Forward logs to Azure Blob Storage

Azure Blob Storage is Microsoft's object storage service for storing and analyzing data. This integration with Site24x7 lets you keep your AppLogs within your existing Azure environment.

No scripts or sync jobs are required. Site24x7 sends each completed log batch directly to the Blob Storage container you select, using the identity of an existing Azure monitor. You can then archive the logs in the cool tier (a lower-cost storage tier for data you access infrequently) or use them with services such as Azure Data Explorer.

Key capabilities of Site24x7's Azure Blob Storage integration

This integration provides the following capabilities:

• Forwards AppLogs to an Azure Blob Storage container.
• Authenticates through an existing Azure cloud monitor; no separate credentials are needed to manage.
• Supports hot and cool access tiers on the destination container.
• Delivers logs as gzip-compressed objects in a NDJSON, JSON, or CSV format.

Prerequisites

1. An Azure cloud monitor must already be configured in Site24x7. Forwarding authenticates to Blob Storage through that monitor's credentials.
   • If you haven't configured an Azure monitor account, add your Azure subscription under Admin > Inventory > Add Monitor > Microsoft Azure.
2. The monitor's credentials need write or create permission on the target container (for example, the Storage Blob Data Contributor role). Scope the role to the target container whenever possible.
3. The target container must already exist in your storage account. Objects are written under the optional path prefix you configure.

Configuring Azure blob storage integration

1. Log in to your account.
2. Navigate to Admin > Third-Party Integrations.
3. Click on the plus icon + next to the Log Forwarding to open the supported destination list.
4. Select Azure Blob and click Integrate Now.

This will open the integration page for the Azure blob destination. Enter the following details:

1. Basic Information: Provide the details of the destination to which the logs will be forwarded.
   • Name: Enter a label to identify this configuration.
   • Enable Forwarding: Toggle to Enabled to activate the configuration once saved.
2. Destinations: Choose where logs should be forwarded and configure destination credentials.
   • Destination Type: By default, Azure Blob is selected.
   • Azure Monitor: Select the existing Azure cloud monitor whose credentials are used to write to the bucket.
   • Storage Account: Select or enter the destination blob container account.
   • Path Prefix: Optionally, enter a virtual-folder prefix prepended to every blob name.
   • File Format: Select the file format NDJSON (default), JSON, or CSV. Learn more about the file formats.
     • Click Test Connection to test the connection and confirm the bucket is reachable and writable.
3. Filtering: Restrict which logs are forwarded by log type and query.
   • Log Types: Optionally, you can select the 100+ default log types whose data you want to forward, and enter a Filter Query to forward only matching records.
     • Click Add Log Type to add more than one query.
     • Click the X icon on the respective log type to remove the query.
4. Schedule and Retry: Control how often logs are forwarded and retry behavior occurs upon failure.
   • Forwarding Frequency: Select how often batches are written to the bucket; you can select any one from the following list:
     • Every 1 minute
     • Every 5 minutes
     • Every 15 minutes
     • Every 30 minutes
     • Every 60 minutes
   • Batch Size: Set the maximum number of records per object. Default is 1, 000. Learn more about the batching and delivery options.
   • Retry on Failure: Toggle to Enable to automatically retry failed deliveries.
   • Max Retires: Enter a number of maximum entries the forward can fail.
5. Click Save. Forwarding will begin with the next matching batch of incoming logs.
   
   

Managing the Azure Blob log forwarding configuration

1. Navigate to Admin > Third-Party Integrations > Log Forwarding.
2. Locate the configuration on the listing page. To make any changes, click the configured forwarding entry to open the Edit Configuration page.
3. Click the hamburger icon on the right corner of each configured forwarding entry to perform the following actions:
   1. Click Disable forwarding to temporarily stop forwarding.
   2. Click Enable forwarding to resume the forwarding.
   3. Click Delete to remove it permanently.

Related articles

• Azure diagnostic logs
• Azure NSG flow logs