Azure Log Analytics Log Writer

Overview

The Azure Log Analytics logger can be used to send log entries to a specific Azure Log Analytics workspace.

Sent entries will contain the message of individual logs as a JSON formatted message, with information about the source and severity in the base JSON attributes.

Considerations

Use of this logger is encouraged without a log filter in order to take advantage of the powerful indexing and search tools provided by Azure Log Analytics.

Configuration

The Azure Log Analytics log writer requires the following by way of configuration:

Attribute	Supports References	Description
Name	no	The display name of the log writer which is used for identification throughout UNIFYConnect.
Writer Type	no	The type of writer to use. Legacy uses the HTTP Data Collector API. DCR uses Data Collection Rules through the Logs Ingestion API.
Workspace ID	yes	The workspace ID of the Azure Log Analytics workspace. Required if Writer Type is set to Legacy.
Shared Key	yes	The shared key that allows access to the workspace. Required if Writer Type is set to Legacy.
Log Type	yes	The log type to use. Required if Writer Type is set to Legacy.
Data Collection Endpoint	yes	The Data Collection Endpoint URI for Azure Log Analytics. Required if Writer Type is set to DCR.
Data Collection Rule ID	yes	The Data Collection Rule ID for Azure Log Analytics. Required if Writer Type is set to DCR.
Data Collection Stream Name	yes	The Data Collection Stream Name for Azure Log Analytics. Required if Writer Type is set to DCR.
Authentication	no	The Azure credential to use for the DCR API. See Azure Writer Authentication. Required if Writer Type is set to DCR.
Auth Client ID	yes	Required for Client secret. Optional for Workload identity and Managed identity. For managed identity, leave blank for the system-assigned identity or specify a user-assigned identity client ID.
Auth Client Secret	yes	Required and displayed only for Client secret.
Auth Tenant ID	yes	Required for Client secret and an optional override for Workload identity. Hidden for other authentication modes.

Authentication

Authentication selection applies only to the DCR writer. The legacy writer continues to authenticate using its workspace ID and shared key. Selecting Workload identity or Managed identity creates only that credential and avoids ambiguity when several credential mechanisms are available to the host. See Azure Writer Authentication for all modes and deployment requirements.

Azure Log Analytics Log Writer (DCR) Setup Guide

The setup below demonstrates client-secret authentication with an app registration. When using the default credential chain, workload identity, or managed identity, configure that identity in the host, skip creation of the client secret, and assign the DCR role to the identity that UNIFYConnect will use.

The steps required to set up a DCR log writer are as follows:

1. Create a Microsoft Entra App Registration / Service Principal
2. Create Data Collection Endpoint (DCE)
3. Create a custom table in LAW (DCR-based). Data Collection Rule (DCR) (can be reused for multiple UNIFY tables)
4. Role assignment on the DCR for that service principal
5. Configure Azure Log Analytics Log Writer for use with DCR API.

Prerequisites

• A Log Analytics workspace
• Ensure you have at least contributor rights to create DCE/DCR/table resources in that workspace.

Create a Microsoft Entra App Registration

Create an Application registration to authenticate against the API

• In Azure Portal, on the Microsoft Entra ID menu, select App registration > New Registration.
  

• Fill in the application name; no need for a Redirect URI.
  

• After registering the application, take note of the Application (client) ID and the Directory (tenant) ID, which we will need when setting up the log writer.

• Generate the application client secret, and take note of the secret value.Select Certificates & secrets > New client secret
  

Create Data Collection Endpoint (DCE)

• Create the data collection endpoint by selecting Monitor > Data Collection Endpoint > Create
  

• After the creation, take note of the Logs Ingestion from the overview page.
  

Create a custom table in the Log analytics workspace (DCR-based)

• On the Log Log Analytics workspaces menu, Select Tables > New custom log (DCR based)
  

• Enter the table's name, and select Create a new data collection rule.
  

• Select the Data collection endpoint that we created previously and select Next.
  

• Now, we need to upload a file with a sample JSON of what a typical log entry from Unify Connect looks like. This will allow Azure to infer and configure the table schema.Use the JSON sample below of a log entry.
  

  {
      "timeStamp": "2024-10-03T03:24:58.5977905Z",
      "source": "UNIFYBroker",
      "module": "Connector engine",
      "severity": "Information",
      "message": "Request to get the enabled state of the selected connector.",
      "level": "Verbose",
      "data": {}
  }

• After successfully uploading the JSON sample, we need to add a transformation to create a TimeGenerated mapping it from our JSON payload. Select Transformation Editor

• Add the following transformation and select Run to run the transformation, and then select

  source | extend TimeGenerated = timeStamp

• Select Create to finalize the table creation
• Now, the new DCR can be found listed under Monitor > Data Collection Rules. Take note of the immutable DCR ID as it is used to set up the log writer.
  

Role assignment on the DCR for that service principal

Now, we need to give the application permission to use the DCR, so that our log writer can send data to the new DCE and DCR.

• From Monitor > Data Collection Rules, go to the new DCR page and select Access Control (IAM) > Add role assignment.
  

• Select Monitoring Metrics Publisher > Next
  

• Select User, group, or service principal for Assign access to, and select Select members. Add the application that we previously created.
  

• Review and assign the application role.
  

Configure Azure Log Analytics Log Writer for use with DCR API

• Configure the log writer in Unify Connect and set Log Analytics Writer Type to DCR API.

• Set the DCE logs ingestion URLfound in the DCE overview page to Data Collection Endpoint.

• Set theImmutable ID)of the DCR to the Data Collection Rule ID.

• Set the DCR stream name. This can be found in the Azure portal on the DCR page under Data Sources, then choose the data source name corresponding to the workspace table to be used for logging.
  

• Select the required Authentication mode. For Client secret, set the Auth Client ID, Auth Client Secret, and Auth Tenant ID found in the application registration overview page. For the other modes, provide only the optional fields shown by the UI and configure the credential in the service host as described in Azure Writer Authentication.

Microsoft reference

• https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal