You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/platform/resource-logs-overview.md
+2-59Lines changed: 2 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.subservice: logs
6
6
ms.topic: reference
7
7
author: rboucher
8
8
ms.author: robb
9
-
ms.date: 09/20/2019
9
+
ms.date: 10/22/2019
10
10
11
11
---
12
12
@@ -29,64 +29,7 @@ Resource logs are automatically generated by supported Azure resources, but they
29
29
Resource logs differ from guest OS-level logs in Azure compute resources. Compute resources require an agent to collect logs and metrics from their guest OS, including such data as event logs, syslog, and performance counters. Use the [Diagnostic Extension](agents-overview.md#azure-diagnostic-extension) to route log data from Azure virtual machines and the [Log Analytics agent](agents-overview.md#log-analytics-agent) to collect logs and metrics from virtual machines in Azure, in other clouds, and on-premises into a Log Analytics workspace. See [Sources of monitoring data for Azure Monitor](data-sources.md) for details.
30
30
31
31
## Resource logs schema
32
-
Each Azure service has its own schema when resource logs are written to one of the destinations, but they all share a the top level schema in the following table. See [Service-specific schemas](#service-specific-schemas) below for links to the schema for each service.
33
-
34
-
| Name | Required/Optional | Description |
35
-
|---|---|---|
36
-
| time | Required | The timestamp (UTC) of the event. |
37
-
| resourceId | Required | The resource ID of the resource that emitted the event. For tenant services, this is of the form /tenants/tenant-id/providers/provider-name. |
38
-
| tenantId | Required for tenant logs | The tenant ID of the Active Directory tenant that this event is tied to. This property is only used for tenant-level logs, it does not appear in resource-level logs. |
39
-
| operationName | Required | The name of the operation represented by this event. If the event represents an RBAC operation, this is the RBAC operation name (eg. Microsoft.Storage/storageAccounts/blobServices/blobs/Read). Typically modeled in the form of a Resource Manager operation, even if they are not actual documented Resource Manager operations (`Microsoft.<providerName>/<resourceType>/<subtype>/<Write/Read/Delete/Action>`) |
40
-
| operationVersion | Optional | The api-version associated with the operation, if the operationName was performed using an API (eg. `http://myservice.windowsazure.net/object?api-version=2016-06-01`). If there is no API that corresponds to this operation, the version represents the version of that operation in case the properties associated with the operation change in the future. |
41
-
| category | Required | The log category of the event. Category is the granularity at which you can enable or disable logs on a particular resource. The properties that appear within the properties blob of an event are the same within a particular log category and resource type. Typical log categories are “Audit” “Operational” “Execution” and “Request.” |
42
-
| resultType | Optional | The status of the event. Typical values include Started, In Progress, Succeeded, Failed, Active, and Resolved. |
43
-
| resultSignature | Optional | The sub status of the event. If this operation corresponds to a REST API call, this is the HTTP status code of the corresponding REST call. |
44
-
| resultDescription | Optional | The static text description of this operation, eg. “Get storage file.” |
45
-
| durationMs | Optional | The duration of the operation in milliseconds. |
46
-
| callerIpAddress | Optional | The caller IP address, if the operation corresponds to an API call that would come from an entity with a publicly-available IP address. |
47
-
| correlationId | Optional | A GUID used to group together a set of related events. Typically, if two events have the same operationName but two different statuses (eg. “Started” and “Succeeded”), they share the same correlation ID. This may also represent other relationships between events. |
48
-
| identity | Optional | A JSON blob that describes the identity of the user or application that performed the operation. Typically this will include the authorization and claims / JWT token from active directory. |
49
-
| Level | Optional | The severity level of the event. Must be one of Informational, Warning, Error, or Critical. |
50
-
| location | Optional | The region of the resource emitting the event, eg. “East US” or “France South” |
51
-
| properties | Optional | Any extended properties related to this particular category of events. All custom/unique properties must be put inside this “Part B” of the schema. |
52
-
53
-
## Service-specific schemas
54
-
The schema for resource diagnostic logs varies depends on the resource type which is defined by the `resourceId` property) and the `category` properties. This following list shows all Azure services that support resource logs with links to the service and category-specific schema where available.
55
-
56
-
| Service | Schema & Docs |
57
-
| --- | --- |
58
-
| Azure Active Directory |[Overview](../../active-directory/reports-monitoring/concept-activity-logs-azure-monitor.md), [Audit log schema](../../active-directory/reports-monitoring/reference-azure-monitor-audit-log-schema.md) and [Sign-ins schema](../../active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema.md)|
0 commit comments