Azure Monitor Logs table reference organized by category
Applications
- AppAvailabilityResults
- AppBrowserTimings
- AppDependencies
- AppEvents
- AppExceptions
- AppMetrics
- AppPageViews
- AppPerformanceCounters
- AppRequests
- AppServiceConsoleLogs
- AppSystemEvents
- AppTraces
- ContainerLog
- FunctionAppLogs
Audit
- AACAudit
- AADB2CRequestLogs
- AADManagedIdentitySignInLogs
- AADNonInteractiveUserSignInLogs
- AADProvisioningLogs
- AADRiskyServicePrincipals
- AADRiskyUsers
- AADServicePrincipalRiskEvents
- AADServicePrincipalSignInLogs
- AADUserRiskEvents
- ACICollaborationAudit
- ACRConnectedClientList
- ADFSSignInLogs
- ADPAudit
- AegDataPlaneRequests
- AEWAuditLogs
- AEWComputePipelinesLogs
- AgriFoodApplicationAuditLogs
- AGSGrafanaLoginEvents
- AmlComputeInstanceEvent
- AmlDataLabelEvent
- AmlDataSetEvent
- AmlDataStoreEvent
- AmlDeploymentEvent
- AmlEnvironmentEvent
- AmlInferencingEvent
- AmlModelsEvent
- AmlOnlineEndpointConsoleLog
- AmlOnlineEndpointEventLog
- AmlOnlineEndpointTrafficLog
- AmlPipelineEvent
- AmlRegistryReadEventsLog
- AmlRegistryWriteEventsLog
- AmlRunEvent
- AMSKeyDeliveryRequests
- AMSLiveEventOperations
- AMSMediaAccountHealth
- AMSStreamingEndpointRequests
- ASCAuditLogs
- ASCDeviceEvents
- AVNMNetworkGroupMembershipChange
- AzureActivity
- AzureLoadTestingOperation
- CassandraAudit
- CCFApplicationLogs
- CDBCassandraRequests
- CDBControlPlaneRequests
- CDBDataPlaneRequests
- CDBGremlinRequests
- CDBMongoRequests
- CDBPartitionKeyRUConsumption
- CDBPartitionKeyStatistics
- CDBQueryRuntimeStatistics
- ChaosStudioExperimentEventLogs
- CIEventsAudit
- ContainerAppConsoleLogs
- ContainerAppSystemLogs
- DevCenterDiagnosticLogs
- HDInsightGatewayAuditLogs
- HDInsightRangerAuditLogs
- LAQueryLogs
- MicrosoftGraphActivityLogs
- MicrosoftHealthcareApisAuditLogs
- MicrosoftPurviewInformationProtection
- NSPAccessLogs
- PFTitleAuditLogs
- PowerBIActivity
- PowerBIAuditTenant
- REDConnectionEvents
- SentinelAudit
- VIAudit
Azure Monitor
- Alert
- AlertHistory
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- ComputerGroup
- Operation
- Usage
- WorkloadDiagnosticLogs
Azure Resources
- AACHttpRequest
- AADDomainServicesAccountLogon
- AADDomainServicesAccountManagement
- AADDomainServicesDirectoryServiceAccess
- AADDomainServicesLogonLogoff
- AADDomainServicesPolicyChange
- AADDomainServicesPrivilegeUse
- ABSBotRequests
- ACICollaborationAudit
- ACRConnectedClientList
- ACSAuthIncomingOperations
- ACSBillingUsage
- ACSCallAutomationIncomingOperations
- ACSCallDiagnostics
- ACSCallRecordingSummary
- ACSCallSummary
- ACSChatIncomingOperations
- ACSEmailSendMailOperational
- ACSEmailStatusUpdateOperational
- ACSEmailUserEngagementOperational
- ACSNetworkTraversalDiagnostics
- ACSNetworkTraversalIncomingOperations
- ACSRoomsIncomingOperations
- ACSSMSIncomingOperations
- AddonAzureBackupAlerts
- AddonAzureBackupJobs
- AddonAzureBackupPolicy
