Forward logs and activity logs from Azure

If your logs are already being collected in Azure, you can use our Microsoft Azure Resource Manager (ARM) templates to forward and enrich them in New Relic.

Forwarding your Azure logs to New Relic will give you enhanced administración de logs capabilities to collect, process, explore, query, and alert on your log data.

We currently offer two ARM templates to achieve this: the EventHub-based (recommended) and the Blob Storage-based templates.

Send logs from an Azure Event Hub (recommended)

The New Relic Event Hub ARM template allows you to attach a consumer to an existing or new Event Hub to forward the incoming stream of logs to New Relic. By using this setup, you can configure multiple Azure resources to send their logs to an Event Hub and have these logs automatically forwarded to New Relic. The template also allows you to easily configure your subscription Activity Logs to be sent to New Relic.

To send the logs from your Event Hub:

1. Deploy the New Relic Event Hub ARM template.
2. Optional: configure your subscription Activity Logs to be sent to New Relic.
3. Optional: configure a given Azure resource to send its individual Activity Logs.
4. Explore your log data.

Deploy the New Relic Event Hub ARM template

Follow these steps:

1. Make sure you have a clave de licencia.
2. From one.newrelic.com, click Integrations & Agents in the left nav.
3. In the Logging category, click the Microsoft Azure Event Hub tile in the list of data sources.
4. Select the account where you want to send the logs, and click Continue.
5. Click Generate API key and copy the generated API key.
6. Click Deploy to Azure and a new tab will be open with the ARM template loaded in Azure.
7. Select the Resource group where you want to create the necessary resources, and a Region. Despite not being mandatory, we recommend installing the template in a new resource group, to avoid deleting any of the components it creates accidentally.
8. In the New Relic license key field, paste the previously copied API key.
9. Ensure the New Relic endpoint is set to the one corresponding to your account.
10. Optional: Set to true the Azure subscription activity logs you want to forward. See the subscription information in this document for more details.
11. Click Review + create, review the data you've inserted, and click Create.

Note that the template is idempotent. You can start forwarding logs from Event Hub and then rerun the same template to configure Azure Subscription Activity Logs forwarding by completing step 10.

Optional: Send Azure Activity Logs from your subscription

Azure Activity Logs provide:

• More visibility of your Azure resources
• Activity of the Azure resources
• Information about performed actions
• Events and their timestamps
• The user who performed an action, if applicable

These are all subscription-level events. If you wish to forward Activity Logs from a specific resource instead, please refer to the Resource Activity Logs information in this document.

For more information about the shape of the Activity Logs, see the Microsoft Azure Activity Log event schema.

The New Relic Event Hub ARM template deployment optionally allows you to select which Azure Activity Logs you want to forward to New Relic, including:

• Administrative Azure Activity Logs
• Alert Azure Activity Logs
• Autoscale Azure Activity Logs
• Policy Azure Activity Logs
• Recommendation: Azure Activity Logs
• Resource Health Azure Activity Logs
• Security Azure Activity Logs
• Service Health Azure Activity Logs

Optional: configure an Azure resource to send its Activity Logs

By default, this template only configures the function and resources needed to forward logs from an Event Hub to New Relic. We can also configure the subscription Activity Logs to be forwarded, but there isn't a default log forwarding from your Azure resources. If you want to forward logs from any resource that produces them, you need to configure it by creating a diagnostic setting for the given resource.

For example, if you have a function running on Azure and you want to forward the logs to New Relic, you'll need to configure a diagnostic setting to forward the logs to Event Hub. For more information, see the Microsoft documentation to create diagnostic settings for sending platform logs and metrics to different destinations.

In the following example, we will demonstrate how to forward the Activity Logs from a Kubernetes Service resource running on Azure.

1. Deploy the New Relic Event Hub ARM template.

2. Navigate to your Kubernetes service:

   

3. In the left-hand menu, select Monitoring>Diagnostic Settings:

   

4. Click Add diagnostic setting.

5. In the Diagnostic setting name field, give your new setting a meaningful name.

6. Select the Kubernetes (control pane) logs you want to collect (for example, kube-apiserver, kube-audit, kube-scheduler).

7. On the Destination details, select Stream to an event hub, and configure the Event hub namespace, Event hub name, and Event hub policy name. If you opted to create a new Event Hub and a namespace during the ARM template deployment, select the following automatically created settings (the namespace name will have a different suffix):

   

8. Click Save to start forwarding your Kubernetes logs to New Relic:

Send logs from Azure Blob storage

Azure Blob Storage allows you to store massive amounts of unstructured data, including log files. Using the New Relic Blob Storage ARM template, you will be able to create a function that forwards the contents of a container placed in a Storage Account.

To send the blobs from a container in your Storage Account, follow these steps:

1. Deploy the New Relic Blob Storage ARM template.
2. Explore your log data.

Deploy the New Relic Blob Storage ARM template

Follow these steps:

1. Make sure you have a clave de licencia.
2. Go to the logs UI and, on the left, click Integrations & Agents.
3. Under Logging, click the Microsoft Azure Blob Storage tile.
4. Select the account you want to send the logs, and click Continue.
5. Click Generate API key and copy the generated API key.
6. Click Deploy to Azure and a new tab will be open with the ARM template loaded in Azure.
7. Select the Resource group where you want to create the necessary resources, and a Region. Despite not being mandatory, we recommend installing the template in a new resource group, to avoid deleting any of the components it creates accidentally.
8. In the New Relic license key field, paste the previously copied API key.
9. Introduce the names for the storage account and the container that you wish to forward.
10. Ensure the New Relic endpoint is set to the one corresponding to your account.
11. Click Review + create, review the data you've inserted, and click Create.

View log data

If everything is configured correctly and your data is being collected, you should see log data in both of these places:

• Our logs UI
• Our tools for running NRQL queries. For example, you can execute a query like this:

SELECT * FROM Log

If you want to only query for logs coming from Azure, run the following query:

SELECT * FROM Log where plugin.type='azure'

Troubleshooting

If you encounter problems with configuring your log forwarder, try these troubleshooting tips:

Security recommendations for your Azure resources

In May 2023, we included some security enhancements in our ARM templates that modify the settings in the storage account and the Function App deployed using those templates. Azure resources are secured by default and these changed settings prevent this secure default state from being modified.

If you deployed our ARM templates prior to May 2023, modify your existing setup by:

• Disabling public network access to the Storage account
• Disabling public access to the blobs/containers in the Storage account
• Disabling FTP access to the Function App
• Enforcing HTTPS to the Function App
• Disabling public network access to the Function App

If you have any questions regarding this notice, contact our support team.

What's next?

Explore logging data across your platform with our logs UI.

• Get deeper visibility into both your application and your platform performance data by forwarding your logs with our logs in context capabilities.
• Set up alerts.
• Query your data and create dashboards.

Disable log forwarding

To disable log forwarding capabilities, follow standard procedures in Microsoft Azure activity logs documentation. You do not need to do anything else in New Relic.