You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/essentials/activity-log.md
+17-2Lines changed: 17 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -182,9 +182,24 @@ Each event is stored in the PT1H.json file with the following format. This forma
182
182
183
183
## Legacy collection methods
184
184
185
+
If you're collecting activity logs using the legacy collection method, migrate to the [export method]() and disable the legacy collection using the [Data Sources - Delete API](https://docs.microsoft.com/en-us/rest/api/loganalytics/data-sources/delete?tabs=HTTP) as follows:
186
+
187
+
1. List all data sources connected to the workspace using the [Data Sources - List By Workspace API](https://docs.microsoft.com/en-us/rest/api/loganalytics/data-sources/list-by-workspace?tabs=HTTP#code-try-0) and filter for activity logs.
188
+
189
+
:::image type="content" source="media/activity-log/data-sources-list-by-workspace-api.png" alt-text="Screenshot showing the configuration of the Data Sources - List By Workspace API.":::
190
+
191
+
1. Find the connection you want to disable.
192
+
193
+
:::image type="content" source="media/activity-log/data-sources-list-by-workspace-api-connection.png" alt-text="Screenshot showing the connection information you need to copy from the output of the Data Sources - List By Workspace API.":::
194
+
195
+
1. Use the [Data Sources - Delete API](https://docs.microsoft.com/en-us/rest/api/loganalytics/data-sources/delete?tabs=HTTP) to stop collecting activity logs for the specific resource.
196
+
197
+
:::image type="content" source="media/activity-log/data-sources-delete-api.png" alt-text="Screenshot of the configuration of the Data Sources - Delete API.":::
198
+
### Managing legacy log profiles
199
+
185
200
Log profiles are the legacy method for sending the activity log to storage or event hubs. If you're using this method, consider transitioning to diagnostic settings, which provide better functionality and consistency with resource logs.
186
201
187
-
### [PowerShell](#tab/powershell)
202
+
####[PowerShell](#tab/powershell)
188
203
189
204
If a log profile already exists, you first must remove the existing log profile and then create a new one.
190
205
@@ -234,7 +249,7 @@ This sample PowerShell script creates a log profile that writes the activity log
0 commit comments