Collect Azure Activity logs

Overview

You can use the Azure Event Hubs Listener to collect Azure Activity Logs.

Prerequisites

In order to use the Azure Event Hubs Listener, you must activate the environment variable in your distributor using docker compose (AZURE_EVENTHUB_LISTENER_EXECUTION_ENABLED)

Azure Activity Logs Setup

In order to ingest activity logs and not hub events, we need to stream the logs to an event hub and configure diagnostic settings for Activity Logs.

1

Go to Azure Portal > Monitor > Activity Log.

2

Click Diagnostic Settings > Add diagnostic setting. Give the setting a name.

3

Select Stream to an event hub.

4

Choose your Event Hubs namespace and Event Hub.

5

Select All Metrics and the relevant log categories.

6

Save the settings and your Event Hub can now be used in the Listener.

For more information, see the Activity Logs documentation.

Azure Event Hubs Setup

There are various management credentials that Onum needs to communicate with the event hub:

• Event Hubs namespace

• Event hub

See the Azure Event Hubs documentation for how to create these.

Onum Setup

Log in to your Onum tenant and click Listeners > New listener. Double-click the Azure Event Hubs Listener. See the configuration steps in this article.