Hello everyone, I'm Stefan from the
Azure monitor team and I would like to
show you how to forward your activity
logs into a log analytics workspace.
Activity logs are essential platform logs
that give you insights into the events which
take place on your Azure subscriptions.
These logs can be seen in the Azure
portal or retrieved programmatically using
tools such as PowerShell or Azure CLI.
But it can also be sent
to multiple destinations,
such as a storage account or an event hub.
As I mentioned today,
we will discuss about streaming
them into log analytics,
which is one of the most popular
destinations because it allows
you to take advantage of the
powerful Kusto query language.
Log Analytics also offers a
legacy way for ingesting activity
logs into the workspace.
However, it is not recommended as it
has high latency and doesn't offer
granular control over what logs
or categories are being ingested.
Therefore,
let's go ahead and forward some activity
logs to a workspace. I will go to monitor.
Activity log.
And then diagnostic settings.
I choose my subscription.
And create a new diagnostic setting.
And I will choose the administrative
and the security categories.
And then I'll forward them to workspace.
Which is going to be this one
demo activity log which stands
for log analytics workspace.
And then I'll hit save.
The next thing that I will do is
to remove this resource group.
I have to type its name.
And then hit delete.
Now that the resource group is removed,
I will wait for a few minutes and then go
to my workspace to find this operation.
Now I am inside the workspace.
If I go to the log section.
I will see multiple queries
that are already built for me.
I can look for something
related to activity logs.
And then click on one of the suggestions.
Naturally they would be more
useful in a real scenario with
production workloads than they are
for me in this demo environment.
Since I don't have any errors or warnings.
What I can look for is the
event that I'm interested in,
which is the removal of my resource group.
I can put in this query.
Make a bit more room. And then run it.
And I immediately get details about
the operation that I just performed.
I can see the time.
The IP of the caller.
The operation name value.
Or the resource ID.
I encourage you to read this
documentation article and get
yourself familiar with forwarding
activity logs to a workspace.
Thank you for using Microsoft services.