- AddonAzureBackupProtectedInstance
- AddonAzureBackupStorage
- ADFActivityRun
- ADFPipelineRun
- ADFSandboxActivityRun
- ADFSandboxPipelineRun
- ADFTriggerRun
- ADPAudit
- ADPDiagnostics
- ADPRequests
- ADTDataHistoryOperation
- ADTDigitalTwinsOperation
- ADTEventRoutesOperation
- ADTModelsOperation
- ADTQueryOperation
- ADXJournal
- AegDataPlaneRequests
- AegDeliveryFailureLogs
- AegPublishFailureLogs
- AEWAuditLogs
- AEWComputePipelinesLogs
- AgriFoodApplicationAuditLogs
- AgriFoodFarmManagementLogs
- AgriFoodFarmOperationLogs
- AgriFoodInsightLogs
- AgriFoodJobProcessedLogs
- AgriFoodModelInferenceLogs
- AgriFoodProviderAuthLogs
- AgriFoodSatelliteLogs
- AgriFoodSensorManagementLogs
- AgriFoodWeatherLogs
- AGSGrafanaLoginEvents
- AHDSMedTechDiagnosticLogs
- AmlComputeClusterEvent
- AmlComputeClusterNodeEvent
- AmlComputeCpuGpuUtilization
- AmlComputeInstanceEvent
- AmlComputeJobEvent
- AmlDataLabelEvent
- AmlDataSetEvent
- AmlDataStoreEvent
- AmlDeploymentEvent
- AmlEnvironmentEvent
- AmlInferencingEvent
- AmlModelsEvent
- AmlOnlineEndpointConsoleLog
- AmlOnlineEndpointEventLog
- AmlOnlineEndpointTrafficLog
- AmlPipelineEvent
- AmlRegistryReadEventsLog
- AmlRegistryWriteEventsLog
- AmlRunEvent
- AmlRunStatusChangedEvent
- AMSKeyDeliveryRequests
- AMSLiveEventOperations
- AMSMediaAccountHealth
- AMSStreamingEndpointRequests
- ApiManagementGatewayLogs
- AppPlatformContainerEventLogs
- AppPlatformIngressLogs
- AppPlatformLogsforSpring
- AppPlatformSystemLogs
- AppServiceAppLogs
- AppServiceAuditLogs
- AppServiceConsoleLogs
- AppServiceFileAuditLogs
- AppServiceHTTPLogs
- AppServicePlatformLogs
- ASCAuditLogs
- ASCDeviceEvents
- ATCExpressRouteCircuitIpfix
- AuditLogs
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- AVNMNetworkGroupMembershipChange
- AZFWFlowTrace
- AzureActivity
- AzureAttestationDiagnostics
- AzureDiagnostics
- AzureLoadTestingOperation
- AzureMetrics
- BaiClusterEvent
- BaiClusterNodeEvent
- BaiJobEvent
- BlockchainApplicationLog
- BlockchainProxyLog
- CCFApplicationLogs
- CDBCassandraRequests
- CDBControlPlaneRequests
- CDBDataPlaneRequests
- CDBGremlinRequests
- CDBMongoRequests
- CDBPartitionKeyRUConsumption
- CDBPartitionKeyStatistics
- CDBQueryRuntimeStatistics
- ChaosStudioExperimentEventLogs
- CIEventsAudit
- CIEventsOperational
- ContainerAppConsoleLogs
- ContainerAppSystemLogs
- CoreAzureBackup
- DatabricksAccounts
- DatabricksClusters
- DatabricksDBFS
- DatabricksFeatureStore
- DatabricksGenie
- DatabricksGitCredentials
- DatabricksGlobalInitScripts
- DatabricksIAMRole
- DatabricksInstancePools
- DatabricksJobs
- DatabricksMLflowAcledArtifact
- DatabricksMLflowExperiment
- DatabricksNotebook
- DatabricksRemoteHistoryService
- DatabricksSecrets
- DatabricksSQLPermissions
- DatabricksSSH
- DatabricksWebTerminal
- DatabricksWorkspace
- DevCenterDiagnosticLogs
- DSMAzureBlobStorageLogs
- DSMDataClassificationLogs
- DSMDataLabelingLogs
