Skip to content

Commit da3e53b

Browse files
committed
Documentation updates
1 parent 8781545 commit da3e53b

File tree

4 files changed

+28
-1
lines changed

4 files changed

+28
-1
lines changed

event-hubs-hec/docs/activity_log_diagnostic_settings.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Sending Azure Activity log data to an Event Hub
22

3-
* From the Azure Portal, select the [Activity Log](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/activityLog) * Select Diagnostics settings
3+
* From the Azure Portal, select the [Activity Log](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/activityLog)
4+
* Select **Diagnostics settings**
45
* Choose an existing setting or create a new setting
56
* Give the diagnostic setting a name
67
* Select the events to log
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Sending Azure Active Directory log data to an Event Hub
2+
3+
## Create a common Azure Active Directory Event Hub
4+
* From the Azure Portal, select Event Hubs
5+
* Select your Event Hub Namespace
6+
* Select Event Hubs
7+
* Click the **+ Event Hub** button to create a new Event Hub
8+
* Name the hub `insights-logs-aad`
9+
* Note: `insights-logs-aad` is the default for the functions, but a different name may be used. If using a different event hub name, update the function application settings to reflect the correct event hub name.
10+
* Set the number of partitions
11+
* Note: at least 4 partitions are recommended
12+
* Click the **Create** button
13+
14+
## Send Azure Active Directory Logs to an Event Hub
15+
* From the Azure Portal, select Azure Active Directory
16+
* In the **Monitoring** section, select **Diagnostic settings**
17+
* Choose an existing setting or create a new setting
18+
* Give the diagnostic setting a name
19+
* Select the events to log
20+
* Note: `NonInteractiveUserSignInLogs` and `ServicePrincipalSignInLogs` are higher volume data sources. The recommended practice is to use a separate diagnostic setting to send these logs to a separate event hub. Specific functions are contained in this repository for `NonInteractiveUserSignInLogs` and `ServicePrincipalSignInLogs`
21+
* Select "Stream to an event hub"
22+
* Select your event hub details
23+
* ***Important:*** select the event hub created in the step above (`insights-logs-aad` by default)
24+
* Click the Save button
25+
26+
[![Azure AD Event Hub](images/AAD_Event_Hub.png)](images/AAD_Event_Hub.png)
287 KB
Loading
Binary file not shown.

0 commit comments

Comments
 (0)