# Azure resource logs

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fazure%2Fazure-resource-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fazure%2Fazure-resource-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Resource logs (previously called diagnostic logs) record what happened *inside* an Azure resource: a connection to a PostgreSQL server, a blob created or deleted in a storage account. That is the data plane, as distinct from the [activity logs](https://coralogix.com/docs/integrations/azure/azure-activity-logs.md) that record operations performed *on* resources. Their contents vary by Azure service and resource type.

Getting them into Coralogix takes two moves: a diagnostic setting that streams the logs to an Event Hub, and the [Event Hub integration](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md) that forwards from there.

## What you need [​](#what-you-need- "Direct link to what-you-need-")

* An Azure account with an active subscription.
* An Event Hub namespace. If yours restricts public access, enable VNet support first. See the [optional configuration steps](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md).

Note

Not every resource type produces audit logs. The example below uses a PostgreSQL database.

## Export the logs to an Event Hub [​](#export-the-logs-to-an-event-hub- "Direct link to export-the-logs-to-an-event-hub-")

1

<!-- -->

.

Open diagnostic settings

Navigate to the resource, then select **Diagnostic settings** under **Monitoring**.

2

<!-- -->

.

Add a setting

Select **Add diagnostic setting** and give it a name.

3

<!-- -->

.

Pick the categories and destination

Select the **audit** category group, then under **Destination details** select **Stream to an event hub** and choose your subscription, namespace, event hub, and policy. Select **Save**.

[![Azure Diagnostic setting page with the audit category group selected and Stream to an event hub configured](/docs/assets/images/Untitled-30-1024x783-1c651de1eb1ec6bea9a2c98f795d3224.webp)](https://coralogix.com/docs/assets/images/Untitled-30-1024x783-1c651de1eb1ec6bea9a2c98f795d3224.webp)

Shows the log categories on the left and the Event Hub destination on the right.

## Forward from the Event Hub [​](#forward-from-the-event-hub- "Direct link to forward-from-the-event-hub-")

Deploy the Azure Event Hub integration to collect the messages and submit them to Coralogix. Two deployment paths are available:

| Path                                                                                                                              | Use                         |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| [Azure Event Hub ARM](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md)                | Deploy from an ARM template |
| [ARM Event Hub integration package](https://coralogix.com/docs/integrations/azure/azure-resource-manager-integration-packages.md) | Deploy the packaged version |
| [Azure Event Hub Terraform](https://coralogix.com/docs/integrations/azure/azure-event-hub-terraform-module.md)                    | Deploy with Terraform       |

Warning

Restart the function after deploying. It does not pick up the new diagnostic setting until it restarts.

## Related resources[​](#related-resources "Direct link to Related resources")

[Introduction to Microsoft Azure](https://coralogix.com/docs/integrations/azure/introduction-to-microsoft-azure.md)[Azure activity logs](https://coralogix.com/docs/integrations/azure/azure-activity-logs.md)[Optional Azure configurations](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md)