ARM Authoring Azure Log Analytics Azure Monitor

ARM – Connect Activity Logs From Multiple Subscriptions As Log Analytics Workspace Data Source

image

Recently I had a requirement to automatically configure Activity Logs from multiple subscriptions to send their logs to a Log Analytics workspace. I am talking about this setting here…

image

There are many ways how to achieve this goal. If you are into PowerShell you could use this cmdlet New-AzureRMOperationalInsightsAzureActivityLogDataSource  (I like the name Smile), this would work perfectly. Another way could be to use the REST API to create or update the Log Analytics data sources. In my case I had the needed for an ARM template which I could pass a collection of subscription ids to it and then it would connect those subscriptions to a workspace…

image

If the workspace does not exist, it will be created. It is good to know, that we could send the Activity Logs from the subscriptions to multiple workspaces. Just execute the template and provide each time a new workspace name. This might be useful in certain scenarios.

This is a short post, but I think others have the same requirement and therefore it may help!

Find the ARM template here.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.