ARM Authoring Azure Log Analytics Azure Monitor

ARM – Connect Activity Logs From Multiple Subscriptions As Log Analytics Workspace Data Source

Posted on Author stefanroth Comments(2)

image

Recently I had a requirement to automatically configure Activity Logs from multiple subscriptions to send their logs to a Log Analytics workspace. I am talking about this setting here…

image

There are many ways how to achieve this goal. If you are into PowerShell you could use this cmdlet New-AzureRMOperationalInsightsAzureActivityLogDataSource  (I like the name Smile), this would work perfectly. Another way could be to use the REST API to create or update the Log Analytics data sources. In my case I had the needed for an ARM template which I could pass a collection of subscription ids to it and then it would connect those subscriptions to a workspace…

image

If the workspace does not exist, it will be created. It is good to know, that we could send the Activity Logs from the subscriptions to multiple workspaces. Just execute the template and provide each time a new workspace name. This might be useful in certain scenarios.

This is a short post, but I think others have the same requirement and therefore it may help!

Find the ARM template here.

stefanroth
http://www.stefanroth.net

Related Articles
Azure Azure Log Analytics Dashboard OMS

Azure Log Analytics – Cross Workspace Query Resolve Workspace ID

Posted on Author stefanroth

At Ignite 2017 Microsoft introduced a new functionality in Azure Log Analytics (ALA) to write queries across workspaces. This has been a long awaited feature for many customers. Why? Let’s imagine you want to provide IT services for customers and you would like to keep data separated for each customer in its own workspace.  At […]
Authoring Management Pack Software Xplat

SCOM 2012 – Unix/Linux Dynamic Grouping Using VSAE Authoring

Posted on Author stefanroth

SCOM is a great tool for monitoring cross platform systems as for example Linux or other Unix derivate. Although Microsoft invested a lot in cross platform monitoring, one thing I am missing is a way for dynamic grouping Unix/Linux systems in SCOM. What is the problem? As you might know in SCOM you can create […]
API Application Insights Azure Monitor

Azure Monitor – Application Insights Web Test Query Azure Resource Graph

Posted on Author stefanr5

Back in the good, old SCOM days, there was a thing called Global Service Monitor (GSM) which is still available. What was / is GSM? System Center Global Service Monitor is a cloud service that provides a simplified way to monitor the availability of external-web-based applications from multiple locations around the world. One of the […]

2 Replies to “ARM – Connect Activity Logs From Multiple Subscriptions As Log Analytics Workspace Data Source”

  1. Hi Stefan,
    It was a good article.
    Can I get your contact mail id to reach you?

    Thanks
    Krithika

    Reply

Leave a Reply to stefanroth Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.