Monitor Azure Cache for Redis data using diagnostic settings

  • Article

Diagnostic settings in Azure are used to collect resource logs. An Azure resource emits resource logs and provides rich, frequent data about the operation of that resource. These logs are captured per request and are also referred to as "data plane logs". See diagnostic settings in Azure Monitor for a recommended overview of the functionality in Azure. The content of these logs varies by resource type. In Azure Cache for Redis, two options are available to log:

  • Cache Metrics (that is "AllMetrics") used to log metrics from Azure Monitor
  • Connection Logs logs connections to the cache for security and diagnostic purposes.

Scope of availability

Tier Basic, Standard, and Premium
Cache Metrics Yes
Connection Logs Yes

Cache Metrics

Azure Cache for Redis emits many metrics such as Server Load and Connections per Second that are useful to log. Selecting the AllMetrics option allows these and other cache metrics to be logged. You can configure how long the metrics are retained. See here for an example of exporting cache metrics to a storage account.

Connection Logs

Azure Cache for Redis uses Azure diagnostic settings to log information on client connections to your cache. Logging and analyzing this diagnostic setting helps you understand who is connecting to your caches and the timestamp of those connections. The log data could be used to identify the scope of a security breach and for security auditing purposes.

Prerequisites/Limitations of Connection Logging

Basic, Standard, and Premium tiers

  • Because connection logs in these tiers consist of point-in-time snapshots taken every 10 seconds, connections that are established and removed in-between 10-second intervals aren't logged.
  • Authentication events aren't logged.
  • All diagnostic settings may take up to 90 minutes to start flowing to your selected destination.
  • Enabling connection logs can cause a small performance degradation to the cache instance.
  • Only the Analytics Logs pricing plan is supported when streaming logs to Azure Log Analytics. For more information, see Azure Monitor pricing.

Note

It is always possible to use the INFO or CLIENT LIST commands to check who is connected to a cache instance on-demand.

Important

When selecting logs, you can chose either the specific Category or Category groups, which are predefined groupings of logs across Azure services. When you use Category groups, you can no longer configure the retention settings. If you need to determine retention duration for your connection logs, select the item in the Categories section instead.

Log Destinations

You can turn on diagnostic settings for Azure Cache for Redis instances and send resource logs to the following destinations:

  • Log Analytics workspace - doesn't need to be in the same region as the resource being monitored.
  • Storage account - must be in the same region as the cache. Premium storage accounts are not supported as a destination, however.
  • Event hub - diagnostic settings can't access event hub resources when virtual networks are enabled. Enable the Allow trusted Microsoft services to bypass this firewall? setting in event hubs to grant access to your event hub resources. The event hub must be in the same region as the cache.

For more information on diagnostic requirements, see diagnostic settings.

You're charged normal data rates for storage account and event hub usage when you send diagnostic logs to either destination. You're billed under Azure Monitor not Azure Cache for Redis. When sending logs to Log Analytics, you're only charged for Log Analytics data ingestion.

For more pricing information, Azure Monitor pricing.

Enable connection logging using the Azure portal

  1. Sign in to the Azure portal.

  2. Navigate to your Azure Cache for Redis account. Open the Diagnostic settings pane under the Monitoring section on the left. Then, select Add diagnostic setting.

    Select diagnostics

  3. In the Diagnostic settings pane, select ConnectedClientList from Categories.

    For more detail on the data logged, see below Contents of the Connection Logs.

  4. Once you select ConnectedClientList, send your logs to your preferred destination. Select the information in the working pane.

    Select enable resource-specific

Enable connection logging using the REST API

Use the Azure Monitor REST API for creating a diagnostic setting via the interactive console. For more information, see Create or update.

Request

PUT https://management.chinacloudapi.cn/{resourceUri}/providers/Microsoft.Insights/diagnosticSettings/{name}?api-version=2017-05-01-preview

Headers

Parameters/Headers Value/Description
name The name of your diagnostic setting.
resourceUri subscriptions/{SUBSCRIPTION_ID}/resourceGroups/{RESOURCE_GROUP}/providers/Microsoft.Cache/Redis/{CACHE_NAME}
api-version 2017-05-01-preview
Content-Type application/json

Body

{
    "properties": {
      "storageAccountId": "/subscriptions/df602c9c-7aa0-407d-a6fb-eb20c8bd1192/resourceGroups/apptest/providers/Microsoft.Storage/storageAccounts/appteststorage1",
      "eventHubAuthorizationRuleId": "/subscriptions/1a66ce04-b633-4a0b-b2bc-a912ec8986a6/resourceGroups/montest/providers/microsoft.eventhub/namespaces/mynamespace/eventhubs/myeventhub/authorizationrules/myrule",
      "eventHubName": "myeventhub",
      "workspaceId": "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/myworkspace",
      "logs": [
        {
          "category": "ConnectedClientList",
          "enabled": true,
          "retentionPolicy": {
            "enabled": false,
            "days": 0
          }
        }
      ]
    }
}

Enable Connection Logging using Azure CLI

Use the az monitor diagnostic-settings create command to create a diagnostic setting with the Azure CLI. For more for information on command and parameter descriptions, see Create diagnostic settings to send platform logs and metrics to different destinations. This example shows how to use the Azure CLI to stream data to four different endpoints:

az monitor diagnostic-settings create 
    --resource /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupname}/providers/Microsoft.Cache/Redis/{cacheName}
    --name {logName}
    --logs '[{"category": "ConnectedClientList","enabled": true,"retentionPolicy": {"enabled": false,"days": 0}}]'    
    --event-hub {eventHubName}
    --event-hub-rule /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/microsoft.eventhub/namespaces/{eventHubNamespace}/authorizationrule/{ruleName}
    --storage-account /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}
    --workspace /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{logAnalyticsWorkspaceName}
    --marketplace-partner-id/subscriptions/{subscriptionID}/resourceGroups{resourceGroupname}/proviers/Microsoft.Datadog/monitors/mydatadog

Contents of the Connection Logs