Diagram
A system architecture diagram showing Azure Activity Log and Resource Logs flowing through Diagnostic Settings to three destinations: Log Analytics workspace, Azure Storage account, and Azure Event Hubs, with the latter feeding external SIEM tools.
Routing Destination Tradeoffs
Selecting the ideal target for log routing involves evaluating data volume, retention needs, and budget boundaries. Choose Event Hubs when you must stream massive data volumes in real-time to external platforms without storing them in Azure. Choose a Log Analytics workspace when you require immediate query capabilities and advanced search syntax to investigate active incidents. Select a Storage account when your primary goal is cheap, long-term archiving for regulatory compliance where active querying is rarely needed.
Domain 1 of 3
8 practice questions
Practice this DomainLast updated