Azure Event Hub

[Sandeep_Poojary]

Once we enable the diagnostics settings for Azure Windows / Azure Linux machines, need to move the Events onto Azure Event Hub. Currently, there are no direct option, how we can move the data.

[#2]

https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-diagnostic-logs

You can stream to an event hub directly, under Diagnostic settings.

[#3]

Actually I am looking for only specific logs.

1. Windows / Application / System
2. All the success and failure login attempts
3. Would like to capture diagnostics agent logs too

I do not want to capture any performance counters.

[#4]

You can install the MMA agent and configure Log Analytics to capture the event logs and untick the performance counters:

https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events

I haven't done it, but this might be worth a read: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export?tabs=portal

[#5]

Thanks for the prompt response.
I am getting closer now. I was going through the given link. found some useful content.

As Diagnostics settinngs doesn't provide any direct method to send data from storage account to event hub.
We can configure one or more data sinks that send data to additional locations.

I am not clear, where from Azure portal I need to change or modify the code. under which section. neigther I am able to see this under storage account nor Event Hub.

https://docs.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-stream-event-hubs