Hi, In a previous post, I showed you how to configure Azure Bastion diagnostic parameters to send logs and metrics to a storage account. But suppose you already have a log analysis workspace. In that case, you may find it interesting to configure Azure bastion to use your workspace and thus centralize the logs and metrics of your resources. This post will show you how to configure Azure Bastion diagnostic parameters to send logs and metrics to a Log Analytics workspace using PowerShell and Azure CLI.

Prerequisites

  • This tutorial assumes that you already have a Log Analytics Workspace. You can use an existing Workspace, or if you want to create a new one, check out this link.
  • This tutorial assumes that you already have an Azure Bastion host. You can use an existing Bastion host, or if you want to create a new one, check out this link.

Important: The Log Analytics workspace does not need to be in the same region as the monitored resource.

In the following examples, I will set the retention policy to 365 days. If you do not want to apply any retention policy and retain data forever, set retention (days) to 0.

Azure PowerShell Workaround

The simplest way to get started is to sign in interactively at the command line.

This cmdlet will bring up a dialog box prompting you for your email address and password associated with your Azure account.
If you have more than one subscription associated with your mail account, you can choose the default subscription. To perform this task, we will use the following commands:

Once you set your default subscription, you’re ready to start.

Set the variables

Here, we define the characteristics of our environment and the resource’s properties.

To improve the visualization of the following commands, I will store the resources into variables.

Sets the logs and metrics settings for the Azure Bastion

To store the event log for the resource, you must use the Set-AzDiagnosticSetting cmdlet with the following syntax. At the time of writing this article, only records are available for the category: BastionAuditLogs.

If you also want to store the metric record for the resource, you must use the Set-AzDiagnosticSetting cmdlet with the following syntax.

Verify the changes made

To verify the established diagnostic settings, you should use the Get-AzDiagnosticSetting cmdlet with the following syntax.

Get-AzDiagnosticSetting

Remove diagnostic settings

If you want to remove the diagnostic setting for the Azure Bastion resource, you should use the Remove-AzDiagnosticSetting cmdlet with the following syntax.

Azure CLI Workaround

In this case, we will use Azure Cloud Shell, a browser-based shell built into Azure Portal. This allows us to use the Azure command-line tools (Azure CLI and Azure PowerShell) directly from a browser. If you want to know more about Azure Cloud Shell, check out this link.
First, we define the characteristics of our environment and store the values in variables.

To improve the visualization of the following commands, I will store the resources into variables.

Sets the logs and metrics settings for the Azure Bastion

To store the event logs and metrics for the resource, you should use the following command.

Verify the changes made

To verify the established diagnostic settings, you should use the following command.

Azure Bastion Log Analytics

Remove diagnostic settings

If you want to remove the diagnostic setting for the Azure Bastion resource, you should use the following commands.

Thanks for reading my post. I hope you find it helpful.

If you want to know more about Azure Bastion, check out this link.