Information about an existing diagnostic in Azure Monitor

Question

Hi,

I'd like to know who and when a Azure Monitor diagnostic was set for an Azure Data Factory resource.

Any suggests to me, please? Thanks

Answer 1

To determine who set up a diagnostic setting in Azure Monitor for an Azure Data Factory resource and when it was configured, you can follow these steps:

Step 1: Check the Activity Log in Azure

The Azure Activity Log captures all the operations and changes made to Azure resources, including the creation or modification of diagnostic settings.

1. Navigate to the Azure Portal: Go to portal.azure.com.
2. Go to the Activity Log:
   • In the left-hand menu, search for "Activity Log" and select it.
   • You can also access the Activity Log from within the Azure Data Factory resource itself. Navigate to the specific Data Factory, and then in the "Monitoring" section, select "Activity log."
3. Filter the Activity Log:
   • Set the filters to narrow down your search:
     • Time range: Set the appropriate time range when you believe the diagnostic setting was configured.
     • Resource: Select the specific Azure Data Factory resource.
     • Operation: Look for operations related to "Microsoft.Insights/diagnosticSettings" or "diagnosticSettings/write."
4. Review the Results:
   • Review the results for entries that indicate the creation or modification of diagnostic settings. These entries should show you the timestamp, the user who made the change, and the details of the operation.

Step 2: Use Azure Monitor Logs (Optional)

If the Activity Log doesn't provide enough detail or if you want more granular insights, you can query the logs via Azure Monitor Logs (Log Analytics).

1. Navigate to Logs:
   • In the Azure portal, navigate to "Monitor" and then select "Logs."
2. Query the Logs:
   • Use a query like the following to search for diagnostic settings changes:

   
      AzureActivity
   
      | where ResourceProvider == "MICROSOFT.INSIGHTS" and OperationNameValue == "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE"
   
      | where Resource == "<Your Data Factory Resource ID>"
   
      | project TimeGenerated, Caller, OperationName, Resource, Status
   
   

   Replace <Your Data Factory Resource ID> with the actual ID of your Data Factory resource.
3. Analyze the Logs:
   • This will give you a detailed view of who made changes to the diagnostic settings and when they were made.

Step 3: Review Resource Access

If necessary, you can also review the Azure Role-Based Access Control (RBAC) assignments to see who has permissions to modify diagnostic settings on the Data Factory resource.

1. Navigate to the Azure Data Factory resource.
2. Select "Access control (IAM)".
3. Review the roles and assignments to identify users who have permissions to modify diagnostics.