6.1.3.3. Configure Diagnostic Settings
š” First Principle: Diagnostic settings are the fundamental mechanism for exporting platform logs and metrics from Azure resources, enabling long-term archival, advanced analysis, and integration with other monitoring and security systems.
Scenario: Your organization needs to export all platform logs (e.g., read/write operations) and metrics from your Azure Storage Accounts to a central Log Analytics workspace for real-time analysis. Additionally, these logs need to be archived in a separate Storage Account for 7 years to meet compliance requirements.
What It Is: Diagnostic settings are a configuration feature for most Azure resources that allows you to specify which logs and metrics from that resource should be sent to specific destinations.
Types of data you can export:
- Activity Logs: Track operations at the subscription level.
- Resource Logs: Capture detailed actions within a specific resource.
- Metrics: Quantitative performance data.
Common destinations for diagnostic data:
- Log Analytics workspace: For querying and alerting using KQL.
- Storage account: For cost-effective, long-term archival.
- Event Hubs: For streaming data to external SIEMs or custom analytics solutions.
How to configure diagnostic settings (high-level):
- Go to the Azure resource in the portal.
- Select Diagnostic settings.
- Click Add diagnostic setting.
- Choose which log and metric categories to export.
- Select one or more destinations.
- Save the configuration.
Visual: Diagnostic Settings Data Flow
Loading diagram...
ā ļø Common Pitfall: Not enabling diagnostic settings for critical resources. Without them, you lose valuable audit trails and troubleshooting information that is not retained by default.
Key Trade-Offs:
- Real-time Analysis (Log Analytics) vs. Long-term Archival (Storage Account): Log Analytics is optimized for fast, interactive queries but is more expensive for long-term storage. A Storage Account is cheaper for archival but not suitable for real-time analysis.
Reflection Question: How does configuring diagnostic settings (choosing specific log/metric categories and multiple destinations) fundamentally enable you to achieve observability, compliance, and advanced troubleshooting by allowing retention and analysis of data beyond default limits?