- FailedIngestion
- FunctionAppLogs
- HDInsightAmbariClusterAlerts
- HDInsightAmbariSystemMetrics
- HDInsightGatewayAuditLogs
- HDInsightHadoopAndYarnLogs
- HDInsightHadoopAndYarnMetrics
- HDInsightHBaseLogs
- HDInsightHBaseMetrics
- HDInsightHiveAndLLAPLogs
- HDInsightHiveAndLLAPMetrics
- HDInsightHiveQueryAppStats
- HDInsightHiveTezAppStats
- HDInsightJupyterNotebookEvents
- HDInsightKafkaLogs
- HDInsightKafkaMetrics
- HDInsightOozieLogs
- HDInsightRangerAuditLogs
- HDInsightSecurityLogs
- HDInsightSparkApplicationEvents
- HDInsightSparkBlockManagerEvents
- HDInsightSparkEnvironmentEvents
- HDInsightSparkExecutorEvents
- HDInsightSparkExtraEvents
- HDInsightSparkJobEvents
- HDInsightSparkLogs
- HDInsightSparkSQLExecutionEvents
- HDInsightSparkStageEvents
- HDInsightSparkStageTaskAccumulables
- HDInsightSparkTaskEvents
- HDInsightStormLogs
- HDInsightStormMetrics
- HDInsightStormTopologyMetrics
- InsightsMetrics
- IoTHubDistributedTracing
- LogicAppWorkflowRuntime
- MCCEventLogs
- MCVPAuditLogs
- MCVPOperationLogs
- MicrosoftAzureBastionAuditLogs
- MicrosoftDataShareReceivedSnapshotLog
- MicrosoftDataShareSentSnapshotLog
- MicrosoftHealthcareApisAuditLogs
- NSPAccessLogs
- OEPAirFlowTask
- OEPElasticOperator
- OEPElasticsearch
- OLPSupplyChainEntityOperations
- OLPSupplyChainEvents
- PFTitleAuditLogs
- PowerBIAuditTenant
- PowerBIDatasetsTenant
- PowerBIDatasetsWorkspace
- PowerBIReportUsageTenant
- PowerBIReportUsageWorkspace
- PurviewDataSensitivityLogs
- PurviewScanStatusLogs
- PurviewSecurityLogs
- REDConnectionEvents
- ResourceManagementPublicAccessLogs
- ServiceFabricOperationalEvent
- ServiceFabricReliableActorEvent
- ServiceFabricReliableServiceEvent
- SignalRServiceDiagnosticLogs
- SigninLogs
- SQLSecurityAuditEvents
- StorageBlobLogs
- StorageCacheOperationEvents
- StorageCacheUpgradeEvents
- StorageCacheWarningEvents
- StorageFileLogs
- StorageMalwareScanningResults
- StorageMoverCopyLogsFailed
- StorageMoverCopyLogsTransferred
- StorageMoverJobRunLogs
- StorageQueueLogs
- StorageTableLogs
- SucceededIngestion
- SynapseBigDataPoolApplicationsEnded
- SynapseBuiltinSqlPoolRequestsEnded
- SynapseDXCommand
- SynapseDXFailedIngestion
- SynapseDXIngestionBatching
- SynapseDXQuery
- SynapseDXSucceededIngestion
- SynapseDXTableDetails
- SynapseDXTableUsageStatistics
- SynapseGatewayApiRequests
- SynapseIntegrationActivityRuns
- SynapseIntegrationPipelineRuns
- SynapseIntegrationTriggerRuns
- SynapseLinkEvent
- SynapseRbacOperations
- SynapseScopePoolScopeJobsEnded
- SynapseScopePoolScopeJobsStateChange
- SynapseSqlPoolDmsWorkers
- SynapseSqlPoolExecRequests
- SynapseSqlPoolRequestSteps
- SynapseSqlPoolSqlRequests
- SynapseSqlPoolWaits
- TSIIngress
- VIIndexing
- WebPubSubConnectivity
- WebPubSubHttpRequest
- WebPubSubMessaging
Azure Virtual Desktop
- WVDCheckpoints
- WVDConnectionGraphicsDataPreview
- WVDConnectionNetworkData
- WVDConnections
- WVDErrors
- WVDFeeds
