You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -69,45 +69,123 @@ The following table contains the list of metrics available to explore in the Azu
69
69
70
70
## Sending Diagnostic Logs
71
71
72
-
Raw telemetry events are emitted to Azure Monitor. Events can be sent to a Log Analytics Workspace, archived to a customer storage account of choice, streamed to an event hub or sent to a partner solution for further analysis. Exporting of logs is done via the Diagnostic settings for the Microsoft Purview account on the Azure portal.
72
+
Raw telemetry events are sent to Azure Monitor. Events can be sent to a Log Analytics Workspace, archived to a customer storage account of choice, streamed to an event hub, or sent to a partner solution for further analysis. Exporting of logs is done via the Diagnostic settings for the Microsoft Purview account on the Azure portal.
73
73
74
-
Follow the steps to create a Diagnostic setting for your Microsoft Purview account and send to your preferred destination.
74
+
Follow these steps to create a diagnostic setting for your Microsoft Purview account and send to your preferred destination:
75
75
76
-
Create a new diagnostic setting to collect platform logs and metrics by following this article: [Create diagnostic settings to send platform logs and metrics to different destinations](../azure-monitor/essentials/diagnostic-settings.md).
76
+
1. Locate your Microsoft Purview account in the [Azure portal](https://portal.azure.com).
77
+
1. In the menu under **Monitoring** select **Diagnostic settings**.
78
+
1. Select **Add diagnostic setting** to create a new diagnostic setting to collect platform logs and metrics. For more information about these settings and logs, see [the Azure Monitor documentation.](../azure-monitor/essentials/diagnostic-settings.md).
Select the destination to a log analytics workspace to send the event to. Create a name for the diagnostic setting, select the applicable log category group and select the right subscription and workspace, then click save. The workspace doesn't have to be in the same region as the resource being monitored. Follow this article to [Create a New Log Analytics Workspace](../azure-monitor/logs/quick-create-workspace.md).
Verify the changes in **Log Analytics Workspace** by perfoming some operations to populate data such as creating/updating/deleting policy. After which you can open the **Log Analytics Workspace**, navigate to **Logs**, enter query filter as **"purviewsecuritylogs"**, then click **"Run"** to execute the query.
92
-
93
-
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-two-two-diagnostic-setting.png" alt-text="Screenshot showing log results in the Log Analytics Workspace after a query was run." lightbox="./media/how-to-monitor-with-azure-monitor/step-two-two-diagnostic-setting.png":::
94
-
95
-
#### Destination - Storage account
96
-
To log the events to a storage account; create a diagnostic setting name, select the log category,. select the destination as archieve to a storage account, select the right subscription and storage account then click save. A dedicated storage account is recommended for archiving the diagnostic logs. Following this article to [Create a storage account](../storage/common/storage-account-create.md?tabs=azure-portal).
To see logs in the **Storage Account**, create/update/delete a policy, then open the **Storage Account**, navigate to **Containers**, and click on the container name
103
-
104
-
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-two-diagnostic-setting.png" alt-text="Screenshot showing container in storage account where the diagnostic logs have been sent to." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-two-diagnostic-setting.png":::
105
-
106
-
Navigate to the flie and download it to see the logs
107
-
108
-
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-three-diagnostic-setting.png" alt-text="Screenshot showing folders with details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-three-diagnostic-setting.png":::
109
86
110
-
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/step-three-four-diagnostic-setting.png" alt-text="Screenshot showing details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/step-three-four-diagnostic-setting.png":::
87
+
### Destination - Log Analytics Workspace
88
+
89
+
1. In the **Destination details**, select **Send to Log Analytics workspace**.
90
+
1. Create a name for the diagnostic setting, select the applicable log category group and select the right subscription and workspace, then select save. The workspace doesn't have to be in the same region as the resource being monitored. You to create a new workspace, you can follow this article: [Create a New Log Analytics Workspace](../azure-monitor/logs/quick-create-workspace.md).
1. Verify the changes in your Log Analytics Workspace by performing some operations to populate data. For example, creating/updating/deleting a policy. After which you can open the **Log Analytics Workspace**, navigate to **Logs**, enter query filter as **"purviewsecuritylogs"**, then select **"Run"** to execute the query.
