Skip to content

Commit a15da52

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #260070 from vhorne/fw-logs-metrics
update log and metrics
2 parents 9292a0b + 2032367 commit a15da52

File tree

7 files changed

+282
-213
lines changed

7 files changed

+282
-213
lines changed

‎articles/azure-monitor/essentials/resource-logs-schema.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ The schema for resource logs varies depending on the resource and log category.
7272
| Azure Digital Twins | [Set up Azure Digital Twins diagnostics](../../digital-twins/troubleshoot-diagnostics.md#log-schemas)
7373
| Azure Event Hubs |[Azure Event Hubs logs](../../event-hubs/event-hubs-diagnostic-logs.md) |
7474
| Azure ExpressRoute | [Monitoring Azure ExpressRoute](../../expressroute/monitor-expressroute.md#collection-and-routing) |
75-
| Azure Firewall | [Logging for Azure Firewall](../../firewall/logs-and-metrics.md#diagnostic-logs) |
75+
| Azure Firewall | [Logging for Azure Firewall](../../firewall/diagnostic-logs.md) |
7676
| Azure Front Door | [Logging for Azure Front Door](../../frontdoor/front-door-diagnostics.md) |
7777
| Azure Functions | [Monitoring Azure Functions Data Reference Resource Logs](../../azure-functions/monitor-functions-reference.md#resource-logs) |
7878
| Azure IoT Hub | [IoT Hub operations](../../iot-hub/monitor-iot-hub-reference.md#resource-logs) |

‎articles/firewall/diagnostic-logs.md

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
title: Azure Firewall Diagnostic logs (legacy)
3+
description: Diagnostic logs are the original Azure Firewall log queries that output log data in an unstructured or free-form text format.
4+
services: firewall
5+
author: vhorne
6+
ms.service: firewall
7+
ms.topic: article
8+
ms.date: 12/04/2023
9+
ms.author: victorh
10+
---
11+
12+
# Azure Firewall diagnostic logs (legacy)
13+
14+
Diagnostic logs are the original Azure Firewall log queries that output log data in an unstructured or free-form text format.
15+
16+
The following log categories are supported in Diagnostic logs:
17+
18+
- Azure Firewall application rule
19+
- Azure Firewall network rule
20+
- Azure Firewall DNS proxy
21+
22+
## Application rule log
23+
24+
The Application rule log is saved to a storage account, streamed to Event hubs and/or sent to Azure Monitor logs only if you've enabled it for each Azure Firewall. Each new connection that matches one of your configured application rules results in a log for the accepted/denied connection. The data is logged in JSON format, as shown in the following examples:
25+
26+
```
27+
Category: application rule logs.
28+
Time: log timestamp.
29+
Properties: currently contains the full message.
30+
note: this field will be parsed to specific fields in the future, while maintaining backward compatibility with the existing properties field.
31+
```
32+
33+
```json
34+
{
35+
"category": "AzureFirewallApplicationRule",
36+
"time": "2018-04-16T23:45:04.8295030Z",
37+
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
38+
"operationName": "AzureFirewallApplicationRuleLog",
39+
"properties": {
40+
"msg": "HTTPS request from 10.1.0.5:55640 to mydestination.com:443. Action: Allow. Rule Collection: collection1000. Rule: rule1002"
41+
}
42+
}
43+
```
44+
45+
```json
46+
{
47+
"category": "AzureFirewallApplicationRule",
48+
"time": "2018-04-16T23:45:04.8295030Z",
49+
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
50+
"operationName": "AzureFirewallApplicationRuleLog",
51+
"properties": {
52+
"msg": "HTTPS request from 10.11.2.4:53344 to www.bing.com:443. Action: Allow. Rule Collection: ExampleRuleCollection. Rule: ExampleRule. Web Category: SearchEnginesAndPortals"
53+
}
54+
}
55+
```
56+
57+
## Network rule log
58+
59+
The Network rule log is saved to a storage account, streamed to Event hubs and/or sent to Azure Monitor logs only if you've enabled it for each Azure Firewall. Each new connection that matches one of your configured network rules results in a log for the accepted/denied connection. The data is logged in JSON format, as shown in the following example:
60+
61+
```
62+
Category: network rule logs.
63+
Time: log timestamp.
64+
Properties: currently contains the full message.
65+
note: this field will be parsed to specific fields in the future, while maintaining backward compatibility with the existing properties field.
66+
```
67+
68+
```json
69+
{
70+
"category": "AzureFirewallNetworkRule",
71+
"time": "2018-06-14T23:44:11.0590400Z",
72+
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
73+
"operationName": "AzureFirewallNetworkRuleLog",
74+
"properties": {
75+
"msg": "TCP request from 111.35.136.173:12518 to 13.78.143.217:2323. Action: Deny"
76+
}
77+
}
78+
79+
```
80+
81+
## DNS proxy log
82+
83+
The DNS proxy log is saved to a storage account, streamed to Event hubs, and/or sent to Azure Monitor logs only if you’ve enabled it for each Azure Firewall. This log tracks DNS messages to a DNS server configured using DNS proxy. The data is logged in JSON format, as shown in the following examples:
84+
85+
86+
```
87+
Category: DNS proxy logs.
88+
Time: log timestamp.
89+
Properties: currently contains the full message.
90+
note: this field will be parsed to specific fields in the future, while maintaining backward compatibility with the existing properties field.
91+
```
92+
93+
Success:
94+
```json
95+
{
96+
"category": "AzureFirewallDnsProxy",
97+
"time": "2020-09-02T19:12:33.751Z",
98+
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
99+
"operationName": "AzureFirewallDnsProxyLog",
100+
"properties": {
101+
"msg": "DNS Request: 11.5.0.7:48197 – 15676 AAA IN md-l1l1pg5lcmkq.blob.core.windows.net. udp 55 false 512 NOERROR - 0 2.000301956s"
102+
}
103+
}
104+
```
105+
106+
Failed:
107+
108+
```json
109+
{
110+
"category": "AzureFirewallDnsProxy",
111+
"time": "2020-09-02T19:12:33.751Z",
112+
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
113+
"operationName": "AzureFirewallDnsProxyLog",
114+
"properties": {
115+
"msg": " Error: 2 time.windows.com.reddog.microsoft.com. A: read udp 10.0.1.5:49126->168.63.129.160:53: i/o timeout”
116+
}
117+
}
118+
```
119+
120+
msg format:
121+
122+
`[client’s IP address]:[client’s port] – [query ID] [type of the request] [class of the request] [name of the request] [protocol used] [request size in bytes] [EDNS0 DO (DNSSEC OK) bit set in the query] [EDNS0 buffer size advertised in the query] [response CODE] [response flags] [response size] [response duration]`
123+
124+
## Storage
125+
126+
You have three options for storing your logs:
127+
128+
* **Storage account**: Storage accounts are best used for logs when logs are stored for a longer duration and reviewed when needed.
129+
* **Event hubs**: Event hubs are a great option for integrating with other security information and event management (SEIM) tools to get alerts on your resources.
130+
* **Azure Monitor logs**: Azure Monitor logs is best used for general real-time monitoring of your application or looking at trends.
131+
132+
## Enable diagnostic logs
133+
134+
To learn how to enable the diagnostic logging using the Azure portal, see [Monitor Azure Firewall logs (legacy) and metrics](firewall-diagnostics.md).
135+
136+
## Next steps
137+
138+
- [Azure Firewall metrics and alerts](metrics.md)

