Azure Storage Account Diagnostic Logs - Retrieval Methods

Retrieving Azure Storage Account Diagnostic Logs

Question

You are troubleshooting a security issue for an Azure Storage account.

You enable the diagnostic logs for the storage account.

What should you use to retrieve the diagnostics logs?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

A

If you want to download the metrics for long-term storage or to analyze them locally, you must use a tool or write some code to read the tables. You must download the minute metrics for analysis. The tables do not appear if you list all the tables in your storage account, but you can access them directly by name.

Many storage-browsing tools are aware of these tables and enable you to view them directly (see Azure Storage Client Tools for a list of available tools).

Microsoft provides several graphical user interface (GUI) tools for working with the data in your Azure Storage account. All of the tools outlined in the following table are free.

Note:

There are several versions of this question in the exam. The questions in the exam have two different correct answers:

1. Azure Storage Explorer

2. AZCopy

Other incorrect answer options you may see on the exam include the following:

1. Azure Monitor

2. The Security & Compliance admin center

3. Azure Cosmos DB explorer

4. Azure Monitor

https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-metrics?toc=%2fazure%2fstorage%2fblobs%2ftoc.json https://docs.microsoft.com/en-us/azure/storage/common/storage-explorers

To retrieve the diagnostics logs for an Azure Storage account, you can use Azure Storage Explorer or any other tool that supports Azure Storage diagnostic logs.

Azure Storage Explorer is a free, cross-platform, standalone application that enables you to connect to and manage Azure Storage accounts from Windows, macOS, or Linux. To retrieve the diagnostic logs for an Azure Storage account using Azure Storage Explorer, you can follow these steps:

  1. Install and launch Azure Storage Explorer.
  2. Connect to the Azure Storage account that you want to retrieve the diagnostic logs for.
  3. Right-click the storage account and select "Configure Diagnostics".
  4. Configure the diagnostic settings by selecting the logs you want to collect, the retention policy, and the destination for the logs (e.g. storage account, Event Hub, Log Analytics workspace).
  5. Save the configuration settings.
  6. Wait for the diagnostic logs to be generated (this may take a few minutes).
  7. In Azure Storage Explorer, navigate to the "Tables" section of the storage account.
  8. Look for the "WADLogsTable" table and open it.
  9. Use the filters and search capabilities to find the diagnostic logs that you are interested in.

SQL query editor in Azure is not the right tool for retrieving Azure Storage diagnostic logs as it is primarily designed for querying data stored in Azure SQL Database or Azure Synapse Analytics.

File Explorer in Windows is also not the right tool for retrieving Azure Storage diagnostic logs as it is designed for browsing and managing files and folders on local or networked drives.

Azure Security Center is a cloud-based security management solution that helps you identify and mitigate security risks across your Azure resources. While Azure Security Center can provide insights and recommendations related to storage security, it is not designed for retrieving Azure Storage diagnostic logs.