- WVDHostRegistrations
- WVDManagement
- WVDSessionHostManagement
Containers
- ContainerImageInventory
- ContainerInventory
- ContainerLog
- ContainerLogV2
- ContainerNodeInventory
- ContainerRegistryLoginEvents
- ContainerRegistryRepositoryEvents
- ContainerServiceLog
- Heartbeat
- InsightsMetrics
- KubeEvents
- KubeHealth
- KubeMonAgentEvents
- KubeNodeInventory
- KubePodInventory
- KubePVInventory
- KubeServices
- Perf
Databases
Desktop Analytics
- DHAppReliability
- DHDriverReliability
- DHLogonFailures
- DHLogonMetrics
- DHOSCrashData
- DHOSReliability
- DHWipAppLearning
- MAApplication
- MAApplicationHealth
- MAApplicationHealthAlternativeVersions
- MAApplicationHealthIssues
- MAApplicationInstance
- MAApplicationInstanceReadiness
- MAApplicationReadiness
- MADeploymentPlan
- MADevice
- MADeviceNotEnrolled
- MADeviceNRT
- MADeviceReadiness
- MADriverInstanceReadiness
- MADriverReadiness
- MAOfficeAddin
- MAOfficeAddinInstance
- MAOfficeAddinReadiness
- MAOfficeAppInstance
- MAOfficeAppReadiness
- MAOfficeBuildInfo
- MAOfficeCurrencyAssessment
- MAOfficeSuiteInstance
- MAProposedPilotDevices
- MAWindowsBuildInfo
- MAWindowsCurrencyAssessment
- MAWindowsCurrencyAssessmentDailyCounts
- MAWindowsDeploymentStatus
- MAWindowsDeploymentStatusNRT
- UAApp
- UAComputer
- UAComputerRank
- UADriver
- UADriverProblemCodes
- UAFeedback
- UAIESiteDiscovery
- UAOfficeAddIn
- UAProposedActionPlan
- UASysReqIssue
- UAUpgradedComputer
- UCDOAggregatedStatus
- UCDOStatus
- WaaSDeploymentStatus
- WaaSInsiderStatus
- WaaSUpdateStatus
- WDAVStatus
- WDAVThreat
- WUDOAggregatedStatus
- WUDOStatus
IT & Management Tools
- AddonAzureBackupAlerts
- AddonAzureBackupJobs
- AddonAzureBackupPolicy
- AddonAzureBackupProtectedInstance
- AddonAzureBackupStorage
- ComputerGroup
- ConfigurationChange
- ConfigurationData
- CoreAzureBackup
- Heartbeat
- IntuneAuditLogs
- IntuneDeviceComplianceOrg
- IntuneDevices
- IntuneOperationalLogs
- NetworkAccessTraffic
- Update
- UpdateRunProgress
- W3CIISLog
Network
- AVNMNetworkGroupMembershipChange
- AzureDiagnostics
- DnsEvents
- DnsInventory
- NetworkAccessTraffic
- NetworkMonitoring
- NSPAccessLogs
- NTAIpDetails
- NTANetAnalytics
- NTATopologyDetails
- NWConnectionMonitorDNSResult
- NWConnectionMonitorPathResult
- NWConnectionMonitorTestResult
Security
- AADB2CRequestLogs
- AADDomainServicesAccountLogon
- AADDomainServicesAccountManagement
- AADDomainServicesDirectoryServiceAccess
- AADDomainServicesLogonLogoff
- AADDomainServicesPolicyChange
- AADDomainServicesPrivilegeUse
- AADManagedIdentitySignInLogs
- AADNonInteractiveUserSignInLogs
- AADProvisioningLogs
- AADRiskyServicePrincipals
- AADRiskyUsers
- AADServicePrincipalRiskEvents
- AADServicePrincipalSignInLogs
- AADUserRiskEvents
- ADFSSignInLogs
- AlertEvidence
- AlertInfo
- Anomalies
- AppServiceServerlessSecurityPluginData
- ASimDnsActivityLogs
- ASimNetworkSessionLogs
- ASimWebSessionLogs
- AuditLogs
