Azure Logging

AzureActivity.md

AzureActivity table on Log Analytics Workspace

• Schema
• Supported services

AzureDiagnostics.md

AzureDiagnostics table on Log Analytics Workspace

• Schema for AzureDiagnostics table
  • Azure Diagnostics mode
  • Azure Diagnostics mode or resource-specific mode
• Categories

Azure Diagnostics mode schemas

• Azure-provided table: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs-schema

Service	Notes	Schema link
Analysis Services
Application Gateways
Automation Accounts
Azure Database for MariaDB servers
Azure Database for MySQL servers
Azure Database for PostgreSQL servers
Azure Database for PostgreSQL servers v2
Batch accounts
CDN profiles
Cognitive Services
Data Lake Analytics
DataLake Storage Gen1
Device Provisioning Services
Digital Twins
Event Grid Topics		🔗
Event Hubs		🔗
ExpressRoute circuits
Front Doors
Integration accounts
Key Vault	Might be soon AZKVAuditLogs table	🔗
Kubernetes services
Load balancers
Logic Apps
Media services
Network interfaces	Only metrics	-
Network Security Groups	See also1 for NSG flow logs	🔗
P2S VPN Gateways	Check: VWAN component
Power BI Embedded
Public IP addresses		🔗 Wrong link? requires DDOS protection plan to log something
Recovery Services vaults(Site Recovery)
Search services
Service Bus
SQL databases
SQL managed Instances
SQL servers
Stream Analytics jobs
Traffic Manager profiles
Virtual networks	No logs / Unused VM protection alerts category	-
Virtual network gateways	Regular VPN GW	🔗
VPN Gateways	Check: VWAN component

Azure Diagnostics mode or resource-specific mode

Service	Notes	Schema link
API Management Services
Azure Cosmos DB
Data factories (V2)
IoT Hub
Recovery Services vaults(Backup).
Firewalls

NSG logs

NSG flow logs can be periodically send to LAW table AzureNetworkAnalytics_CL with Traffic Analytics

• AzureNetworkAnalytics_CL Schema
• Example queries for AzureNetworkAnalytics_CL

Footnotes

1. Network Security Groups is documented to use AzureDiagnostics table and event and rule counters are being logged into Log Analytics Workspace. ↩

AzureDiagnosticsTablesPerResource.md

Resource-specific Azure diagnostics logging tables

• Categories