Log Routing (Diagnostic Settings)
Destinations · Limits · Streaming to SIEM · Policy at scale
Practice questions for this topic →
Destinations
| Destination | Use for |
|---|---|
| Log Analytics workspace | KQL queries, alerts, workbooks, Sentinel |
| Storage account | Cheap long-term archive and audit |
| Event Hubs | Stream to an external SIEM or tool (Splunk, QRadar, Elastic) |
| Partner solution | Supported Azure-native partner integrations |
Rules and limits
- Up to 5 diagnostic settings per resource; one destination of each type per setting, so two workspaces need two settings.
- Storage and Event Hubs destinations must be in the same region as the monitored resource, and must exist first. With firewalls or VNet rules, allow trusted Microsoft services to bypass.
- Delete a resource's diagnostic settings before deleting, renaming or moving it, or they can apply to a re-created resource and resume collection.
- A consumer reading from Event Hubs needs outbound ports 5671 and 5672. For SIEM streaming Microsoft suggests about 4 partitions to start, retention of at least 7 days and the default consumer group.
- Enforce at scale with an Azure Policy deployIfNotExists definition plus remediation for existing resources.
Exam Tips
Tick each tip once you can answer it without looking.
“Send resource logs to a third-party SIEM in near real time” → Diagnostic setting → Event Hubs.
“Archive logs for years at the lowest cost” → Diagnostic setting → Storage account (cool/archive, immutability if required).
“Send the same logs to two Log Analytics workspaces” → Two diagnostic settings. Trap: One setting can have only one destination of each type.
“Ensure every new storage account sends logs to the central workspace” → Azure Policy deployIfNotExists for diagnostic settings + remediation task.
“Query who deleted a resource 6 months ago” → Route the Activity log to a workspace. Trap: The portal only keeps 90 days.
“Storage destination in another region than the resource” → Not allowed: storage/Event Hubs must be in the same region.
“Entra ID sign-in and audit logs into Log Analytics” → Entra ID diagnostic settings (P1/P2 for sign-in logs).
“Diagnostic setting limits” → Up to 5 settings per resource; one destination of each type per setting. Trap: Storage and Event Hubs destinations must be in the same region as the resource.
“Resource deleted, renamed or moved” → Delete its diagnostic settings first or they can apply to a re-created resource. Trap: Firewalled Storage and Event Hubs need trusted Microsoft services allowed.
“Consumer reading monitoring data from Event Hubs” → Open outbound ports 5671 and 5672 (AMQP). Trap: Keep retention at 7 days or more.