97
+
98
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/log-analytics-view-logs-diagnostic-setting.png" alt-text="Screenshot showing log results in the Log Analytics Workspace after a query was run." lightbox="./media/how-to-monitor-with-azure-monitor/log-analytics-view-logs-diagnostic-setting.png":::
99
+
100
+
### Destination - Storage account
101
+
102
+
1. In the **Destination details**, select **Archive to a storage account**.
103
+
1. Create a diagnostic setting name, select the log category, select the destination as archive to a storage account, select the right subscription and storage account then select save. A dedicated storage account is recommended for archiving the diagnostic logs. If you need a storage account, you can follow this article: [Create a storage account](../storage/common/storage-account-create.md?tabs=azure-portal).
1. To see logs in the **Storage Account**, perform a sample action (for example: create/update/delete a policy), then open the **Storage Account**, navigate to **Containers**, and select the container name.
110
+
111
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/storage-two-diagnostic-setting.png" alt-text="Screenshot showing container in storage account where the diagnostic logs have been sent to." lightbox="./media/how-to-monitor-with-azure-monitor/storage-two-diagnostic-setting.png":::
112
+
113
+
1. Navigate to the file and download it to see the logs.
114
+
115
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/storage-navigate-diagnostic-setting.png" alt-text="Screenshot showing folders with details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/storage-navigate-diagnostic-setting.png":::
116
+
117
+
:::image type="content" source="./media/how-to-monitor-with-azure-monitor/storage-select-logs-diagnostic-setting.png" alt-text="Screenshot showing details of logs." lightbox="./media/how-to-monitor-with-azure-monitor/storage-select-logs-diagnostic-setting.png":::
118
+
119
+
## Sample Log
120
+
121
+
Here's a sample log you'd receive from a diagnostic setting.
122
+
123
+
The event tracks the scan life cycle. A scan operation follows progress through a sequence of states, from Queued, Running and finally a terminal state of Succeeded | Failed | Canceled. An event is logged for each state transition and the schema of the event will have the following properties.
124
+
125
+
```JSON
126
+
{
127
+
"time": "<The UTC time when the event occurred>",
128
+
"properties": {
129
+
"dataSourceName": "<Registered data source friendly name>",
130
+
"dataSourceType": "<Registered data source type>",
131
+
"scanName": "<Scan instance friendly name>",
132
+
"assetsDiscovered": "<If the resultType is succeeded, count of assets discovered in scan run>",
133
+
"assetsClassified": "<If the resultType is succeeded, count of assets classified in scan run>",
134
+
"scanQueueTimeInSeconds": "<If the resultType is succeeded, total seconds the scan instance in queue>",
135
+
"scanTotalRunTimeInSeconds": "<If the resultType is succeeded, total seconds the scan took to run>",
136
+
"runType": "<How the scan is triggered>",
137
+
"errorDetails": "<Scan failure error>",
138
+
"scanResultId": "<Unique GUID for the scan instance>"
139
+
},
140
+
"resourceId": "<The azure resource identifier>",
141
+
"category": "<The diagnostic log category>",
142
+
"operationName": "<The operation that cause the event Possible values for ScanStatusLogEvent category are:
143
+
|AdhocScanRun
144
+
|TriggeredScanRun
145
+
|StatusChangeNotification>",
146
+
"resultType": "Queued – indicates a scan is queued.
147
+
Running – indicates a scan entered a running state.
148
+
Succeeded – indicates a scan completed successfully.
149
+
Failed – indicates a scan failure event.
150
+
Cancelled – indicates a scan was cancelled. ",
151
+
"resultSignature": "<Not used for ScanStatusLogEvent category. >",
152
+
"resultDescription": "<This will have an error message if the resultType is Failed. >",
153
+
"durationMs": "<Not used for ScanStatusLogEvent category. >",
154
+
"level": "<The log severity level. Possible values are:
155
+
|Informational
156
+
|Error >",
157
+
"location": "<The location of the Microsoft Purview account>",
158
+
}
159
+
```
160
+
161
+
The Sample log for an event instance is shown in the below section.
0 commit comments