Skip to content

Commit 8305051

Browse files
itechedititechedit
authored
Merge pull request #108473 from bwren/am-activity-log
Azure Monitor activity log transition
2 parents 4bbeaf8 + c1b12c8 commit 8305051

File tree

10 files changed

+186
-174
lines changed

10 files changed

+186
-174
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42410,6 +42410,11 @@
4241042410
"redirect_url": "/azure/azure-monitor/log-query/vminsights-overview",
4241142411
"redirect_document_id": false
4241242412
},
42413+
{
42414+
"source_path": "articles/azure-monitor/platform/diagnostic-settings-legacy.md",
42415+
"redirect_url": "/azure/azure-monitor/platform/activity-log-collect",
42416+
"redirect_document_id": false
42417+
},
4241342418
{
4241442419
"source_path": "articles/machine-learning/service/how-to-automated-ml.md",
4241542420
"redirect_url": "/azure/machine-learning/service/concept-automated-ml",

‎articles/azure-monitor/platform/activity-log-collect.md

Lines changed: 169 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,110 @@
11
---
2-
title: Collect Azure activity log in Log Analytics workspace
2+
title: Collect and analyze Azure activity log in Azure Monitor
33
description: Collect the Azure Activity Log in Azure Monitor Logs and use the monitoring solution to analyze and search the Azure activity log across all your Azure subscriptions.
44
ms.subservice: logs
55
ms.topic: conceptual
66
author: bwren
77
ms.author: bwren
8-
ms.date: 09/30/2019
8+
ms.date: 03/24/2020
99

1010
---
1111

12-
# Collect and analyze Azure activity logs in Log Analytics workspace in Azure Monitor
12+
# Collect and analyze Azure Activity log in Azure Monitor
13+
The [Azure Activity log](platform-logs-overview.md) is a [platform log](platform-logs-overview.md) that provides insight into subscription-level events that have occurred in Azure. While you can view the Activity log in the Azure portal, you should configure it to send to a Log Analytics workspace to enable additional features of Azure Monitor. This article describes how to perform this configuration and how to send the Activity log to Azure storage and event hubs.
1314

14-
> [!WARNING]
15-
> You can now collect the Activity log into a Log Analytics workspace using a diagnostic setting similar to how you collect resource logs. See [Collect and analyze Azure activity logs in Log Analytics workspace in Azure Monitor](diagnostic-settings-legacy.md).
15+
Collecting the Activity Log in a Log Analytics workspace provides the following advantages:
1616

17-
The [Azure Activity Log](platform-logs-overview.md) provides insight into subscription-level events that have occurred in your Azure subscription. This article describes how to collect the Activity Log into a Log Analytics workspace and how to use the Activity Log Analytics [monitoring solution](../insights/solutions.md), which provides log queries and views for analyzing this data.
17+
- No data ingestion or data retention charge for Activity log data stored in a Log Analytics workspace.
18+
- Correlate Activity log data with other monitoring data collected by Azure Monitor.
19+
- Use log queries to perform complex analysis and gain deep insights on Activity Log entries.
20+
- Use log alerts with Activity entries allowing for more complex alerting logic.
21+
- Store Activity log entries for longer than 90 days.
22+
- Consolidate log entries from multiple Azure subscriptions and tenants into one location for analysis together.
1823

19-
Connecting the Activity Log to a Log Analytics workspace provides the following benefits:
2024

21-
- Consolidate the Activity Log from multiple Azure subscriptions into one location for analysis.
22-
- Store Activity Log entries for longer than 90 days.
23-
- Correlate Activity Log data with other monitoring data collected by Azure Monitor.
24-
- Use [log queries](../log-query/log-query-overview.md) to perform complex analysis and gain deep insights on Activity Log entries.
2525

