Question

Contoso runs several production Azure App Service apps and SQL databases. Compliance requires that all resource diagnostic logs be retained for 7 years at the lowest possible cost, while a smaller subset of the most recent logs must support interactive Kusto (KQL) queries and be correlated with metrics for near-real-time troubleshooting. You must recommend a logging and routing design. What should you recommend?

Accepted Answer

Route diagnostic settings to both a Log Analytics workspace (with short retention) for querying and to an Azure Storage account for 7-year archival.

Answer

Route diagnostic settings to a Log Analytics workspace only, and set the workspace data retention to 7 years.

Answer

Route diagnostic settings to an Event Hub, then use a Stream Analytics job to write everything to a SQL database for 7 years.

Answer

Route diagnostic settings to an Azure Storage account only and query the archived logs directly with KQL when needed.