Resource logs tell you what Azure resources are doing behind the scenes. These logs do not collect themselves; you must create diagnostic settings that tell Azure where to send them. The three main destinations are Azure Monitor Logs for searching and analyzing, Azure Storage for long-term backup, and Azure Event Hubs for sending logs to external security tools. Each destination serves a different purpose: Monitor Logs help you investigate problems, Storage keeps logs for compliance or audit needs, and Event Hubs stream data to SIEM platforms in real time.
The activity log records what happens at the subscription level, showing operations performed on Azure resources from an external viewpoint. Unlike resource logs, activity log events arrive automatically without any setup. You can route these events to the same three destinations—Monitor Logs, Storage, and Event Hubs—so you can search for changes, keep records for compliance, or feed them into security systems. The activity log acts as a record of who did what and when across your entire Azure environment.
Choosing where to send logs depends on three factors: how much data you have, how long you need to keep it, and how much you want to spend. Event Hubs handles the highest data volumes and works best when you need real-time streaming to external tools. Log Analytics workspaces store logs in a format optimized for searching and querying, making them ideal for investigation and troubleshooting. Storage Accounts cost the least for archiving large amounts of data you may need later but do not need to search frequently. The right choice depends on whether you prioritize speed, query capability, or cost efficiency.
To route logs, you configure diagnostic settings on each Azure service you want to monitor. The process involves selecting the resource, choosing which log categories to capture, and picking one or more destinations. You can send the same logs to multiple places—for example, streaming to Event Hubs for a SIEM while also storing copies in Storage for backup. Diagnostic settings act as the bridge between your Azure resources and wherever you want the logs to go.
Security teams often use SIEM tools like Splunk, SumoLogic, or ArcSight to monitor logs from many sources at once. Azure connects to these tools through Event Hubs, which streams logs in real time as they are generated. You create an Event Hub, configure diagnostic settings to send logs to it, and then the SIEM tool reads from the Event Hub. This setup lets security analysts see Azure activity alongside logs from on-premises systems, giving them a complete view of the organization's security posture.
Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Prepare and test your skills
Prepare and test your skills
The three main destinations are Azure Monitor Logs for searching and analyzing, Azure Storage for long-term backup, and Azure Event Hubs for sending logs to external security tools. Monitor Logs help investigate problems, Storage keeps logs for compliance or audit needs, and Event Hubs stream data to SIEM platforms in real time.
The Azure Activity Log records subscription-level operations performed on Azure resources from an external viewpoint and arrives automatically without any setup. Resource logs tell you what Azure resources are doing behind the scenes and require diagnostic settings to be routed.
The key factors are how much data you have, how long you need to keep it, and how much you want to spend. Event Hubs handles the highest data volumes for real-time streaming, Log Analytics workspaces are optimized for searching and querying, and Storage Accounts cost the least for archiving large amounts of data.
Azure connects to SIEM tools through Azure Event Hubs, which streams logs in real time as they are generated. You configure diagnostic settings to send logs to an Event Hub, and then the SIEM tool reads from the Event Hub to see Azure activity alongside logs from other sources.
StudyCerts
StudyCerts