Day 12 - Azure Monitor and Log Analytics (2024)

FAQs

How long does Azure Monitor keep logs? ›

Azure Monitor Logs archive provides up to 12 years of retention.

In conclusion, Azure Monitor and Log Analytics collectively offer a robust solution for monitoring Azure resources. While Azure Monitor provides a lot of features including aggregation of logs, real-time insights and performance metrics, Log Analytics allows advanced query capabilities and extensive log data analysis.

The Time range in Azure Monitor Logs connector (preview) includes Exact time range option to let you pass the start-time and end-time dynamically, and satisfy scenarios such as alert diagnosis - When connector is triggered by alert, Azure Monitor Logs connector can be provided with the alert's time range dynamically, ...

Azure Monitor stores log data in a Log Analytics workspace. If you already created a workspace in your subscription, you can use that one. You can also choose to use the default workspace in each Azure subscription.

You can set a Log Analytics workspace's default retention in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. You can apply a different setting to specific tables by configuring retention and archive at the table level.

What is the duration of log retention? The default retention policy for log analytics workspace is usually 30 days. However, it can be altered and expanded as per the unique requirements.

Log Analytics is a tool in the Azure portal to edit and run log queries from data collected by Azure Monitor logs and interactively analyze their results. You can use Log Analytics queries to retrieve records that match particular criteria, identify trends, analyze patterns, and provide various insights into your data.

Explanation: Azure Monitor provides two primary data types for monitoring and analysis: Metrics and Logs. Metrics provide a numerical view of performance data, while Logs provide a detailed record of events and activities.

Metrics are numerical values that are collected at regular intervals and describe some aspect of a system at a particular time. Azure Monitor Metrics is one half of the data platform that supports Azure Monitor. The other half is Azure Monitor Logs, which collects and organizes log and performance data.

Can Azure activity log be longer than 90 days? ›

Send the activity log to an Azure Storage account if you want to retain your log data longer than 90 days for audit, static analysis, or back up. If you're required to retain your events for 90 days or less, you don't need to set up archival to a storage account.

The default timeout is 3 minutes. The maximum timeout is 10 minutes.

We will focus on Azure Monitor logs in this article. Within Microsoft Azure, there are two types of logs: Platform logs: the native logs of the Azure platform, made up of activity logs and resource logs. Application logs: the logs developers send from applications to Azure Monitor Logs.

Azure Monitor Logs is based on Azure Data Explorer, and log queries are written by using the same Kusto Query Language (KQL).

While Application Insights targets application monitoring and performance optimization, Log Analytics focuses on log management and infrastructure monitoring. However, it's worth noting that these tools can be used together to provide a comprehensive monitoring and analytics solution for organizations.

The retention period for user sign-in logs in the Azure portal depends on the Azure Active Directory (AAD) pricing tier that you have. In the Free and Basic tiers, sign-in logs are retained for 30 days.

Activity log events are retained in the Azure platform for 90 days.

The default retention for Application Insights resources is 90 days . Different retention periods can be selected for each Application Insights resource. The full set of available retention periods is 30, 60, 90, 120, 180, 270, 365, 550 or 730 days.