At Ignite the Azure Monitor team has announced that you can now send subscription activity logs to Log Analytics. Wait? What? Isn’t that already available? And the answer yes it was available before but if we look closer you will see that the previous implementation was not very native to Azure. With the new implementation besides making the API better there are also other improvements like faster ingestion, ability to send different categories, etc.
Let’s have a look in ARM template how the previous implementation looked:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"logAnalyticsWorkspaceName": {
"type": "string",
"metadata": {
"description": "The name of the log analytics workspace."
}
},
"subscriptionIds": {
"type": "array",
"metadata": {
"description": "IDs of Azure Subscriptions in array"
}
}
},
"variables": {
"apiVersions": {
"dataSources": "2015-11-01-preview"
}
},
"resources": [
{
"name": "[concat(parameters('logAnalyticsWorkspaceName'), '/', replace(parameters('subscriptionIds')[copyIndex()], '-', ''))]",
"type": "Microsoft.OperationalInsights/workspaces/dataSources",
"apiVersion": "[variables('apiVersions').dataSources]",
"copy": {
"name": "activityLogsCopy",
"count": "[length(parameters('subscriptionIds'))]"
},
"kind": "AzureActivityLog",
"properties": {
"linkedResourceId": "[concat('/subscriptions/', parameters('subscriptionIds')[copyIndex()], '/providers/Microsoft.Insights/eventTypes/management')]"
}
}
]
}
As you will see above this is resource group level deployment and you are deploying child resource to the Log Analytics workspace.
With the new implementation the API has the following improvements:
- you are setting diagnostic settings on Azure Subscription just like any other resource in Azure
- the deployment is at subscription level
- you are just referencing the Log Analytics workspace
- you can choose which Azure Activity log categories to send
At the end the ARM template looks like this:
{
"$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"logAnalyticsWorkspaceId": {
"type": "string",
"metadata": {
"description": "the resource id of the log analytics workspace"
}
}
},
"variables": {
"apiVersions": {
"diagnosticSettings": "2017-05-01-preview"
}
},
"resources": [
{
"name": "subscriptionLogsToLogAnalytics",
"type": "Microsoft.Insights/diagnosticSettings",
"apiVersion": "[variables('apiVersions').diagnosticSettings]",
"location": "Global",
"properties": {
"workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
"logs": [
{
"category": "Administrative",
"enabled": true
},
{
"category": "Security",
"enabled": true
},
{
"category": "ServiceHealth",
"enabled": true
},
{
"category": "Alert",
"enabled": true
},
{
"category": "Recommendation",
"enabled": true
},
{
"category": "Policy",
"enabled": true
},
{
"category": "Autoscale",
"enabled": true
},
{
"category": "ResourceHealth",
"enabled": true
}
]
}
}
]
}
I hope you will find this tip useful.
Cloud Administrator in Azure World 
Thanks Stani for the ARM templates 🙂
Just one detail – with the previous implementation not all Azure Acitivity Logs were ingested in Log Analytics workspace. For example ServiceHealth alerts were never ingested.
True. I think I have mentioned that you can select all categories. I haven’t mentioned which categories were available with the previous implementation. I know that there were a few that weren’t there and ServiceHealth was one of them.
Great blog, do you know if you can set a LA workspace in another subscription as the destination? Thanks
Thank you! Yes you can. As long as the workspace is in the same tenant you can set workspace in another subscription. Having one central workspace for the tenant is still possible and it is my recommendation.
I’m trying to deploy this to a test subscription. I copied your example arm template as is and it does not work for me. I get the error:
“Code”: “BadRequest”,
“Message”: “”
}’
At line:1 char:1
I know, not a very descriptive error. I’ve tried a few things but continue to get this error. Is this template successful for you? Any idea why mine would be failing?
HI if you mean the second template example may the reason you are deploying at resource group level where the template needs to be deployed at subscription level. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription
I’m trying to deploy this to a test subscription. I copied your arm template as-is but it is not deploying successfully for me. I get this not very helpful error:
“Code”: “BadRequest”,
“Message”: “”
}’
At line:1 char:1
Any idea why this template wouldn’t work for me?
Thanks,
Steven
HI if you mean the second template example may the reason you are deploying at resource group level where the template needs to be deployed at subscription level. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription
Can’t believe I did that. Thanks for the quick reply.
no problem