Azure Log Analytics

AKA

Log Analytics has also been known as:

• Operational Insights
• Monitor

Creation

In order to begin playing with Azure Log Analytics, you must first create a Log Analytic Workspace (aka Operational Insights Workspace). To do that, you must first have a Resource Group.

1. Go the Home page of Azure Portal
2. In the "Search resources" edit control at the top of the page, type "Log Analytics" then select "Log Analytics workspaces" from the results.
3. Click the "+ Add" button in the top menu bar
4. Give the new workspace a name (truxlaw)
5. Select the Subscription
6. Select the Resource Group (truxlogs)
7. Select the Location. For best results, use the same location as the Resource Group (US East or US East 2)
8. Click OK
9. Azure will go off and think about what you've done for a while, then tell you it succeeded. Wait a minute or two and refresh the web page to see the new workspace listed.

Keys and ID

In order for Truxton to log forensic items to Azure Monitor service, it must know where to send the log messages.

1. Edit the TruxtonSettings.xml file in the "C:\ProgramData\Truxton\Settings" folder.
2. Under the truxton_options element, create a new element named AzureMonitor
3. Under the AzureMonitor element, create a new element named LogAnalyticsWorkspaceID
4. Under the AzureMonitor element, create a new element named APIKey
5. In a browser, go the Azure portal, locate your Log Analytics workspace.
6. Select Advanced Settings and then Connected Sources.
7. Under the "WORKSPACE ID" label, select the GUID, copy and then paste it into the LogAnalyticsWorkspaceID element in TruxtonSettings.xml.
8. Under the "PRIMARY KEY" label, select the text, copy and then paste it into the APIKey element in TruxtonSettings.xml.
9. Save TruxtonSettings.xml

Sample Config File

<?xml version="1.0" encoding="utf-8"?>
<truxton_options>
  <AzureMonitor>
    <LogAnalyticsWorkspaceID>7d70d995-c49d-43f2-80d0-1253ef811c73</LogAnalyticsWorkspaceID>
    <APIKey>YxNXhS8oXCjTXp87DMpEZAcLv5od3dTaSR0xzm3xzQWT7svsytJ/WQyyejLn9lbxI4VbM/ByzuTV8dgqW0V2eg==</APIKey>
  </AzureMonitor>
  <dbserver>localhost</dbserver>
  <dbport>5432</dbport>
  <dbname>Truxton</dbname>
  <dbuser>postgres</dbuser>
  <dbpassword>password</dbpassword>
  <mqserver>localhost</mqserver>
  <mqport>5432</mqport>
  <mqname>TruxtonMessageBus</mqname>
  <mquser>postgres</mquser>
  <mqpassword>password</mqpassword>
  <datadir>C:\Truxton Data</datadir>
  <machineid>9D29E664-A4F2-48C3-88D2-BCF7CB5DEBBC</machineid>
  <CreateTheDatabase>1</CreateTheDatabase>
  <solr_url>http://localhost:8983/solr/truxton-core</solr_url>
</truxton_options>

References

• az - You can create a log analytic workspace using:

az monitor log-analytics workspace create