‎articles/firewall/firewall-best-practices.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ To maximize the [performance](firewall-performance.md) of your Azure Firewall an
2121

2222
- **High traffic throughput**
2323

24-
Azure Firewall Standard supports up to 30 Gbps, while Premium supports up to 100 Gbps. For more information, see the [throughput limitations](firewall-performance.md#performance-data). You can monitor your throughput or data processing in Azure Firewall metrics. For more information, see [Azure Firewall metrics](logs-and-metrics.md#metrics).
24+
Azure Firewall Standard supports up to 30 Gbps, while Premium supports up to 100 Gbps. For more information, see the [throughput limitations](firewall-performance.md#performance-data). You can monitor your throughput or data processing in Azure Firewall metrics. For more information, see [Azure Firewall metrics and alerts](metrics.md).
2525

2626
- **High Number of Connections**
2727

@@ -67,7 +67,7 @@ Use the following best practices for testing and monitoring:
6767
- **Identify rule hits and performance spikes**
6868
- Look for spikes in network performance or latency. Correlate rule hit timestamps, such as application rules hit count and network rules hit count, to determine if rule processing is a significant factor contributing to performance or latency issues. By analyzing these patterns, you can identify specific rules or configurations that you might need to optimize.
6969
- **Add alerts to key metrics**
70-
- In addition to regular monitoring, it's crucial to set up alerts for key firewall metrics. This ensures that you're promptly notified when specific metrics surpass predefined thresholds. To configure alerts, see [Azure Firewall logs and metrics](logs-and-metrics.md#alert-on-azure-firewall-metrics) for detailed instructions about setting up effective alerting mechanisms. Proactive alerting enhances your ability to respond swiftly to potential issues and maintain optimal firewall performance.
70+
- In addition to regular monitoring, it's crucial to set up alerts for key firewall metrics. This ensures that you're promptly notified when specific metrics surpass predefined thresholds. To configure alerts, see [Azure Firewall logs and metrics](metrics.md#alert-on-azure-firewall-metrics) for detailed instructions about setting up effective alerting mechanisms. Proactive alerting enhances your ability to respond swiftly to potential issues and maintain optimal firewall performance.
7171

7272
## Next steps
7373

0 commit comments

Comments
 (0)