How to enable to azure lab service logs to azure sentinel ? and How to send particular resource groups logs to particfular log anaytics workspace

Rohith Kumar 0 Reputation points
2023-10-17T07:17:05.1866667+00:00

Currently I am facing an issue with azure activity logs . We are having One subscription with two resource groups for that we have created another log analutics works space to divvide the logs currently we are having two log analytics workspaces but the problem is we have created log analytics worksspace with different resource gropus but data was coming as per the same . My question is their any possiblity to have only resourse gropus logs to log analytics workspace

Azure Lab Services
Azure Lab Services
An Azure service that is used to set up labs for classrooms, trials, development and testing, and other scenarios.
280 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Prrudram-MSFT 22,381 Reputation points
    2023-10-17T11:14:09.2666667+00:00

    Hi @Rohith Kumar

    Thank you for reaching out to the Microsoft Q&A platform.

    Yes, it is possible to send only specific resource group logs to a particular Log Analytics workspace in Azure. You can achieve this by creating a diagnostic setting for each resource group and specifying the Log Analytics workspace as the destination for the logs.

    Here are the steps to create a diagnostic setting for a resource group:

    In the Azure portal, navigate to the resource group for which you want to create a diagnostic setting.

    Click on "Diagnostic settings" under the "Monitoring" section.

    1. Click on "Add diagnostic setting" to create a new diagnostic setting.
    2. Give a name to the diagnostic setting and select the logs that you want to collect. You can select specific logs such as Activity Logs, Metrics, or Windows Event Logs.
    3. Under the "Destination details" section, select "Log Analytics" as the destination and choose the Log Analytics workspace that you want to send the logs to.
    4. Click on "Save" to create the diagnostic setting.
    5. Repeat the above steps for each resource group that you want to send logs to a specific Log Analytics workspace.

    By creating a diagnostic setting for each resource group, you can ensure that only the logs from that resource group are sent to the specified Log Analytics workspace.

    Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?WT.mc_id=Portal-Microsoft_Azure_Monitoring&tabs=portal

    I hope this helps you resolve the issue you are facing with Azure activity logs. Let me know if you have any other questions or need further assistance.

    Please click "Accept as answer" if this helps.

    0 comments