Connecting Azure Activity Log to Log Analytics instance using Az CLI

Question

Is there a way to configure Azure Activity logs to be forwarded to a Log Analytics instance using Azure CLI?

Hopefully equivalent to the PowerShell command:

New-AzureRmOperationalInsightsAzureActivityLogDataSource -ResourceGroupName <LogAnalyticsOMSWorkspaceResourceGroupName> -WorkspaceName <LogAnalyticsOMSWorkspaceName> -Name <NameOfThisOperationalInsightsAzureActivityLogDataSource> -SubscriptionId <SubscriptionId>

Answer 1

Significant changes have been made to Azure Monitor recently, with different services being consolidated in order to simplify monitoring for Azure customers.

Dedicated Azure CLI commands under the set az monitor activity-log alert are available for managing activity log alert rules.

To create a new activity log alert rule, use in this order:

• az monitor activity-log alert create: Create new activity log alert rule resource
• az monitor activity-log alert scope: Add scope for the created activity log alert rule
• az monitor activity-log alert action-group: Add action group to the activity log alert rule

To retrieve one activity log alert rule resource, the Azure CLI command az monitor activity-log alert show can be used. And for viewing all activity log alert rule resource in a resource group, use az monitor activity-log alert list. Activity log alert rule resources can be removed using Azure CLI command az monitor activity-log alert delete.

https://learn.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log#cli