I am getting my head around the logs in Azure, and particularly the logs I get from ADSL Gen2 data lake. It is really true that I can't get the login / userid for the changes to the data lake?
I have these fields
TenantId TimeGenerated [UTC] AccountName Location Protocol OperationName AuthenticationType StatusCode StatusText DurationMs ServerLatencyMs Uri CallerIpAddress CorrelationId SchemaVersion OperationVersion AuthenticationHash UserAgentHeader ClientRequestId Etag ServiceType RequestHeaderSize ResponseHeaderSize LastModifiedTime [UTC] Category TlsVersion SourceSystem Type _ResourceId
AuthenticationType is just called AccountKey
CallerIpAddress is the IP address of the user
But the userID like 123@domain.com or similar is what I am looking for. So how do I include fields that describe how the operation was authenticated
To be clear (after some input from KarthikBhyresh-MT)
I have my own ADSL that I am playing around in In azure portal under ADSL > Diagnostic setting (classic) I have enabled Blob logging version 2.0, Read/Write/Delete/Delete data (just as suggested)
I then use Microsoft Azure Storage Explore to upload some file, deleting some of the files again, and generally make something to log
In azure portal under ADSL > Logs (preview) I read the StorageBlobLogs
If I run the simplest query where RequesterUpn is not empty I get my username for an even where AuthenticationType is OAuth. That is the login to the service.
But when I find the OperationName: DeleteFile I have no information of who did it I have the autenticationHash(1) and CallerIpAdress(2) and I could look up the IpAdress from the OAuth log event to put Delete action to a name
Once I had sat Allow storage account key access to Disabled. I had OAuth on every StorageRead, StorageWrite, StorageDelete