A resource log records operations performed within a specific Azure resource. Azure services generate these logs automatically, but generating a log is not the same as collecting it for review or retention. section 9.1.3 section 9.2
Resource logs describe data-plane activity: use of a resource’s capabilities after it exists. They complement the Azure activity log, which records control-plane operations used to manage resources in a subscription. For example, creating a storage account is a control-plane action; reading blob data from it is a data-plane action recorded in resource logs. section 9.1.2
Use resource logs alongside related Azure monitoring data, but do not treat them as interchangeable:
- Platform metrics provide numeric measurements at a point in time, such as VM CPU usage or storage-account transaction counts. section 9.1.3
- Resource logs provide operational detail rather than metric values, and their contents vary by Azure service and resource type. section 9.1.3
- Platform metrics are collected automatically by default, whereas resource logs require configuration before they are collected. section 9.1.3
Configure diagnostic settings on the relevant resource to collect its resource logs. Diagnostic settings can send the resulting data to supported destinations, including a Log Analytics workspace or an Azure Storage account. This turns automatically generated operational evidence into data available for investigation and retention. section 9.2 section 9.10
Storage account operations
An application can read blob data through a storage account’s data plane. The resource logs capture information about operations within that storage resource, while the separate activity log records management actions such as creating the storage account. section 9.1.2
Collected Azure monitoring data can support investigation of suspicious activity and possible signs of compromise. Resource logs are one layer of that evidence: configure collection deliberately, then combine them with other monitoring data when assessing activity in the environment. section 9.2 section 9.10
