Azure Data Explorer API as an Audit log?

Yuri Legachev 1

Hello!

I am thinking of usage Azure Data Explorer API as an audit log for customers.
So, our services can write important events to Kusto and then customers can use UI to retrieve and filter operations made, statuses and other important info.

Is Azure Data Explorer API good fit for that?
For instance, in terms of latency of queries or other technical challenges?

PRADEEPCHEEKATLA-MSFT 89,376 Reputation points Microsoft Employee

2022-10-10T07:00:52.223+00:00
Hello @Yuri Legachev ,

Following up to see if the below suggestion was helpful. And, if you have any further query do let us know.

------------------------------

Please don't forget to click on or upvote button whenever the information provided helps you.

1 answer

PRADEEPCHEEKATLA-MSFT 89,376 Reputation points Microsoft Employee

2022-09-16T05:58:43.183+00:00
Hello @Yuri Legachev ,

Thanks for the question and using MS Q&A platform.

I would say it's perfect fit for the data that you want to log and read later, there is latency but for these types of logs it's not critical. I can't think of anything that would be problematic though for this specific use case.

Hope this will help. Please let us know if any further queries.

------------------------------

Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how

Want a reminder to come back and check responses? Here is how to subscribe to a junotification

If you are interested in joining the VM program and help shape the future of Q&A: Here is jhow you can be part of [Q&A Volunteer Moderators][50]

[50]: https://learn.microsoft.com/en-us/answers/support/community-champions-program a
Please sign in to rate this answer.
Yuri Legachev 1 Reputation point

2022-09-16T17:28:50.647+00:00

thanks for the answer!
any numbers on latency? since we plan to fetch data and show on UI.
I don't think that customer will wait for 10 seconds

PRADEEPCHEEKATLA-MSFT 89,376 Reputation points Microsoft Employee

2022-09-20T06:17:01.283+00:00

Hello @Yuri Legachev ,

It could be in that range, depending on the data size.

The batching manager buffers and batches ingress data based on the ingestion settings in the ingestion batching policy. The ingestion batching policy sets batch limits according to three limiting factors, whichever is first reached: time elapsed since batch creation, accumulated number of items (blobs), or total batch size. The default batching settings are 5 minutes / 1 GB / 1000 blobs, meaning there will be at least a 5-minute delay when queueing a sample data for ingestion.

For more details, refer to How does batching affect my data?.

Yuri Legachev 1 Reputation point

2022-09-20T15:59:40.037+00:00

I am more concerned about querying latency.
If I use Kusto web explorer, even simple queries can take a minute or so.
Is there any info on it?

PRADEEPCHEEKATLA-MSFT 89,376 Reputation points Microsoft Employee

2022-09-21T06:21:29.443+00:00

Hello @Yuri Legachev ,

I am experiencing the same issue. As far as I can tell, the latency here is due to complexity of queries, most of the time the responses are within a few seconds for me.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Data Explorer API as an Audit log?

1 answer

Your answer