AZ-305 Designing Microsoft Azure Infrastructure Solutions Exam

Recommend a Solution for Routing Logs

Evaluate and Configure Azure Log Routing Services

When configuring Azure log routing services, it is important to understand the different options available for throughput, retention, and cost efficiency. You can route logs to various endpoints such as Event Hubs, Log Analytics workspaces, and Storage Accounts depending on your organizational requirements.

Azure Monitor Resource Logs

Resource logs provide insights into operations performed by Azure resources. By default, these logs aren’t collected until you create diagnostic settings to route them to desired locations like Azure Monitor Logs, Azure Storage, and Azure Event Hubs.

• Collection: Logs must be configured through diagnostic settings specifying log categories.
• Routing Options:
  • Azure Monitor Logs: Suitable for detailed analysis.
  • Azure Storage: Ideal for backup or archiving.
  • Azure Event Hubs: Useful for integrating with SIEM platforms.

Azure Activity Log

The activity log hosts subscription-level events, capturing operations from an external perspective of each Azure resource.

• Collection: These events are automatic and stored separately.
• Routing Options: Similar to resource logs, you can route these logs to Azure Monitor Logs, Storage, and Event Hubs for enhanced analysis.

Comparison of Logging Solutions

Choosing between Event Hubs, Log Analytics workspaces, and Storage Accounts involves evaluating:

• Throughput: Event Hubs support high-volume, real-time data ingestion.
• Retention: Log Analytics provides flexible query options for long-term log analysis.
• Cost: Azure Storage might be more cost-effective for archiving large data volumes.

Implementation Procedures

For implementing diagnostic settings:

1. Sign in to the Azure portal.
2. Navigate to the relevant service’s diagnostic settings option.
3. Create diagnostic settings and select log categories.
4. Choose the destination for the logs (Event Hub, Log Analytics workspace, or Storage Account).

Integration with SIEM Tools

For routing logs to SIEM tools via Event Hubs:

1. Set up an Event Hub in your Azure subscription.
2. Configure diagnostic settings to stream logs to the Event Hub.
3. Integrate the Event Hub with tools like Splunk, Sumo Logic, or ArcSight.

Summary

In conclusion, understanding and configuring Azure log routing services efficiently leverage various storage and analytical tools, facilitating better monitoring, performance optimization, cost management, and enhanced security across Azure environments. By evaluating options like Event Hubs, Log Analytics workspaces, and Storage Accounts for their throughput, retention, and cost characteristics, you ensure that logs are routed to the most appropriate destinations based on your precise needs.