Configure a VM to feed its Event Logs into App Insights or the Data Lake?

Question

We want to add Azure cloud compute audit logs to Data Lake. For Virtual Machines, these would be Event Logs, and includes one time historical and ongoing. We want to do this for auditing purposes. Is there an option we can enable for this? We are trying to avoid having to feed this data manually extracting and then loading the data ourselves. So if there is an option in place that would be ideal!!

I looked into the possibility of ETW Events but isnt that just useful at the application level and not the VM level?

Ive also looked at this thread and there was a comment referring to an alternative solution called "Log Analytics" from Azure but clicking the link leads to an unknown page

Answer 1

@Cataster Thank you for reaching out.

If you need to ingest event logs into Azure Data Lake, you will need to build an ingestion pipeline that will extract and load data.

However, if the requirement is to hold this data for auditing purposes, Azure Monitor offers a cheaper and scalable option.
You can persist the event and activity logs (you can choose the retention period) not just for Virtual machines but for many other Azure services that you may provision in future.

Please refer to this document to understand more.
Monitor virtual machines with Azure Monitor

Log Analytics is a feature within Azure Monitor that lets you query the metrics and logs just like you would from Azure DataLake and lets you build reports and dashboards.

Read more here
Overview of Log Analytics in Azure Monitor

Please let us know if you have any further questions.

----------

If an answer is helpful, please click on or upvote which might help other community members reading this thread.