26-
## Connect to Log Analytics workspace
27-
A single workspace can be connected to the Activity Log for multiple subscriptions in the same Azure tenant. For collection across multiple tenants, see [Collect Azure Activity Logs into a Log Analytics workspace across subscriptions in different Azure Active Directory tenants](activity-log-collect-tenants.md).
26+
## Collecting Activity log
27+
The Activity log is collected automatically for [viewing in the Azure portal](activity-log-view.md). To collect it in a Log Analytics workspace or to send it Azure storage or event hubs, create a [diagnostic setting](diagnostic-settings.md). This is the same method used by resource logs making it consistent for all [platform logs](platform-logs-overview.md).
28+
29+
To create a diagnostic setting for the Activity log, select **Diagnostic settings** from the **Activity log** menu in Azure Monitor. See [Create diagnostic setting to collect platform logs and metrics in Azure](diagnostic-settings.md) for details on creating the setting. See [Categories in the Activity log](activity-log-view.md#categories-in-the-activity-log) for a description of the categories you can filter. If you have any legacy settings, make sure you disable them before creating a diagnostic setting. Having both enabled may result in duplicate data.
30+
31+
![Diagnostic settings](media/diagnostic-settings-subscription/diagnostic-settings.png)
32+
33+
34+
> [!NOTE]
35+
> Currently, you can only create a subscription level diagnostic setting using the Azure portal and a Resource Manager template.
36+
37+
38+
## Legacy settings
39+
While diagnostic settings are the preferred method to send the Activity log to different destinations, legacy methods will continue to work if you don't choose to replace with a diagnostic setting. Diagnostic settings have the following advantages over legacy methods, and it's recommended that you update your configuration:
40+
41+
- Consistent method for collecting all platform logs.
42+
- Collect Activity log across multiple subscriptions and tenants.
43+
- Filter collection to only collect logs for particular categories.
44+
- Collect all Activity log categories. Some categories are not collected using legacy method.
45+
- Faster latency for log ingestion. The previous method has about 15 minutes latency while diagnostic settings adds only about 1 minute.
2846

29-
> [!IMPORTANT]
30-
> You may receive an error with the following procedure if the Microsoft.OperationalInsights and Microsoft.OperationsManagement resource providers aren't registered for your subscription. See [Azure resource providers and types](../../azure-resource-manager/management/resource-providers-and-types.md) to register these providers.
3147

32-
Use the following procedure to connect the Activity Log to your Log Analytics workspace:
48+
49+
### Log profiles
50+
Log profiles are the legacy method for sending the Activity log to Azure storage or event hubs. Use the following procedure to continue working with a log profile or to disable it in preparation for migrating to a diagnostic setting.
51+
52+
1. From the **Azure Monitor** menu in the Azure portal, select **Activity log**.
53+
3. Click **Diagnostic settings**.
54+
55+
![Diagnostic settings](media/diagnostic-settings-subscription/diagnostic-settings.png)
56+
57+
4. Click the purple banner for the legacy experience.
58+
59+
![Legacy experience](media/diagnostic-settings-subscription/legacy-experience.png)
60+
61+
### Log Analytics workspace
62+
The legacy method for collecting the Activity log into a Log Analytics workspace is connecting the log in the workspace configuration.
3363

3464
1. From the **Log Analytics workspaces** menu in the Azure portal, select the workspace to collect the Activity Log.
3565
1. In the **Workspace Data Sources** section of the workspace's menu, select **Azure Activity log**.
3666
1. Click the subscription you want to connect.
3767

38-
![Workspaces](media/activity-log-export/workspaces.png)
68+
![Workspaces](media/activity-log-collect/workspaces.png)
3969

4070
1. Click **Connect** to connect the Activity log in the subscription to the selected workspace. If the subscription is already connected to another workspace, click **Disconnect** first to disconnect it.
4171

