Learn how Azure Activity Log works in Azure Monitoring

Azure Activity Log is an essential feature of Azure Monitor that tracks and records events related to Azure resources and their management. These logs provide insight into the operations performed on Azure resources, allowing you to monitor and investigate resource changes, user activities, and service health in a comprehensive manner. It serves as a primary tool for understanding the history of resource management activities within an Azure subscription, helping users identify unauthorized access, troubleshoot issues, and audit compliance.

Here’s a detailed breakdown of Azure Activity Log Events:

What are Activity Log Events?

Activity Log Events record all management operations that are performed on Azure resources and services within a specific Azure subscription. These events include any modification or interaction with Azure resources like virtual machines, storage accounts, and networking configurations. The activity log provides a detailed record of actions such as:

1. Who initiated the action (e.g., a user or service principal).

2. What action was performed (e.g., create, update, delete).

3. The resource that was affected.

4. The time at which the operation occurred.

The Activity Log focuses on management operations related to resources, not data operations within the resources themselves (e.g., reading or modifying files inside a storage account). It complements Azure Monitor Logs, which track data-level operations and performance metrics.

Components of Activity Log Events

Activity Log Events contain several key pieces of information that make them useful for auditing, monitoring, and troubleshooting. These components include:

1. Timestamp: The exact date and time when the event occurred.

2. Resource Name: The name of the Azure resource that was affected by the operation (e.g., virtual machine name, resource group).

3. Operation Name: The name of the action performed (e.g., "Create Virtual Machine", "Update Role Assignment").

4. Status: The outcome of the operation, indicating whether it was successful, failed, or canceled.

5. Initiated By: The identity (user or service principal) that performed the operation. This is especially useful for auditing and security purposes.

6. Operation Type: The category or type of the action (e.g., Create, Delete, Update, Action).

7. Event Level: The severity of the event. It can be Informational, Warning, or Error, indicating the level of importance or concern.

8. Resource Type: The type of Azure resource that was modified (e.g., Microsoft.Compute/virtualMachines, Microsoft.Network/networkInterfaces).

9. Event ID: A unique identifier for the event that can be used to reference and track the specific event.

Types of Activity Log Events

Activity logs in Azure are categorized into different types based on the action that was performed:

1. Create: Indicates the creation of a new resource or resource group. This can include creating a virtual machine, deploying an app, or creating a storage account.

2. Delete: Tracks when a resource is deleted. For example, if a virtual machine or an entire resource group is deleted, this action is logged.

3. Update: Any operation that changes the configuration or properties of an existing resource is logged here. This includes updating a VM size, changing network settings, or modifying security policies.

4. Action: Represents a custom operation that does not fall into the basic create, update, or delete categories. Examples include applying a policy, assigning a role, or initiating a backup process.

5. Write: Refers to operations that modify the state of a resource but do not fall under the typical "create" or "update" classifications. This could include configuration changes to services.

6. Read: Represents operations like querying or retrieving information about resources (not typically logged in Activity Logs, but useful for querying resources programmatically).

These types help you filter logs and focus on specific operations when investigating activities.

Key Operations Tracked by Activity Log

Azure Activity Logs record a wide range of operations across various services, including:

1. Resource Management: Operations related to creating, updating, and deleting resources. Examples include creating a new virtual machine, updating a database, or removing a storage account.

2. Role-Based Access Control (RBAC): Changes related to permissions, role assignments, and access control. For instance, logging who assigned a role to a user or granted access to a resource.

3. Policy and Compliance: Logs associated with the creation and application of Azure Policies, Azure Blueprints, or Compliance.

4. Network Operations: Operations related to network security groups, virtual networks, or load balancers, including creation, updates, or deletions.

5. Security-Related Actions: Security-focused operations such as security group rule changes, audit log access, or changes in security settings.

6. Billing and Subscription Management: Includes events such as starting or stopping a subscription, billing changes, or resource usage metrics.

7. Resource Health: Tracks incidents or issues related to Azure service health, such as when a service or resource goes down or experiences degraded performance.

8. Virtual Machine Management: Any VM-related operations such as creation, deletion, rebooting, scaling, or resizing of virtual machines.

9. Service Principal & Authentication Events: Tracks the creation or modification of service principals, authentication failures, or sign-in attempts.

