Send Subscription Activity Logs via ARM Template


At Ignite the Azure Monitor team has announced that you can now send subscription activity logs to Log Analytics. Wait? What? Isn’t that already available? And the answer yes it was available before but if we look closer you will see that the previous implementation was not very native to Azure. With the new implementation besides making the API better there are also other improvements like faster ingestion, ability to send different categories, etc.

Let’s have a look in ARM template how the previous implementation looked:

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "logAnalyticsWorkspaceName": {
            "type": "string",
            "metadata": {
                "description": "The name of the log analytics workspace."
            }
        },
        "subscriptionIds": {
            "type": "array",
            "metadata": {
                "description": "IDs of Azure Subscriptions in array"
            }
        }
    },
    "variables": {
        "apiVersions": {
            "dataSources": "2015-11-01-preview"
        }
    },
    "resources": [
        {
            "name": "[concat(parameters('logAnalyticsWorkspaceName'), '/', replace(parameters('subscriptionIds')[copyIndex()], '-', ''))]",
            "type": "Microsoft.OperationalInsights/workspaces/dataSources",
            "apiVersion": "[variables('apiVersions').dataSources]",
            "copy": {
                "name": "activityLogsCopy",
                "count": "[length(parameters('subscriptionIds'))]"
            },
            "kind": "AzureActivityLog",
            "properties": {
                "linkedResourceId": "[concat('/subscriptions/', parameters('subscriptionIds')[copyIndex()], '/providers/Microsoft.Insights/eventTypes/management')]"
            }
        }
    ]
}

As you will see above this is resource group level deployment and you are deploying child resource to the Log Analytics workspace.

With the new implementation the API has the following improvements:

  • you are setting diagnostic settings on Azure Subscription just like any other resource in Azure
  • the deployment is at subscription level
  • you are just referencing the Log Analytics workspace
  • you can choose which Azure Activity log categories to send

At the end the ARM template looks like this:

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "logAnalyticsWorkspaceId": {
            "type": "string",
            "metadata": {
                "description": "the resource id of the log analytics workspace"
            }
        }
    },
    "variables": {
        "apiVersions": {
            "diagnosticSettings": "2017-05-01-preview"
        }
    },
    "resources": [
        {
            "name": "subscriptionLogsToLogAnalytics",
            "type": "Microsoft.Insights/diagnosticSettings",
            "apiVersion": "[variables('apiVersions').diagnosticSettings]",
            "location": "Global",
            "properties": {
                "workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
                "logs": [
                    {
                        "category": "Administrative",
                        "enabled": true
                    },
                    {
                        "category": "Security",
                        "enabled": true
                    },
                    {
                        "category": "ServiceHealth",
                        "enabled": true
                    },
                    {
                        "category": "Alert",
                        "enabled": true
                    },
                    {
                        "category": "Recommendation",
                        "enabled": true
                    },
                    {
                        "category": "Policy",
                        "enabled": true
                    },
                    {
                        "category": "Autoscale",
                        "enabled": true
                    },
                    {
                        "category": "ResourceHealth",
                        "enabled": true
                    }
                ]
            }
        }
    ]
}

I hope you will find this tip useful.

2 thoughts on “Send Subscription Activity Logs via ARM Template

  1. Thanks Stani for the ARM templates 🙂

    Just one detail – with the previous implementation not all Azure Acitivity Logs were ingested in Log Analytics workspace. For example ServiceHealth alerts were never ingested.

    1. True. I think I have mentioned that you can select all categories. I haven’t mentioned which categories were available with the previous implementation. I know that there were a few that weren’t there and ServiceHealth was one of them.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.