Azure Automation: Enable Diagnostic Settings

Azure Diagnostic Logs are logs emitted by a resource that provide rich, frequent data about the operation of that resource. To enable Azure Diagnostic Settings you can do this manually by Azure Portal or by PowerShell/CLI via Azure Cloud Shell.

Initially, when I looked at this topic I created a PowerShell script in Azure Automation to do this task automatically, I mean I was looking for an automated solution to enable logs to be sent to a log analytics workspace and also to a storage account. For each resource that I have on a subscription, I enabled Azure Diagnostic Settings using this piece of code

Set-AzDiagnosticSetting `
   -Name "LogAnalyticsName" `
   -ResourceId "LogAnalyticsResourceID" `
   -Enabled $true `
   -WorkspaceId "WorkspaceAccountID"
  Set-AzDiagnosticSetting `
   -Name "DiagnosticSettingsName" `
   -ResourceId "ResourceIDForWhichYouEnableDiagnosticSettings" `
   -Enabled $true `
   -RetentionEnabled $true `
   -RetentionInDays "90" `
   -StorageAccountId "StorageAccountID"

As you can see with this piece of code I enable the logs to be sent to a Log Analytics Workspace and also to a storage account where to keep them for a period of 90 days.

Everything was fine for a very long period of time until a new release was deployed and suddenly diagnostic settings were no longer enabled and the retention period was no longer enforced.

I started troubleshooting this issue because I really wanted to have this implemented automatically by my PowerShell script way.

Finally, I managed to resolve this issue by understanding the fact that I need to go into each diagnostic settings category or metrics to enable and also enable the retention period, and for that, I used this piece of code

For storage account

$azdiag = Get-AzDiagnosticSetting -ResourceId "ResourceIDForEachYouWantToEnableDiagnosticSettings"
$azdiagLogs = $azdiag.Logs
foreach ($azdiagLog in $azdiagLogs) { 
 Set-AzDiagnosticSetting `
  -Name "CategoryDiagnosticSettingsName" `
  -ResourceId "ResourceIDForEachYouWantToEnableDiagnosticSettings" `
  -Enabled $True `
  -EnableLog $True `
  -Category $azdiagLog.Category `
  -StorageAccountId "StorageAccountID" `
  -RetentionEnabled $true `
  -RetentionInDays 10
}
$azdiagMetrics = $azdiag.Metrics
foreach ($azdiagMetric in $azdiagMetrics) {
 Set-AzDiagnosticSetting `
  -Name "MetricDiagnosticSettingsName" `
  -ResourceId "ResourceIDForEachYouWantToEnableDiagnosticSettings" `
  -Enabled $True `
  -EnableMetrics $True `
  -MetricCategory $azdiagMetric.Category `
  -StorageAccountId $storageID `
  -RetentionEnabled $True `
  -RetentionInDays 10
}

For Log Analytics Workspace

$azdiag = Get-AzDiagnosticSetting -ResourceId "ResourceIDForEachYouWantToEnableDiagnosticSettings"
$azdiagLogs = $azdiag.Logs
foreach ($azdiagLog in $azdiagLogs) { 
  Set-AzDiagnosticSetting `
   -Name "CategoryDiagnosticSettingsName" `
   -ResourceId "ResourceIDForEachYouWantToEnableDiagnosticSettings" `
   -Enabled $True `
   -EnableLog $True `
   -Category $azdiagLog.Category `
   -WorkspaceId "WokspaceAccountID"
}
$azdiagMetrics = $azdiag.Metrics
foreach ($azdiagMetric in $azdiagMetrics) {
 Set-AzDiagnosticSetting `
  -Name "MetricDiagnosticSettingsName" `
  -ResourceId "ResourceIDForEachYouWantToEnableDiagnosticSettings" `
  -Enabled $True `
  -EnableMetrics $True `
  -MetricCategory $azdiagMetric.Category `
  -WorkspaceId "WokspaceAccountID"
}

This is was the solution that I implemented and is working as expected.

This is how I enable NSG flow logs using Azure Automation PowerShell script

$nsgs = Get-AzNetworkSecurityGroup -ResourceGroupName "ResourceGroupName"
 foreach ($nsg in $nsgs) {       
  Set-AzNetworkWatcherConfigFlowLog `
   -NetworkWatcher "SubscriptionNetwrokWatcherDeployment" `
   -TargetResourceId "NSGResourceID" `
   -EnableFlowLog $True `
   -StorageAccountId "StorageAccountID" `
   -EnableRetention $True `
   -RetentionInDays 10 `
   -EnableTrafficAnalytics:$True `
   -Workspace "LoganalyticsWorkspaceAccount" `
   -TrafficAnalyticsInterval 60 
}      

This is how I enable SQL Server Audit using Azure Automation PowerShell script

Set-AzSqlServerAudit `
 -ResourceGroupName "ResourceGroupName" `
 -ServerName "SQLServerName" `
 -BlobStorageTargetState Enabled `
 -StorageAccountResourceId "StorageAccountID" `
 -RetentionInDays 10 `
 -LogAnalyticsTargetState Enabled `
 -WorkspaceResourceId "LoganalyticsWorkspaceAccount"

Azure Diagnostic Settings could not be enabled on all resources and that is the reason why you need to include this in you script also https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs-categories

For more details about Azure Diagnostics Settings please check this link also https://docs.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview and https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings

Thank you!

AmistadGroup IT Team

(https://www.amistadgroup.ro/)