You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/platform/activity-log-collect.md
+87-20Lines changed: 87 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Collect and analyze Azure activity logs in Log Analytics workspace | Microsoft Docs
2
+
title: Collect and analyze Azure activity logs in Log Analytics workspace
3
3
description: Collect the Azure Activity Log in Azure Monitor Logs and use the monitoring solution to analyze and search the Azure activity log across all your Azure subscriptions.
4
4
ms.subservice: logs
5
5
ms.topic: conceptual
@@ -9,12 +9,32 @@ ms.date: 09/30/2019
9
9
10
10
---
11
11
12
-
# Collect and analyze Azure activity logs in Log Analytics workspace in Azure Monitor
12
+
# Collect and analyze Azure Activity log in Azure Monitor
13
+
The [Azure Activity log](platform-logs-overview.md) is a [platform log](platform-logs-overview.md) that provides insight into subscription-level events that have occurred in Azure. While you can view the Activity log in the Azure portal, you can send the entries to other destinations to provide different methods of analysis. The methods to configure different destinations for the Activity log are in the process of changing. This article describes this transition and the roadmap for the collection and analysis for the Activity log.
13
14
14
-
> [!WARNING]
15
-
> You can now collect the Activity log into a Log Analytics workspace using a diagnostic setting similar to how you collect resource logs. See [Collect and analyze Azure activity logs in Log Analytics workspace in Azure Monitor](diagnostic-settings-legacy.md).
15
+
## Summary of changes
16
16
17
-
The [Azure Activity Log](platform-logs-overview.md) provides insight into subscription-level events that have occurred in your Azure subscription. This article describes how to collect the Activity Log into a Log Analytics workspace and how to use the Activity Log Analytics [monitoring solution](../insights/solutions.md), which provides log queries and views for analyzing this data.
17
+
### Collection of Activity log
18
+
Like other platform logs, the Activity log can be sent to a Log Analytics workspace, Azure storage, or Azure Event Hubs. This configuration is now performed for the Activity log with a diagnostic setting, which is the same method used by resource logs. Prior to this change, there were two way to sent the Activity log to these destinations:
19
+
20
+
- Send to a Log Analytics workspace by connect the Activity log to the workspace in the workspace configuration.
21
+
- Send to Azure storage or event hubs by creating a log profile.
22
+
23
+
### Analysis of Activity log
24
+
You can still view the Activity log in the Azure portal without any configuration. While the configuration has changed for Azure storage and event hubs, these scenarios haven't changed.
25
+
26
+
What is changing is analysis of the logs in a Log Analytics workspace. Activity log events are still sent to the *AzureActivity* table, and the same log queries can be used to analyze them. The Activity Logs Analytics monitoring solution is being deprecated along with the deprecation of Azure Monitor views. A new Azure Monitor workbook will be provided in the near future for analyzing this data.
27
+
28
+
29
+
30
+
## Collecting Activity log
31
+
The method to send Activity log entries to [an event hub or storage account](activity-log-export.md) or to a [Log Analytics workspace](activity-log-collect.md) has changed to use [diagnostic settings](diagnostic-settings.md) which has the following advantages over the previous methods:
32
+
33
+
- Consistent method for collecting all platform logs.
34
+
- Collect Activity log across multiple subscriptions and tenants.
35
+
- Filter collection to only collect logs for particular categories.
36
+
- Collect all Activity log categories. Some categories are not collected using legacy method.
37
+
- Faster latency for log ingestion. The previous method has about 15 minutes latency while diagnostic settings adds only about 1 minute.
18
38
19
39
Connecting the Activity Log to a Log Analytics workspace provides the following benefits:
20
40
@@ -23,32 +43,79 @@ Connecting the Activity Log to a Log Analytics workspace provides the following
23
43
- Correlate Activity Log data with other monitoring data collected by Azure Monitor.
24
44
- Use [log queries](../log-query/log-query-overview.md) to perform complex analysis and gain deep insights on Activity Log entries.
25
45
26
-
## Connect to Log Analytics workspace
27
-
A single workspace can be connected to the Activity Log for multiple subscriptions in the same Azure tenant. For collection across multiple tenants, see [Collect Azure Activity Logs into a Log Analytics workspace across subscriptions in different Azure Active Directory tenants](activity-log-collect-tenants.md).
46
+
### Considerations
47
+
Consider the following details of Activity log collection using diagnostic settings before enabling this feature.
48
+
49
+
- The retention setting for collecting the Activity log to Azure storage has been removed meaning that data will be stored indefinitely until you remove it.
50
+
- Currently, you can only create a subscription level diagnostic setting using the Azure portal. To use other methods such as PowerShell or CLI, you can create a Resource Manager template.
51
+
52
+
53
+
### Work with legacy settings
54
+
Legacy settings for collecting the Activity log will continue to work if you don't choose to replace with a diagnostic setting. Use the following method to manage the log profile for a subscription.
55
+
56
+
1. From the **Azure Monitor** menu in the Azure portal, select **Activity log**.
> You may receive an error with the following procedure if the Microsoft.OperationalInsights and Microsoft.OperationsManagement resource providers aren't registered for your subscription. See [Azure resource providers and types](../../azure-resource-manager/management/resource-providers-and-types.md) to register these providers.
