Collecting Log Analytics/OMS Data Across Subscriptions

DZone 's Guide to

Collecting Log Analytics/OMS Data Across Subscriptions

Importing log data across Azure subscriptions isn't necessarily intuitive and involves some legwork to make sure Microsoft.Insights is pulling its weight.

· Cloud Zone ·
Free Resource

Microsoft's Log Analytics platform, part of the OMS Suite, allows you to pull in and analyze data from a wide variety of source for your operational needs. One of these sources of data is from Azure Monitor, the monitoring solution built into the Azure platform.

Azure Monitor is great on its own when you want to look at performance or log data for a specific resource, but when you want to look at this data across your whole estate and be able to create dashboards and alerts, you need to aggregate and analyze them in Log Analytics.

To enable this, you can either do it through the portal, in the diagnostic settings of your required resource, or you can set it up through PowerShell using one of these approaches:

The setup I wanted to use involved having a single OMS workspace and having resources from multiple different subscriptions report into that workspace. The documentation stated this was feasible, but I found that when I tried to enable this using any of the methods above, I hit an error along the lines of:

Failed to update diagnostics for 'resource'. {"code":"Forbidden","message":"Please register the subscription 'subscription id' with Microsoft.Insights."} 

The subscription ID in the error was the one where my resources were located, so I checked to ensure both it and Microsoft.Insights were enabled. Importing resources into an OMS workspace in the same subscription as my resource worked, so I was beginning to think it wasn't possible to have this data report across subscriptions, which would have been a real issue. However, Richard Rundle, one of the authors of this article was kind enough to point out that for this cross-subscription setup, the Microsoft.Insights resource needed to be enabled in both the resource and the workspace subscription. Once I did this, it all started working.

Enabling the Microsoft.Insights Resource

To enable the resource, follow these steps:

  1. Log into the Azure Portal.
  2. On the left-hand menu, go to "More Services" then "Subscriptions".
  3. Locate the subscription where your resources sit and click on that.
  4. In the menu that opens, click on "Resource Providers".
  5. Search for "Microsoft.Insights".
  6. It should show 1 resource provider. If it shows as "NotRegistered" click the Register link.
  7. This should change state to "Registering" and then eventually "Registered".
  8. Finally, repeat the steps above in the subscription where your OMS workspace sits.
analytics ,cloud ,logging ,microsoft azure ,tutorial

Published at DZone with permission of Sam Cogan , DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}