42-
![Connect Workspaces](media/activity-log-export/connect-workspace.png)
72+
![Connect Workspaces](media/activity-log-collect/connect-workspace.png)
73+
74+
75+
To disable the setting, perform the same procedure and click **Disconnect** to remove the subscription from the workspace.
76+
77+
78+
## Analyze Activity log in Log Analytics workspace
79+
When you connect an Activity Log to a Log Analytics workspace, entries will be written to the workspace into a table called *AzureActivity* that you can retrieve with a [log query](../log-query/log-query-overview.md). The structure of this table varies depending on the [category of the log entry](activity-log-view.md#categories-in-the-activity-log). See [Azure Activity Log event schema](activity-log-schema.md) for a description of each category.
80+
81+
82+
### Data structure changes
83+
Diagnostic settings collect the same data as the legacy method used to collect the Activity log with some changes to the structure of the *AzureActivity* table.
84+
85+
The columns in the following table have been deprecated in the updated schema. They still exist in *AzureActivity* but they will have no data. The replacement for these columns are not new, but they contain the same data as the deprecated column. They are in a different format, so you may need to modify log queries that use them.
86+
87+
| Deprecated column | Replacement column |
88+
|:---|:---|
89+
| ActivityStatus | ActivityStatusValue |
90+
| ActivitySubstatus | ActivitySubstatusValue |
91+
| OperationName | OperationNameValue |
92+
| ResourceProvider | ResourceProviderValue |
93+
94+
> [!IMPORTANT]
95+
> In some cases, the values in these columns may be in all uppercase. If you have a query that includes these columns, you should use the [=~ operator](https://docs.microsoft.com/azure/kusto/query/datatypes-string-operators) to do a case insensitive comparison.
96+
97+
The following column have been added to *AzureActivity* in the updated schema:
98+
99+
- Authorization_d
100+
- Claims_d
101+
- Properties_d
43102

44-
## Analyze in Log Analytics workspace
45-
When you connect an Activity Log to a Log Analytics workspace, entries will be written to the workspace into a table called **AzureActivity** that you can retrieve with a [log query](../log-query/log-query-overview.md). The structure of this table varies depending on the [category of log entry](activity-log-view.md#categories-in-the-activity-log). See [Azure Activity Log event schema](activity-log-schema.md) for a description of each category.
46103

47104
## Activity Logs Analytics monitoring solution
48-
The Azure Log Analytics monitoring solution includes multiple log queries and views for analyzing the Activity Log records in your Log Analytics workspace.
105+
The Azure Log Analytics monitoring solution will be deprecated soon and replaced by a workbook using the updated schema in the Log Analytics workspace. You can still use the solution if you already have it enabled, but it can only be used if you're collecting the Activity log using legacy settings.
106+
49107

50-
### Install the solution
51-
Use the procedure in [Install a monitoring solution](../insights/solutions.md#install-a-monitoring-solution) to install the **Activity Log Analytics** solution. There is no additional configuration required.
52108

53109
### Use the solution
54110
Monitoring solutions are accessed from the **Monitor** menu in the Azure portal. Select **More** in the **Insights** section to open the **Overview** page with the solution tiles. The **Azure Activity Logs** tile displays a count of the number of **AzureActivity** records in your workspace.
@@ -60,12 +116,96 @@ Click the **Azure Activity Logs** tile to open the **Azure Activity Logs** view.
60116

61117
![Azure Activity Logs dashboard](media/collect-activity-logs/activity-log-dash.png)
62118