How to Access and Query Activity Log Events

Azure Activity Logs can be accessed and queried in several ways:

1. Azure Portal: The simplest way to access activity logs is through the Azure Portal. The Activity Log section under Azure Monitor provides an easy-to-navigate interface where you can filter logs by time, resource, and action type.

   • Navigate to Azure Monitor > Activity Log.

   • Filter by Subscription, Resource Group, Resource, Time Range, Event Type, etc.

2. Azure CLI: You can use the Azure Command-Line Interface (CLI) to access the Activity Log and filter events.

xxxxxxxxxx
4
1
az monitor activity-log list \
2
--resource-group MyResourceGroup \
3
--start-time '2024-12-01T00:00:00Z' \
4
--end-time '2024-12-10T23:59:59Z'

3. Azure PowerShell: Similar to the CLI, you can use PowerShell cmdlets to query the activity log. For example:

xxxxxxxxxx
4
1
Get-AzActivityLog `
2
-ResourceGroupName 'MyResourceGroup' `
3
-StartTime '2024-12-01' `
4
-EndTime '2024-12-10'

4. Azure Monitor Logs: You can route Activity Log data to Azure Log Analytics and use KQL (Kusto Query Language) to query and analyze it further. This is especially useful for setting up alerts and advanced reporting. Example of a KQL query to filter events in Log Analytics:

xxxxxxxxxx
3
1
AzureActivity
2
| where TimeGenerated > ago(7d)
3
| where OperationName == "Create Virtual Machine"

Common Use Cases for Activity Log Events

Activity Log Events are useful for a variety of scenarios, including:

1. Audit and Compliance: Activity logs are crucial for auditing user actions and resource management to meet regulatory compliance. They help track who performed an action and whether it was authorized. Example: Audit changes in access control, permissions, or role assignments.

2. Troubleshooting and Incident Investigation: When troubleshooting issues related to resource configurations or access problems, Activity Logs can pinpoint when changes occurred and what actions were taken before or after an incident. Example: A resource went down, and you need to check if any updates or deletions occurred before the outage.

3. Security Monitoring: Activity logs can help detect security threats, such as unauthorized access or configuration changes made by malicious actors. Example: An alert is triggered if a user adds a new user to an Azure Active Directory role or changes network security settings unexpectedly.

4. Change Management: Monitoring changes to resources helps organizations control updates and deployments, ensuring that modifications are deliberate and follow change management processes. Example: Track modifications to critical production resources to ensure they align with operational policies.

5. Performance Monitoring: While Activity Logs mainly track resource management, they can also provide insights into service health, such as whether an Azure resource was successfully provisioned or if an update failed. Example: Track the completion status of resource provisioning or scaling actions.

Setting Up Alerts for Activity Log Events

You can create alerts on Activity Log Events to notify you about important actions or potential issues. These alerts help you stay on top of changes to resources and can automatically trigger workflows or notify administrators.

1. Example Alerting Scenarios:

   • Notify when a critical resource is deleted or modified.

   • Alert when an unauthorized user performs an action, like creating or deleting a resource.

   • Send an alert if role assignments are changed or security policies are modified.

2. Creating Alerts: Alerts can be created using the Azure Portal under Azure Monitor > Alerts > + New Alert Rule, and you can specify the criteria, conditions, and actions to take.

   Example: An alert when a user deletes a resource.

xxxxxxxxxx
2
1
AzureActivity
2
| where OperationName == "Delete" and Resource == "Virtual Machine"

Data Retention and Pricing

1. Retention: By default, Azure Activity Logs are retained for 90 days, but they can be retained for longer periods if needed. You can configure data retention by exporting logs to Log Analytics workspaces, Event Hub, or Storage Accounts for long-term storage.

2. Cost: While activity logs are free for viewing within the portal, exporting logs to storage or Log Analytics may incur additional charges based on the data volume and retention period.

Summary

Azure Activity Log Events are a vital component of the Azure monitoring ecosystem. They provide an extensive record of resource management actions, including who did what and when. These logs are essential for auditing, compliance, troubleshooting, security monitoring, and performance analysis. By understanding and leveraging Activity Log Events, organizations can ensure better operational control, enhance security, and maintain an efficient, compliant environment across their Azure resources.