Configuring Resource-Specific Log Retention for Azure Diagnostic Settings

Question

Azure has announced that the Diagnostic Settings Storage Retention feature is being deprecated (https://aka.ms/diagnostic_settings_log_retention). My logs and metrics in AKS --> Monitor --> Diagnostics Settings are currently being sent directly to a Log Analytics workspace. However, I haven't found a way to specify the exact table to which they are sent by default? My current AKS logs and metrics have different retention periods than the default Log Analytics Workspace settings, so I would like to set resource-specific retention policies instead of relying on the default https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs?WT.mc_id=Portal-Microsoft_Azure_Monitoring#send-to-log-analytics-workspace .

For example, I would like to set Kubernetes API logs to retain for 30 days and Kubernetes cluster-autoscaler logs for 60 days. After switching to resource-specific tables, how can I identify the table name to adjust these retention policies accordingly? I've tried it on the test environment, and I don't see a new table was created.

Note: I know we can send logs and metrics to storage account and set up retention in there , but I want to keep them in logs analytics workspace.

P.S. your tags do not have Log Analytics Workspace

Answer 1

Hi,

If I understand correctly you are looking for information about the resource logs of AKS cluster and you want to know to which Log Analytics workspace tables they are send to. You can find information for every Azure resource that supports resource logs and metrics at Supported Resource log categories for Azure Monitor. Particularly for AKS clusters information is at Supported logs for Microsoft.ContainerService/managedClusters. There you will find information for every log category and to which table the logs are send. You can than assign different retention per any of those tables in Log Analytics. Metrics are stored in one table - AzureMetrics which is the same for all resources that support sending metrics so in case you apply retention on that table it will apply for all resources that send metrics to Log Analytics workspace.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.