description Azure Log Analytics Overview
Within Microsoft Azure Monitor, Log Analytics provides an interface for querying and examining collected log data. It works with information stored in Log Analytics workspaces, including application logs and performance records from connected systems. Virtual machines and other infrastructure can contribute data when collection is configured. Kusto Query Language, usually shortened to KQL, lets analysts filter records and connect related events to investigate system behavior.
The tool suits IT administrators, developers and security analysts who need to understand failures or unusual activity across systems. Its distinction is the ability to investigate operational records through queries rather than viewing only individual log files. The usefulness of an investigation depends on which sources are connected and what information has actually been collected.
help Azure Log Analytics FAQ
What query language does Azure Log Analytics use?
Azure Log Analytics uses Kusto Query Language (KQL), a powerful, read-only query language designed specifically for high-performance data exploration. It allows users to easily parse, filter, and aggregate massive volumes of telemetry and log data.
Can I send Active Directory logs to Azure Log Analytics?
Yes, you can connect Azure Active Directory (now known as Microsoft Entra ID) diagnostic settings to send sign-in logs and audit logs directly to a Log Analytics workspace. This allows security teams to actively query user behavior and build alerting rules within Azure Monitor.
How long does Azure Log Analytics retain data by default?
By default, Azure Log Analytics retains interactive data for 31 days for most subscription tiers. You can configure the retention period up to 730 days (or up to 12 years using Archive and Basic logs) depending on your specific compliance requirements.
explore Explore More
Reviews & Comments
Write a Review
Be the first to review
Share your thoughts with the community and help others make better decisions.
