Azure Log Analytics - Revision history

Sam: /* Keys and ID */

2022-07-27T17:20:26Z

Keys and ID

Sam: /* Sample Config File */

2022-07-27T17:19:50Z

Sample Config File

Sam: /* Keys and ID */

2022-07-27T17:19:37Z

Keys and ID

Admin: Created page with "==AKA== Log Analytics has also been known as: * Operational Insights * Monitor ==Creation== In order to begin playing with Azure Log Analytics, you must first create a Log A..."

2020-05-18T20:45:12Z

Created page with "==AKA== Log Analytics has also been known as: * Operational Insights * Monitor ==Creation== In order to begin playing with Azure Log Analytics, you must first create a Log A..."

New page

==AKA==
Log Analytics has also been known as:
* Operational Insights
* Monitor

==Creation==

In order to begin playing with Azure Log Analytics, you must first create a Log Analytic Workspace (aka Operational Insights Workspace).
To do that, you must first have a [[Resource Group]].

# Go the Home page of Azure Portal
# In the "Search resources" edit control at the top of the page, type "Log Analytics" then select "Log Analytics workspaces" from the results.
# Click the "+ Add" button in the top menu bar
# Give the new workspace a name (truxlaw)
# Select the Subscription
# Select the [[Resource Group]] (truxlogs)
# Select the Location. For best results, use the same location as the [[Resource Group]] (US East or US East 2)
# Click OK
# Azure will go off and think about what you've done for a while, then tell you it succeeded. Wait a minute or two and refresh the web page to see the new workspace listed.

==Keys and ID==

In order for Truxton to log forensic items to Azure Monitor service, it must know where to send the log messages.

# Edit the <code>TruxtonSettings.xml</code> file in the "C:\ProgramData\Truxton\Settings" folder.
# Under the <code>truxton_options</code> element, create a new element named <code>AzureMonitor</code>
# Under the <code>AzureMonitor</code> element, create a new element named <code>LogAnalyticsWorkspaceID</code>
# Under the <code>AzureMonitor</code> element, create a new element named <code>APIKey</code>
# In a browser, go the Azure portal, locate your Log Analytics workspace.
# Select Advanced Settings and then Connected Sources.
# Under the "WORKSPACE ID" label, select the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID], copy and then paste it into the <code>LogAnalyticsWorkspaceID</code> element in <code>TruxtonSettings.xml</code>.
# Under the "PRIMARY KEY" label, select the text, copy and then paste it into the <code>APIKey</code> element in <code>TruxtonSettings.xml</code>.
# Save <code>TruxtonSettings.xml</code>

===Sample Config File===
<syntaxhighlight lang="xml">
<?xml version="1.0" encoding="utf-8"?>
<truxton_options>
<AzureMonitor>
<LogAnalyticsWorkspaceID>7d70d995-c49d-43f2-80d0-1253ef811c73</LogAnalyticsWorkspaceID>
<APIKey>YxNXhS8oXCjTXp87DMpEZAcLv5od3dTaSR0xzm3xzQWT7svsytJ/WQyyejLn9lbxI4VbM/ByzuTV8dgqW0V2eg==</APIKey>
</AzureMonitor>
<dbserver>localhost</dbserver>
<dbport>5432</dbport>
<dbname>Truxton</dbname>
<dbuser>postgres</dbuser>
<dbpassword>password</dbpassword>
<mqserver>localhost</mqserver>
<mqport>5432</mqport>
<mqname>TruxtonMessageBus</mqname>
<mquser>postgres</mquser>
<mqpassword>password</mqpassword>
<datadir>C:\Truxton Data</datadir>
<machineid>9D29E664-A4F2-48C3-88D2-BCF7CB5DEBBC</machineid>
<CreateTheDatabase>1</CreateTheDatabase>
<solr_url>http://localhost:8983/solr/truxton-core</solr_url>
</truxton_options>
</syntaxhighlight>

==References==
* [https://docs.microsoft.com/en-us/cli/azure/monitor/log-analytics/workspace?view=azure-cli-latest az] - You can create a log analytic workspace using:
<syntaxhighlight lang="powershell">
az monitor log-analytics workspace create
</syntaxhighlight>

@@ Line 29: / Line 29: @@
 # In a browser, go the Azure portal, locate your Log Analytics workspace.
 # Select Advanced Settings and then Connected Sources.
-# Under the "WORKSPACE ID" label, select the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID], copy and then paste it into the <code>LogAnalyticsWorkspaceID</code> element in <code>TruxtonSettings.xml</code>.
+# Under the "WORKSPACE ID" label, select the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID], copy and then paste it into the <code>LogAnalyticsWorkspaceID</code> element in <code>[[Configuration_System#Truxton_Settings_File|TruxtonSettings.xml]]</code>.
-# Under the "PRIMARY KEY" label, select the text, copy and then paste it into the <code>APIKey</code> element in <code>TruxtonSettings.xml</code>.
+# Under the "PRIMARY KEY" label, select the text, copy and then paste it into the <code>APIKey</code> element in <code>[[Configuration_System#Truxton_Settings_File|TruxtonSettings.xml]]</code>.
-# Save <code>TruxtonSettings.xml</code>
+# Save <code>[[Configuration_System#Truxton_Settings_File|TruxtonSettings.xml]]</code>
 ===Sample Config File===

@@ Line 34: / Line 34: @@
 ===Sample Config File===
-<syntaxhighlight lang="xml">
+<source lang="xml">
 <?xml version="1.0" encoding="utf-8"?>
 <truxton_options>
@@ Line 56: / Line 56: @@
    <solr_url>http://localhost:8983/solr/truxton-core</solr_url>
 </truxton_options>
-</syntaxhighlight>
+</source>
 ==References==

@@ Line 23: / Line 23: @@
 In order for Truxton to log forensic items to Azure Monitor service, it must know where to send the log messages.
-# Edit the <code>TruxtonSettings.xml</code> file in the "C:\ProgramData\Truxton\Settings" folder.
+# Edit the <code>[[Configuration_System#Truxton_Settings_File|TruxtonSettings.xml]]</code> file in the "C:\ProgramData\Truxton\Settings" folder.
 # Under the <code>truxton_options</code> element, create a new element named <code>AzureMonitor</code>
 # Under the <code>AzureMonitor</code> element, create a new element named <code>LogAnalyticsWorkspaceID</code>