63-
| Visualization part | Description |
64-
| --- | --- |
65-
| Azure Activity Log Entries | Shows a bar chart of the top Azure Activity Log entry record totals for the date range that you have selected and shows a list of the top 10 activity callers. Click the bar chart to run a log search for `AzureActivity`. Click a caller item to run a log search returning all Activity Log entries for that item. |
66-
| Activity Logs by Status | Shows a doughnut chart for Azure Activity Log status for the selected date range and a list of the top ten status records. Click the chart to run a log query for `AzureActivity | summarize AggregatedValue = count() by ActivityStatus`. Click a status item to run a log search returning all Activity Log entries for that status record. |
67-
| Activity Logs by Resource | Shows the total number of resources with Activity Logs and lists the top ten resources with record counts for each resource. Click the total area to run a log search for `AzureActivity | summarize AggregatedValue = count() by Resource`, which shows all Azure resources available to the solution. Click a resource to run a log query returning all activity records for that resource. |
68-
| Activity Logs by Resource Provider | Shows the total number of resource providers that produce Activity Logs and lists the top ten. Click the total area to run a log query for `AzureActivity | summarize AggregatedValue = count() by ResourceProvider`, which shows all Azure resource providers. Click a resource provider to run a log query returning all activity records for the provider. |
119+
120+
### Enable the solution for new subscriptions
121+
You will soon no longer be able to add the Activity Logs Analytics solution to your subscription using the Azure portal. You can add it using the following procedure with a resource manager template.
122+
123+
1. Copy the following json into a file called *ActivityLogTemplate*.json.
124+
125+
```json
126+
{
127+
"$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
128+
"contentVersion": "1.0.0.0",
129+
"parameters": {
130+
"workspaceName": {
131+
"type": "String",
132+
"defaultValue": "my-workspace",
133+
"metadata": {
134+
"description": "Specifies the name of the workspace."
135+
}
136+
},
137+
"location": {
138+
"type": "String",
139+
"allowedValues": [
140+
"east us",
141+
"west us",
142+
"australia central",
143+
"west europe"
144+
],
145+
"defaultValue": "australia central",
146+
"metadata": {
147+
"description": "Specifies the location in which to create the workspace."
148+
}
149+
}
150+
},
151+
"resources": [
152+
{
153+
"type": "Microsoft.OperationalInsights/workspaces",
154+
"name": "[parameters('workspaceName')]",
155+
"apiVersion": "2015-11-01-preview",
156+
"location": "[parameters('location')]",
157+
"properties": {
158+
"features": {
159+
"searchVersion": 2
160+
}
161+
}
162+
},
163+
{
164+
"type": "Microsoft.OperationsManagement/solutions",
165+
"apiVersion": "2015-11-01-preview",
166+
"name": "[concat('AzureActivity(', parameters('workspaceName'),')')]",
167+
"location": "[parameters('location')]",
168+
"dependsOn": [
169+
"[resourceId('microsoft.operationalinsights/workspaces', parameters('workspaceName'))]"
170+
],
171+
"plan": {
172+
"name": "[concat('AzureActivity(', parameters('workspaceName'),')')]",
173+
"promotionCode": "",
174+
"product": "OMSGallery/AzureActivity",
175+
"publisher": "Microsoft"
176+
},
177+
"properties": {
178+
"workspaceResourceId": "[resourceId('microsoft.operationalinsights/workspaces', parameters('workspaceName'))]",
179+
"containedResources": [
180+
"[concat(resourceId('microsoft.operationalinsights/workspaces', parameters('workspaceName')), '/views/AzureActivity(',parameters('workspaceName'))]"
181+
]
182+
}
183+
},
184+
{
185+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
186+
"kind": "AzureActivityLog",
187+
"name": "[concat(parameters('workspaceName'), '/', subscription().subscriptionId)]",
188+
"apiVersion": "2015-11-01-preview",
189+
"location": "[parameters('location')]",
190+
"dependsOn": [
191+
"[parameters('WorkspaceName')]"
192+
],
193+
"properties": {
194+
"linkedResourceId": "[concat(subscription().Id, '/providers/microsoft.insights/eventTypes/management')]"
195+
}
196+
}
197+
]
198+
}
199+
```
200+
201+
2. Deploy the template using the following PowerShell commands:
202+
203+
```PowerShell
204+
Connect-AzAccount
205+
Select-AzSubscription <SubscriptionName>
206+
New-AzResourceGroupDeployment -Name activitysolution -ResourceGroupName <ResourceGroup> -TemplateFile <Path to template file>
207+
```
208+
69209

70210
## Next steps
71211

‎articles/azure-monitor/platform/activity-log-export.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.subservice: logs
1313
# Export Azure Activity log to storage or Azure Event Hubs
1414

1515
> [!IMPORTANT]
16-
> The method for sending the Azure Activity log to Azure Storage and Azure Event Hubs has changed to [diagnostic settings](diagnostic-settings.md). This article describes the legacy method which is in the process of being deprecated. See Update to [Azure Activity log collection and export](diagnostic-settings-legacy.md) for a comparison.
16+
> The method for sending the Azure Activity log to Azure Storage and Azure Event Hubs has changed to [diagnostic settings](diagnostic-settings.md). This article describes the legacy method which is in the process of being deprecated. See Update to [Collect and analyze Azure Activity log in Azure Monitor](activity-log-collect.md) for a comparison.
1717
1818

1919
The [Azure Activity Log](platform-logs-overview.md) provides insight into subscription-level events that have occurred in your Azure subscription. In addition to viewing the Activity log in the Azure portal or copying it to a Log Analytics workspace where it can be analyzed with other data collected by Azure Monitor, you can create a log profile to archive the Activity log to an Azure storage account or stream it to an Event Hub.

0 commit comments

Comments
 (0)