how to configure to store azure diagnostics to store only Azure SQL dB login logout related events logs
Follow the below steps which I have tried with:
Step:1
Go to the Azure portal and select Azure SQL Database. In the left blade, navigate to the Auditing
option under Security
and enable Azure SQL Auditing. Under Audit log destination
,choose Storage
, then select the correct subscription and storage account. By default, the storage authentication type will be set to Storage Access Keys
, Finally, click on Save
to apply the changes.
Refer the below Image: ![enter image description here]
Step:2
In Azure SQL Database, go to the left-side blade and select Diagnostics setting
under Monitoring,
then click on +Add Diagnostics Setting.
Enter the Diagnostics setting name,
select SQLSecurity Audit Event
under Categories, and choose Archive to a storage account
under Destination details. Next, select the correct Subscription
and Storage account,
then click on Save
to apply the settings.
Refer the below Image: ![enter image description here]
Step:3
Select Auditing
under Security
on the left-side blade panel, then click on View audit logs
to access the audit records.
Refer the below Image: ![enter image description here]
Step:4
Under Audit Source,
the default selection will be Database audit.
Click on Log Analytics
to proceed.
Refer the below Image: ![enter image description here]
Step:5
As per your requirement, modify the Kusto Query,
Time Range,
and Show result,
then click on RUN
to execute the query.
Refer the below Image: ![enter image description here]