azureloggingazure-data-lakeuseridazure-data-lake-gen2

Userid in azure datalake (gen2) log


I am getting my head around the logs in Azure, and particularly the logs I get from ADSL Gen2 data lake. It is really true that I can't get the login / userid for the changes to the data lake?

I have these fields

TenantId TimeGenerated [UTC] AccountName Location Protocol OperationName AuthenticationType StatusCode StatusText DurationMs ServerLatencyMs Uri CallerIpAddress CorrelationId SchemaVersion OperationVersion AuthenticationHash UserAgentHeader ClientRequestId Etag ServiceType RequestHeaderSize ResponseHeaderSize LastModifiedTime [UTC] Category TlsVersion SourceSystem Type _ResourceId

AuthenticationType is just called AccountKey

CallerIpAddress is the IP address of the user

But the userID like 123@domain.com or similar is what I am looking for. So how do I include fields that describe how the operation was authenticated

To be clear (after some input from KarthikBhyresh-MT)

I have my own ADSL that I am playing around in In azure portal under ADSL > Diagnostic setting (classic) I have enabled Blob logging version 2.0, Read/Write/Delete/Delete data (just as suggested)

I then use Microsoft Azure Storage Explore to upload some file, deleting some of the files again, and generally make something to log

In azure portal under ADSL > Logs (preview) I read the StorageBlobLogs

If I run the simplest query where RequesterUpn is not empty I get my username for an even where AuthenticationType is OAuth. That is the login to the service.

But when I find the OperationName: DeleteFile I have no information of who did it I have the autenticationHash(1) and CallerIpAdress(2) and I could look up the IpAdress from the OAuth log event to put Delete action to a name enter image description here


Solution

  • Once I had sat Allow storage account key access to Disabled. I had OAuth on every StorageRead, StorageWrite, StorageDelete

    enter image description here

    MS Dokumentation