Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The following table lists the types of logs available for the Microsoft.Network/azureFirewalls resource type.
For a list of supported metrics, see Supported metrics - Microsoft.Network/azureFirewalls
| Category | Costs to export | Log table | Supports basic log plan | Supports ingestion-time transformation | Example queries |
|---|---|---|---|---|---|
| Azure Firewall Application Rule | Yes | AZFWApplicationRule Contains all Application rule log data. Each match between data plane and Application rule creates a log entry with the data plane packet and the matched rule's attributes. |
Yes | Yes | Queries |
| Azure Firewall Application Rule Aggregation (Policy Analytics) | Yes | AZFWApplicationRuleAggregation Contains aggregated Application rule log data for Policy Analytics. |
Yes | Yes | |
| Azure Firewall DNS Flow Trace Log | Yes | AZFWDnsFlowTrace Contains all the DNS proxy data between the client, firewall, and DNS server. |
Yes | No | |
| Azure Firewall DNS query | Yes | AZFWDnsQuery Contains all DNS Proxy events log data. |
Yes | Yes | Queries |
| Azure Firewall Fat Flow Log | Yes | AZFWFatFlow This query returns the top flows across Azure Firewall instances. Log contains flow information, date transmission rate (in Megabits per second units) and the time period when the flows were recorded. Please follow the documentation to enable Top flow logging and details on how it is recorded. |
Yes | Yes | Queries |
| Azure Firewall Flow Trace Log | Yes | AZFWFlowTrace Flow logs across Azure Firewall instances. Log contains flow information, flags and the time period when the flows were recorded. Please follow the documentation to enable flow trace logging and details on how it is recorded. |
Yes | Yes | Queries |
| Azure Firewall FQDN Resolution Failure | Yes | No | No | ||
| Azure Firewall IDPS Signature | Yes | AZFWIdpsSignature Contains all data plane packets that were matched with one or more IDPS signatures. |
Yes | Yes | Queries |
| Azure Firewall Nat Rule | Yes | AZFWNatRule Contains all DNAT (Destination Network Address Translation) events log data. Each match between data plane and DNAT rule creates a log entry with the data plane packet and the matched rule's attributes. |
Yes | Yes | Queries |
| Azure Firewall Nat Rule Aggregation (Policy Analytics) | Yes | AZFWNatRuleAggregation Contains aggregated NAT Rule log data for Policy Analytics. |
Yes | Yes | |
| Azure Firewall Network Rule | Yes | AZFWNetworkRule Contains all Network Rule log data. Each match between data plane and network rule creates a log entry with the data plane packet and the matched rule's attributes. |
Yes | Yes | Queries |
| Azure Firewall Network Rule Aggregation (Policy Analytics) | Yes | AZFWNetworkRuleAggregation Contains aggregated Network rule log data for Policy Analytics. |
Yes | Yes | |
| Azure Firewall Threat Intelligence | Yes | AZFWThreatIntel Contains all Threat Intelligence events. |
Yes | Yes | Queries |
| Azure Firewall Application Rule (Legacy Azure Diagnostics) | No | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries |
| Azure Firewall DNS Proxy (Legacy Azure Diagnostics) | No | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries |
| Azure Firewall Network Rule (Legacy Azure Diagnostics) | No | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries |
Next Steps
- Learn more about resource logs
- Stream resource logs to Event Hubs
- Change resource log diagnostic settings using the Azure Monitor REST API
- Analyze logs from Azure storage with Log Analytics
- Optimize log queries in Azure Monitor
- Aggregate data in a Log Analytics workspace by using summary rules (Preview)