Articles → MICROSOFT AZURE → Query Storage Account Logs In Azure Log Analytics

Query Storage Account Logs In Azure Log Analytics

In this article, we will query storage account logs in Azure log analytics.

Steps

For querying the storage account logs in log analytics, we will work on the following steps: -

Create a log analytics workspace
Create a storage account
Enable logging for storage account
Upload the file in storage account
Query log analytics

So, let’s get started.

Create A Log Analytics Workspace

First, create a log analytics workspace.

Picture showing the log analytics workspace created in Azure portal

Click to Enlarge

Create A Storage Account

Second step is to create a storage account.

Please Note That The Storage Account And Log Analytics Workspace Should Be In The Same Region.

Picture showing the storage account created in Azure portal

Click to Enlarge

Enable Logging For Storage Account

To enable logging, go to the detail screen of the storage account. On the left-hand side menu, click on the Diagnostic settings.

Picture showing the Diagnostic settings menu inside the storage account

Click to Enlarge

The diagnostic settings screen will appear on the right-hand side.

Click on the blob. A screen will appear to add a diagnostic setting for the blob.

Picture showing the diagnostic settings in Azure portal

Click to Enlarge

Click on the + Add diagnostic setting link (see the picture above). Another screen will appear.

Picture showing the screen for adding the diagnostic setting

Click to Enlarge

Enable the Logs and Destination details. Click on the Save button to save the changes.

Upload The File In Storage Account

Upload a file in a storage account.

Picture showing the screen to upload a file in the storage account

Click to Enlarge

Query Log Analytics

Write the following query in log analytics: -

StorageBlobLogs

You will get the following output: -

Picture showing querying the storage account using StorageBlobLogs query

Click to Enlarge

Posted By -	Karan Gupta

Posted On -	Thursday, August 18, 2022

Query/Feedback

Your Email Id		**

Subject		*

Query/Feedback	Characters remaining 250	**