Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Log query audit logs provide telemetry about log queries run in Azure Monitor. This includes information such as when a query was run, who ran it, what tool was used, the query text, and performance statistics describing the query's execution.
Configure query auditing
Query auditing is enabled with a diagnostic setting on the Log Analytics workspace. This allows you to send audit data to the current workspace or any other workspace in your subscription, to Azure Event Hubs to send outside of Azure, or to Azure Storage for archiving.
Configure auditing in the Azure portal
Access the diagnostic setting for a Log Analytics workspace in the Azure portal in either of the following locations:
From the Azure Monitor menu, select Diagnostic settings, and then locate and select the workspace.
From the Log Analytics workspaces menu, select the workspace, and then select Diagnostic settings.
Configure auditing by using a Resource Manager template
Get an example Resource Manager template from Diagnostic setting for Log Analytics workspace.
Audit data
An audit record is created each time a query is run. If you send the data to a Log Analytics workspace, it's stored in a table called LAQueryLogs. The following table describes the properties in each record of the audit data.
| Field | Description |
|---|---|
| TimeGenerated | UTC time when query was submitted. |
| CorrelationId | Unique ID to identify the query. Can be used in troubleshooting scenarios when contacting Microsoft for assistance. |
| AADObjectId | Microsoft Entra ID of the user account that started the query. |
| AADTenantId | ID of the tenant of the user account that started the query. |
| AADEmail | Email of the user account that started the query. |
| AADClientId | ID and resolved name of the application used to start the query. |
| RequestClientApp | Resolved name of the application used to start the query. For more information, see request client app. |
| QueryTimeRangeStart | Start of the time range selected for the query. This property might not be populated in certain scenarios such as when you start the query from Log Analytics, and specify the time range inside the query rather than using the time picker. |
| QueryTimeRangeEnd | End of the time range selected for the query. This property might not be populated in certain scenarios such as when you start the query from Log Analytics, and specify the time range inside the query rather than using the time picker. |
| QueryText | Text of the query that was run. |
| RequestTarget | API URL was used to submit the query. |
| RequestContext | List of resources that the query was requested to run against. Contains up to three string arrays: workspaces, applications, and resources. Subscription or resource group-targeted queries show as resources. Includes the target implied by RequestTarget. The resource ID for each resource is included if it can be resolved. It might not resolve if an error occurs when accessing the resource. In this case, the specific text from the query is used. If the query uses an ambiguous name, such as a workspace name existing in multiple subscriptions, this ambiguous name is used. |
| RequestContextFilters | Set of filters specified as part of the query invocation. Includes up to three possible string arrays: - ResourceTypes - type of resource to limit the scope of the query - Workspaces - list of workspaces to limit the query to - WorkspaceRegions - list of workspace regions to limit the query |
| ResponseCode | HTTP response code returned when the query was submitted. |
| ResponseDurationMs | Time for the response to be returned. |
| ResponseRowCount | Total number of rows returned by the query. |
| StatsCPUTimeMs | Total compute time used for computing, parsing and data fetching. Only populated if query returns with status code 200. |
| StatsDataProcessedKB | Amount of data that was accessed to process the query. Influenced by the size of the target table, time span used, filters applied, and the number of columns referenced. Only populated if query returns with status code 200. |
| StatsDataProcessedStart | Time of oldest data that was accessed to process the query. Influenced by the query explicit time span and filters applied. This might be larger than the explicit time span due to data partitioning. Only populated if query returns with status code 200. |
| StatsDataProcessedEnd | Time of newest data that was accessed to process the query. Influenced by the query explicit time span and filters applied. This might be larger than the explicit time span due to data partitioning. Only populated if query returns with status code 200. |
| StatsWorkspaceCount | Number of workspaces accessed by the query. Only populated if query returns with status code 200. |
| StatsRegionCount | Number of regions accessed by the query. Only populated if query returns with status code 200. |
Request Client App
| RequestClientApp | Description |
|---|---|
| AAPBI | Log Analytics integration with Power BI. |
| AppAnalytics | Experiences of Log Analytics in the Azure portal (such as the Logs blade). |
| AppInsightsPortalExtension | Workbooks or Application insights. |
| ASC_Portal | Microsoft Defender for Cloud. |
| ASI_Portal | Microsoft Sentinel. |
| AzureAutomation | Azure Automation. |
| AzureMonitorLogsConnector | Azure Monitor Logs Connector. |
| csharpsdk | Log Analytics Query API. |
| Draft-Monitor | Log search alert creation in the Azure portal. |
| Grafana | Grafana connector. |
| IbizaExtension | Experiences of Log Analytics in the Azure portal. |
| infraInsights/container | Container insights. |
| infraInsights/vm | VM insights. |
| LogAnalyticsExtension | Azure Dashboard. |
| LogAnalyticsPSClient | Log Analytics Query API. |
| OmsAnalyticsPBI | Log Analytics integration with Power BI. |
| PowerBIConnector | Log Analytics integration with Power BI. |
| Sentinel-Investigation-Queries | Microsoft Sentinel. |
| Sentinel-DataCollectionAggregator | Microsoft Sentinel. |
| Sentinel-analyticsManagement-customerQuery | Microsoft Sentinel. |
| Unknown | Log Analytics Query API. |
| UpdateManagement | Update Management. |
| M365D_AdvancedHunting | Advanced hunting in Microsoft Defender |
Query audit logging considerations
- The system logs queries only when you execute them in a user context. It doesn't log any service-to-service queries within Azure. This exclusion covers two main sets of queries: billing calculations and automated alert executions. For alerts, the system doesn't log alert queries triggered on a schedule. The initial execution of the alert in the alert creation screen runs in a user context though and is available for audit purposes.
- Performance statistics aren't available for queries that come from the Azure Data Explorer proxy. All other data for these queries is still populated.
- The system supports the h hint on strings that obfuscates string literals (it didn't previously).
- For queries that include data from multiple workspaces, the system captures the query only in those workspaces to which you have access.
Query audit data ingestion costs
There's no cost for enabling query auditing, but you might incur charges for the data ingested. Check Azure Monitor pricing for the destination where you're collecting data.
Next steps
- Learn more about diagnostic settings.
- Learn more about optimizing log queries.