- AWSCloudTrail
- AWSCloudWatch
- AWSGuardDuty
- AWSVPCFlow
- AZFWApplicationRule
- AZFWApplicationRuleAggregation
- AZFWDnsQuery
- AZFWFatFlow
- AZFWIdpsSignature
- AZFWInternalFqdnResolutionFailure
- AZFWNatRule
- AZFWNatRuleAggregation
- AZFWNetworkRule
- AZFWNetworkRuleAggregation
- AZFWThreatIntel
- AzureActivity
- AzureDiagnostics
- BehaviorAnalytics
- CloudAppEvents
- CommonSecurityLog
- ConfidentialWatchlist
- DeviceEvents
- DeviceFileCertificateInfo
- DeviceFileEvents
- DeviceImageLoadEvents
- DeviceInfo
- DeviceLogonEvents
- DeviceNetworkEvents
- DeviceNetworkInfo
- DeviceProcessEvents
- DeviceRegistryEvents
- DeviceTvmSecureConfigurationAssessment
- DeviceTvmSecureConfigurationAssessmentKB
- DeviceTvmSoftwareInventory
- DeviceTvmSoftwareVulnerabilities
- DeviceTvmSoftwareVulnerabilitiesKB
- DSMAzureBlobStorageLogs
- DSMDataClassificationLogs
- DSMDataLabelingLogs
- DynamicEventCollection
- DynamicSummary
- EmailAttachmentInfo
- EmailEvents
- EmailPostDeliveryEvents
- EmailUrlInfo
- GCPAuditLogs
- HDInsightSecurityLogs
- HuntingBookmark
- IdentityDirectoryEvents
- IdentityLogonEvents
- IdentityQueryEvents
- LinuxAuditLog
- McasShadowItReporting
- MicrosoftGraphActivityLogs
- MicrosoftPurviewInformationProtection
- NetworkAccessTraffic
- NetworkSessions
- NSPAccessLogs
- OfficeActivity
- PowerBIActivity
- ProjectActivity
- ProtectionStatus
- PurviewDataSensitivityLogs
- SecurityAlert
- SecurityBaseline
- SecurityBaselineSummary
- SecurityDetection
- SecurityEvent
- SecurityIoTRawEvent
- SecurityRecommendation
- SentinelAudit
- SentinelHealth
- SigninLogs
- StorageMalwareScanningResults
- Syslog
- ThreatIntelligenceIndicator
- Update
- UrlClickEvents
- UserAccessAnalytics
- UserPeerAnalytics
- Watchlist
- WindowsEvent
- WindowsFirewall
- WireData
Virtual Machines
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- ComputerGroup
- ETWEvent
- Event
- Heartbeat
- InsightsMetrics
- Perf
- Syslog
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WireData
- WVDAgentHealthStatus
Workloads
- ADAssessmentRecommendation
- ADReplicationResult
- ADSecurityAssessmentRecommendation
- AzureAssessmentRecommendation
- DeviceAppCrash
- DeviceAppLaunch
- DeviceCalendar
- DeviceCleanup
- DeviceConnectSession
- DeviceEtw
- DeviceHardwareHealth
- DeviceHealth
- DeviceHeartbeat
- DeviceSkypeHeartbeat
- DeviceSkypeSignIn
- ExchangeAssessmentRecommendation
- ExchangeOnlineAssessmentRecommendation
- MicrosoftDynamicsTelemetryPerformanceLogs
- MicrosoftDynamicsTelemetrySystemMetricsLogs
- SCCMAssessmentRecommendation
- SCOMAssessmentRecommendation
- SfBAssessmentRecommendation
- SfBOnlineAssessmentRecommendation
- SharePointOnlineAssessmentRecommendation
- SPAssessmentRecommendation
- SQLAssessmentRecommendation
- SqlVulnerabilityAssessmentResult
- WindowsClientAssessmentRecommendation
- WindowsServerAssessmentRecommendation
- WorkloadDiagnosticLogs
- WorkloadMonitoringPerf