Enable logging by category group for Volumes (microsoft.netapp/netappaccounts/capacitypools/volumes) to Event Hub

Azure BuiltIn Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.Insights/diagnosticSettings/eventHubAuthorizationRuleId

microsoft.insights

diagnosticSettings

properties.eventHubAuthorizationRuleId

True

False

Microsoft.Insights/diagnosticSettings/eventHubName

microsoft.insights

diagnosticSettings

properties.eventHubName

True

False

Microsoft.Insights/diagnosticSettings/logs[*]

microsoft.insights

diagnosticSettings

properties.logs[*]

True

False

microsoft.insights/diagnosticSettings/logs[*].categoryGroup

microsoft.insights

diagnosticSettings

properties.logs[*].categoryGroup

True

False

Microsoft.Insights/diagnosticSettings/logs[*].enabled

microsoft.insights

diagnosticSettings

properties.logs[*].enabled

True

False

Rows: 1-2 / 2

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

Type

polSet in AzUSGov

Enable allLogs category group resource logging for supported resources to Event Hub

85175a36-2f12-419a-96b4-18d5b0096531

Monitoring

BuiltIn

unknown

Enable audit category group resource logging for supported resources to Event Hub

1020d527-2764-4230-92cc-7035e4fcf8a7

Monitoring

BuiltIn

unknown

Date/Time (UTC ymd) (i)

Change type

Change detail

2024-04-29 17:47:10

change

Minor (1.1.0 > 1.2.0)

2023-03-27 17:43:07

change

Minor (1.0.0 > 1.1.0)

2023-02-10 18:41:56

add

a285df35-0164-4f4d-9e04-c39056742c55

{

displayName: "Enable logging by category group for Volumes (microsoft.netapp/netappaccounts/capacitypools/volumes) to Event Hub",
policyType: "BuiltIn",
mode: "Indexed",
description: "Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to an Event Hub for Volumes (microsoft.netapp/netappaccounts/capacitypools/volumes).",
metadata: {2 items
- category: "Monitoring",
- version: "1.2.0"
},
parameters: {6 items
- effect: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect",
    - description: "Enable or disable the execution of the policy"
    },
  - allowedValues: [3 items
    - "DeployIfNotExists",
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "DeployIfNotExists"
  },
- diagnosticSettingName: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Diagnostic Setting Name",
    - description: "Diagnostic Setting Name"
    },
  - defaultValue: "setByPolicy-EventHub"
  },
- categoryGroup: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Category Group",
    - description: "Diagnostic category group - none, audit, or allLogs."
    },
  - allowedValues: [2 items
    - "audit",
    - "allLogs"
    ],
  - defaultValue: "audit"
  },
- resourceLocation: {2 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Resource Location",
    - description: "Resource Location must be in the same location as the Event Hub Namespace.",
    - strongType: "location"
    }
  },
- eventHubAuthorizationRuleId: {2 items
  - type: "String",
  - metadata: {4 items
    - displayName: "Event Hub Authorization Rule Id",
    - description: "Event Hub Authorization Rule Id - the authorization rule needs to be at Event Hub namespace level. e.g. /subscriptions/{subscription Id}/resourceGroups/{resource group}/providers/Microsoft.EventHub/namespaces/{Event Hub namespace}/authorizationrules/{authorization rule}",
    - strongType: "Microsoft.EventHub/Namespaces/AuthorizationRules",
    - assignPermissions: true
    }
  },
- eventHubName: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Event Hub Name",
    - description: "Event Hub Name."
    },
  - defaultValue: "Monitoring"
  }
},
policyRule: {2 items
- if: {1 item
  - allOf: [2 items
    - {2 items
      - field: "type",
      - equals: "microsoft.netapp/netappaccounts/capacitypools/volumes"
      },
    - {2 items
      - field: "location",
      - equals: "[parameters('resourceLocation')]"
      }
    ]
  },
- then: {2 items
  - effect: "[parameters('effect')]",
  - details: {5 items
    - type: "Microsoft.Insights/diagnosticSettings",
    - evaluationDelay: "AfterProvisioning",
    - existenceCondition: {1 item
      - allOf: [4 items
        {2 items
        count: {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*]",
        where: {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
        equals: 🔍"[ equals( parameters('categoryGroup'), 'audit' ) ]"
        },
        {2 items
        field: "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
        equals: "audit"
        }
        ]
        }
        },
        equals: 1
        },
        {2 items
        count: {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*]",
        where: {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
        equals: 🔍"[ equals( parameters('categoryGroup'), 'allLogs' ) ]"
        },
        {2 items
        field: "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
        equals: "allLogs"
        }
        ]
        }
        },
        equals: 1
        },
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/eventHubAuthorizationRuleId",
        equals: "[parameters('eventHubAuthorizationRuleId')]"
        },
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/eventHubName",
        equals: "[parameters('eventHubName')]"
        }
        ]
      },
    - roleDefinitionIds: [2 items
      - "/providers/Microsoft.Authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293" Log Analytics Contributor ,
      - "/providers/Microsoft.Authorization/roleDefinitions/f526a384-b230-433a-b45c-95f59c4a2dec" Azure Event Hubs Data Owner
      ],
    - deployment: {1 item
      - properties: {3 items
        mode: "incremental",
        template: {6 items
        $schema: "http://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
        contentVersion: "1.0.0.0",
        parameters: {6 items
        diagnosticSettingName: {1 item
        type: "string"
        },
        categoryGroup: {1 item
        type: "String"
        },
        eventHubName: {1 item
        type: "string"
        },
        eventHubAuthorizationRuleId: {1 item
        type: "string"
        },
        resourceLocation: {1 item
        type: "string"
        },
        resourceName: {1 item
        type: "string"
        }
        },
        variables: {},
        resources: [1 item
        {5 items
        type: "microsoft.netapp/netappaccounts/capacitypools/volumes/providers/diagnosticSettings",
        apiVersion: "2021-05-01-preview",
        name: 🔍"[ concat( parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('diagnosticSettingName') ) ]",
        location: "[parameters('resourceLocation')]",
        properties: {4 items
        eventHubName: "[parameters('eventHubName')]",
        eventHubAuthorizationRuleId: "[parameters('eventHubAuthorizationRuleId')]",
        logs: [2 items
        {2 items
        categoryGroup: "audit",
        enabled: 🔍"[ equals( parameters('categoryGroup'), 'audit' ) ]"
        },
        {2 items
        categoryGroup: "allLogs",
        enabled: 🔍"[ equals( parameters('categoryGroup'), 'allLogs' ) ]"
        }
        ],
        metrics: []
        }
        }
        ],
        outputs: {1 item
        policy: {2 items
        type: "string",
        value: 🔍"[ concat( 'Diagnostic setting', parameters('diagnosticSettingName'), 'for type Volumes ( microsoft.netapp/netappaccounts/capacitypools/volumes ), resourceName', parameters('resourceName'), 'to EventHub', parameters('eventHubAuthorizationRuleId'), ':', parameters('eventHubName'), 'configured' ) ]"
        }
        }
        },
        parameters: {6 items
        diagnosticSettingName: {1 item
        value: "[parameters('diagnosticSettingName')]"
        },
        categoryGroup: {1 item
        value: "[parameters('categoryGroup')]"
        },
        eventHubName: {1 item
        value: "[parameters('eventHubName')]"
        },
        eventHubAuthorizationRuleId: {1 item
        value: "[parameters('eventHubAuthorizationRuleId')]"
        },
        resourceLocation: {1 item
        value: "[field('location')]"
        },
        resourceName: {1 item
        value: "[field('fullName')]"
        }
        }
        }
      }
    }
  }
}

}