You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-data-export.md
+46-17Lines changed: 46 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -679,11 +679,26 @@ If the data export rule includes an unsupported table, the configuration will su
679
679
| ACSRoomsIncomingOperations ||
680
680
| ACSSMSIncomingOperations ||
681
681
| ADAssessmentRecommendation ||
682
+
| AddonAzureBackupAlerts ||
683
+
| AddonAzureBackupJobs ||
684
+
| AddonAzureBackupPolicy ||
685
+
| AddonAzureBackupProtectedInstance ||
686
+
| AddonAzureBackupStorage ||
682
687
| ADFActivityRun ||
688
+
| ADFAirflowSchedulerLogs ||
683
689
| ADFAirflowTaskLogs ||
690
+
| ADFAirflowWebLogs ||
684
691
| ADFAirflowWorkerLogs ||
685
692
| ADFPipelineRun ||
693
+
| ADFSandboxActivityRun ||
694
+
| ADFSandboxPipelineRun ||
686
695
| ADFSSignInLogs ||
696
+
| ADFSSISIntegrationRuntimeLogs ||
697
+
| ADFSSISPackageEventMessageContext ||
698
+
| ADFSSISPackageEventMessages ||
699
+
| ADFSSISPackageExecutableStatistics ||
700
+
| ADFSSISPackageExecutionComponentPhases ||
701
+
| ADFSSISPackageExecutionDataStatistics ||
687
702
| ADFTriggerRun ||
688
703
| ADPAudit ||
689
704
| ADPDiagnostics ||
@@ -696,7 +711,10 @@ If the data export rule includes an unsupported table, the configuration will su
696
711
| ADTModelsOperation ||
697
712
| ADTQueryOperation ||
698
713
| ADXCommand ||
714
+
| ADXJournal ||
699
715
| ADXQuery ||
716
+
| ADXTableDetails ||
717
+
| ADXTableUsageStatistics ||
700
718
| AegDataPlaneRequests ||
701
719
| AegDeliveryFailureLogs ||
702
720
| AegPublishFailureLogs ||
@@ -714,7 +732,11 @@ If the data export rule includes an unsupported table, the configuration will su
714
732
| AgriFoodWeatherLogs ||
715
733
| AGSGrafanaLoginEvents ||
716
734
| AHDSMedTechDiagnosticLogs ||
717
-
| Alert | Partial support. Data ingestion for Zabbix alerts isn't supported. |
735
+
| AirflowDagProcessingLogs ||
736
+
| AKSAudit ||
737
+
| AKSAuditAdmin ||
738
+
| AKSControlPlane ||
739
+
| Alert | Partial support – Data ingestion for Zabbix alerts isn't supported. |
718
740
| AlertEvidence ||
719
741
| AlertInfo ||
720
742
| AmlComputeClusterEvent ||
@@ -738,6 +760,7 @@ If the data export rule includes an unsupported table, the configuration will su
738
760
| AMSMediaAccountHealth ||
739
761
| AMSStreamingEndpointRequests ||
740
762
| ANFFileAccess ||
763
+
| Anomalies ||
741
764
| ApiManagementGatewayLogs ||
742
765
| AppAvailabilityResults ||
743
766
| AppBrowserTimings ||
@@ -772,8 +795,6 @@ If the data export rule includes an unsupported table, the configuration will su
772
795
| ASimWebSessionLogs ||
773
796
| ATCExpressRouteCircuitIpfix ||
774
797
| AuditLogs ||
775
-
| AUIEventsAudit ||
776
-
| AUIEventsOperational ||
777
798
| AutoscaleEvaluationsLog ||
778
799
| AutoscaleScaleActionsLog ||
779
800
| AVNMNetworkGroupMembershipChange ||
@@ -810,13 +831,14 @@ If the data export rule includes an unsupported table, the configuration will su
810
831
| CDBPartitionKeyRUConsumption ||
811
832
| CDBPartitionKeyStatistics ||
812
833
| CDBQueryRuntimeStatistics ||
834
+
| ChaosStudioExperimentEventLogs ||
813
835
| CIEventsAudit ||
814
836
| CIEventsOperational ||
815
837
| CloudAppEvents ||
816
838
| CommonSecurityLog ||
817
839
| ComputerGroup ||
818
840
| ConfidentialWatchlist ||
819
-
| ConfigurationData | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
841
+
| ConfigurationData | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
820
842
| ContainerAppConsoleLogs ||
821
843
| ContainerAppSystemLogs ||
822
844
| ContainerImageInventory ||
@@ -872,7 +894,7 @@ If the data export rule includes an unsupported table, the configuration will su
872
894
| EmailEvents ||
873
895
| EmailPostDeliveryEvents ||
874
896
| EmailUrlInfo ||
875
-
| Event | Partial support. Data arriving from the Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
897
+
| Event | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
876
898
| ExchangeAssessmentRecommendation ||
877
899
| ExchangeOnlineAssessmentRecommendation ||
878
900
| FailedIngestion ||
@@ -913,9 +935,10 @@ If the data export rule includes an unsupported table, the configuration will su
913
935
| Heartbeat ||
914
936
| HuntingBookmark ||
915
937
| IdentityDirectoryEvents ||
938
+
| IdentityInfo ||
916
939
| IdentityLogonEvents ||
917
940
| IdentityQueryEvents ||
918
-
| InsightsMetrics | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
941
+
| InsightsMetrics | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
919
942
| IntuneAuditLogs ||
920
943
| IntuneDevices ||
921
944
| IntuneOperationalLogs ||
@@ -924,6 +947,7 @@ If the data export rule includes an unsupported table, the configuration will su
