Azure Activity Log

[Ruediger Holzwarth]

Hi, we are exporting all Activity Logs (from all subscriptions) to a separate storage account. There they are stored as json files. How can I query the files for special events with powershell? Are there any apps in the store for this? Can I query it with OMS ?

[#2 · Accepted solution]

Hi You can configure you Azure Activity Logs to be send directly to Log Analytics (part of OMS). From there using the new query language you can perform many functions to get the data you want. You can find more here: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-activity If you want to use Storage accounts and PowerShell for this you will need to create some custom powershell scripts that pull the data from the storage account. This won't be an easy task and will require a lot of engineering. I suggest to use Log Analytics