs.md#send-to-azure-storage). Once the diagnostic logs are configured, the events flow to the storage account.
85
-
86
-
### ScanStatusLogEvent
87
-
88
-
The event tracks the scan life cycle. A scan operation follows progress through a sequence of states, from Queued, Running and finally a terminal state of Succeeded | Failed | Canceled. An event is logged for each state transition and the schema of the event will have the following properties.
89
-
90
-
```JSON
91
-
{
92
-
"time": "<The UTC time when the event occurred>",
93
-
"properties": {
94
-
"dataSourceName": "<Registered data source friendly name>",
95
-
"dataSourceType": "<Registered data source type>",
96
-
"scanName": "<Scan instance friendly name>",
97
-
"assetsDiscovered": "<If the resultType is succeeded, count of assets discovered in scan run>",
98
-
"assetsClassified": "<If the resultType is succeeded, count of assets classified in scan run>",
99
-
"scanQueueTimeInSeconds": "<If the resultType is succeeded, total seconds the scan instance in queue>",
100
-
"scanTotalRunTimeInSeconds": "<If the resultType is succeeded, total seconds the scan took to run>",
101
-
"runType": "<How the scan is triggered>",
102
-
"errorDetails": "<Scan failure error>",
103
-
"scanResultId": "<Unique GUID for the scan instance>"
104
-
},
105
-
"resourceId": "<The azure resource identifier>",
106
-
"category": "<The diagnostic log category>",
107
-
"operationName": "<The operation that cause the event Possible values for ScanStatusLogEvent category are:
108
-
|AdhocScanRun
109
-
|TriggeredScanRun
110
-
|StatusChangeNotification>",
111
-
"resultType": "Queued – indicates a scan is queued.
112
-
Running – indicates a scan entered a running state.
113
-
Succeeded – indicates a scan completed successfully.
114
-
Failed – indicates a scan failure event.
115
-
Cancelled – indicates a scan was cancelled. ",
116
-
"resultSignature": "<Not used for ScanStatusLogEvent category. >",
117
-
"resultDescription": "<This will have an error message if the resultType is Failed. >",
118
-
"durationMs": "<Not used for ScanStatusLogEvent category. >",
119
-
"level": "<The log severity level. Possible values are:
120
-
|Informational
121
-
|Error >",
122
-
"location": "<The location of the Microsoft Purview account>",
123
-
}
124
-
```
125
-
126
-
The Sample log for an event instance is shown in the below section.
0 commit comments