924
947
| KubeMonAgentEvents ||
925
948
| KubeNodeInventory ||
926
949
| KubePodInventory ||
950
+
| KubePVInventory ||
927
951
| KubeServices ||
928
952
| LAQueryLogs ||
929
953
| LogicAppWorkflowRuntime ||
@@ -938,6 +962,7 @@ If the data export rule includes an unsupported table, the configuration will su
938
962
| MicrosoftHealthcareApisAuditLogs ||
939
963
| MicrosoftPurviewInformationProtection ||
940
964
| NetworkAccessTraffic ||
965
+
| NetworkMonitoring ||
941
966
| NSPAccessLogs ||
942
967
| NTAIpDetails ||
943
968
| NTANetAnalytics ||
@@ -951,8 +976,8 @@ If the data export rule includes an unsupported table, the configuration will su
951
976
| OfficeActivity ||
952
977
| OLPSupplyChainEntityOperations ||
953
978
| OLPSupplyChainEvents ||
954
-
| Operation | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
955
-
| Perf |Partial support. Only Windows perf data is currently supported. Currently, the Linux perf data is missing in export.|
979
+
| Operation | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
980
+
| Perf ||
956
981
| PFTitleAuditLogs ||
957
982
| PowerBIActivity ||
958
983
| PowerBIAuditTenant ||
@@ -973,31 +998,32 @@ If the data export rule includes an unsupported table, the configuration will su
973
998
| SecurityBaseline ||
974
999
| SecurityBaselineSummary ||
975
1000
| SecurityDetection ||
976
-
| SecurityEvent | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
1001
+
| SecurityEvent | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
977
1002
| SecurityIncident ||
978
1003
| SecurityIoTRawEvent ||
979
1004
| SecurityNestedRecommendation ||
980
1005
| SecurityRecommendation ||
981
1006
| SecurityRegulatoryCompliance ||
982
1007
| SentinelAudit ||
983
1008
| SentinelHealth ||
984
-
| SfBAssessmentRecommendation ||
985
-
| SfBOnlineAssessmentRecommendation ||
986
1009
| SharePointOnlineAssessmentRecommendation ||
987
1010
| SignalRServiceDiagnosticLogs ||
988
1011
| SigninLogs ||
989
1012
| SPAssessmentRecommendation ||
990
1013
| SQLAssessmentRecommendation ||
991
1014
| SQLSecurityAuditEvents ||
992
1015
| SqlVulnerabilityAssessmentScanStatus ||
993
-
|StorageAntimalwareScanResults||
1016
+
|StorageBlobLogs||
994
1017
| StorageCacheOperationEvents ||
995
1018
| StorageCacheUpgradeEvents ||
996
1019
| StorageCacheWarningEvents ||
1020
+
| StorageFileLogs ||
997
1021
| StorageMalwareScanningResults ||
998
1022
| StorageMoverCopyLogsFailed ||
999
1023
| StorageMoverCopyLogsTransferred ||
1000
1024
| StorageMoverJobRunLogs ||
1025
+
| StorageQueueLogs ||
1026
+
| StorageTableLogs ||
1001
1027
| SucceededIngestion ||
1002
1028
| SynapseBigDataPoolApplicationsEnded ||
1003
1029
| SynapseBuiltinSqlPoolRequestsEnded ||
@@ -1016,13 +1042,16 @@ If the data export rule includes an unsupported table, the configuration will su
1016
1042
| SynapseSqlPoolRequestSteps ||
1017
1043
| SynapseSqlPoolSqlRequests ||
1018
1044
| SynapseSqlPoolWaits ||
1019
-
| Syslog | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
1045
+
| Syslog | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
1020
1046
| ThreatIntelligenceIndicator ||
1021
1047
| TSIIngress ||
1022
1048
| UCClient ||
1023
-
| UCDOAggregatedStatus ||
1049
+
| UCClientReadinessStatus ||
1050
+
| UCClientUpdateStatus ||
1051
+
| UCDeviceAlert ||
1024
1052
| UCDOStatus ||
1025
-
| Update | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
1053
+
| UCServiceUpdateStatus ||
1054
+
| Update | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
1026
1055
| UpdateRunProgress ||
1027
1056
| UpdateSummary ||
1028
1057
| UrlClickEvents ||
@@ -1031,10 +1060,10 @@ If the data export rule includes an unsupported table, the configuration will su
1031
1060
| UserPeerAnalytics ||
1032
1061
| VIAudit ||
1033
1062
| VIIndexing ||
1063
+
| W3CIISLog | Partial support – data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
1034
1064
| WaaSDeploymentStatus ||
1035
1065
| WaaSInsiderStatus ||
1036
1066
| WaaSUpdateStatus ||
1037
-
| W3CIISLog | Partial support. Data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
1038
1067
| Watchlist ||
1039
1068
| WebPubSubConnectivity ||
1040
1069
| WebPubSubHttpRequest ||
@@ -1043,7 +1072,7 @@ If the data export rule includes an unsupported table, the configuration will su
1043
1072
| WindowsEvent ||
1044
1073
| WindowsFirewall ||
1045
1074
| WindowsServerAssessmentRecommendation ||
1046
-
| WireData | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
1075
+
| WireData | Partial support – some of the data is ingested through internal services that aren't supported in export. This portion is missing in export currently. |
0 commit comments