31
65
32
-
Use the following procedure to connect the Activity Log to your Log Analytics workspace:
66
+
See the following articles for details on using the legacy collection methods.
33
67
34
-
1. From the **Log Analytics workspaces** menu in the Azure portal, select the workspace to collect the Activity Log.
35
-
1. In the **Workspace Data Sources** section of the workspace's menu, select **Azure Activity log**.
36
-
1. Click the subscription you want to connect.
68
+
-[Collect and analyze Azure activity logs in Log Analytics workspace in Azure Monitor](activity-log-collect.md)
69
+
-[Collect Azure Activity logs into Azure Monitor across Azure Active Directory tenants](activity-log-collect-tenants.md)
70
+
-[Export Azure Activity log to storage or Azure Event Hubs](activity-log-export.md)
1. Click **Connect** to connect the Activity log in the subscription to the selected workspace. If the subscription is already connected to another workspace, click **Disconnect** first to disconnect it.
If you have existing settings to collect the Activity log, you should disable them before enabling it using diagnostic settings. Having both enabled may result in duplicate data.
43
76
44
-
## Analyze in Log Analytics workspace
77
+
### Disable collection into Log Analytics workspace
78
+
79
+
1. Open the **Log Analytics workspaces** menu in the Azure portal and select the workspace to collect the Activity Log.
80
+
2. In the **Workspace Data Sources** section of the workspace's menu, select **Azure Activity log**.
81
+
3. Click the subscription you want to disconnect.
82
+
4. Click **Disconnect** and then **Yes** when asked to confirm your choice.
83
+
84
+
### Disable log profile
85
+
86
+
1. Use the procedure described in [Work with legacy settings](#work-with-legacy-settings) to open legacy settings.
87
+
2. Disable any current collection to storage or event hubs.
88
+
89
+
90
+
## Analyze Activity log in Log Analytics workspace
45
91
When you connect an Activity Log to a Log Analytics workspace, entries will be written to the workspace into a table called **AzureActivity** that you can retrieve with a [log query](../log-query/log-query-overview.md). The structure of this table varies depending on the [category of log entry](activity-log-view.md#categories-in-the-activity-log). See [Azure Activity Log event schema](activity-log-schema.md) for a description of each category.
46
92
93
+
94
+
### Differences in data
95
+
Diagnostic settings collect the same data as the previous methods used to collect the Activity log with the following current differences:
96
+
97
+
The following columns have been removed. The replacement for these columns are in a different format, so you may need to modify log queries that use them. You may still see removed columns in the schema, but they won't be populated with data.
98
+
99
+
| Removed column | Replacement column |
100
+
|:---|:---|
101
+
| ActivityStatus | ActivityStatusValue |
102
+
| ActivitySubstatus | ActivitySubstatusValue |
103
+
| OperationName | OperationNameValue |
104
+
| ResourceProvider | ResourceProviderValue |
105
+
106
+
The following column have been added:
107
+
108
+
- Authorization_d
109
+
- Claims_d
110
+
- Properties_d
111
+
112
+
> [!IMPORTANT]
113
+
> In some cases, the values in these columns may be in all uppercase. If you have a query that includes these columns, you should use the [=~ operator](https://docs.microsoft.com/azure/kusto/query/datatypes-string-operators) to do a case insensitive comparison.
114
+
115
+
47
116
## Activity Logs Analytics monitoring solution
48
-
The Azure Log Analytics monitoring solution includes multiple log queries and views for analyzing the Activity Log records in your Log Analytics workspace.
117
+
The Azure Log Analytics monitoring solution is currently being deprecated but can still be used if you already have it enabled.
49
118
50
-
### Install the solution
51
-
Use the procedure in [Install a monitoring solution](../insights/solutions.md#install-a-monitoring-solution) to install the **Activity Log Analytics** solution. There is no additional configuration required.
52
119
53
120
### Use the solution
54
121
Monitoring solutions are accessed from the **Monitor** menu in the Azure portal. Select **More** in the **Insights** section to open the **Overview** page with the solution tiles. The **Azure Activity Logs** tile displays a count of the number of **AzureActivity** records in your workspace.
Copy file name to clipboardExpand all lines: articles/azure-monitor/platform/diagnostic-settings-legacy.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,10 @@ ms.date: 02/04/2020
14
14
The [Azure Activity log](platform-logs-overview.md) is a [platform log](platform-logs-overview.md) that provides insight into subscription-level events that have occurred in Azure. The method to send Activity log entries to [an event hub or storage account](activity-log-export.md) or to a [Log Analytics workspace](activity-log-collect.md) has changed to use [diagnostic settings](diagnostic-settings.md). This article describes the difference between the methods and how to clear legacy settings in preparation to change to diagnostic settings.
15
15
16
16
17
+
18
+
17
19
## Differences between methods
20
+
The previous method for collecting the Activity log was to connect it to a Log Analytics workspace.
18
21
19
22
### Advantages
20
23
Using diagnostic settings has the following advantages over the current methods:
0 commit comments