Skip to main content

Azure NSG

Enable an Azure function to forward NSG logs from your Azure Blob Storage account to your account.

Before you begin, you'll need:

  • An Azure Blob Storage account of the type StorageV2 (general purpose v2) dedicated to NSG logs and called Logzio_NSG_BLOB
  • A virtual machine instance in Azure resource group connected to the storage account
  • Network Watcher enabled in the region of the virtual machine

Configure the NSG flow to your Azure Blob Storage account

Register Insights provider

  1. Log in to the Azure Portal.
  2. Navigate to All services > Subscriptions.
  3. Select the subscription that the Azure resource group belongs to.
  4. Select Settings > Resource providers.
  5. Make sure that Status for the microsoft.insights provider is set to Registered. If not, set it to Registered.

Enable NSG flow log

  1. For your VM, navigate to Networking > NSG > NSG flow.
  2. From the list of NSGs, select the NSG with the name of your VM.
  3. Set the Flow logs status to on.
  4. Select the required Flow logs version.
  5. In the Storage accound field, select the Logzio_NSG_BLOB Azure Blob Storage account.
  6. Select the required retention period.
  7. If required, enable the Traffic Analytics.
  8. Save the configuration.

Connect your Azure Blob Storage account to

Open the link below and fill in the form according to the table.

Deploy to Azure

Resource groupSelect your existing resource group.Required
LocationSelect the same region as the Azure services that will stream data to this Blob Storage.Required
Logzio hostUse the listener URL specific to the region where your account is hosted. Click to look up your listener URL. The required port depends whether HTTP or HTTPS is used: HTTP = 8070, HTTPS = 8071.Required
Log shipping tokenYour log shipping token directs the data securely to your Log Management account. The default token is auto-populated in the examples when you're logged into the app as an Admin. Manage your tokens.Required
Blob Storage Account NameLogzio_NSG_BLOBRequired
FormatSelect the supported parsing format: jsonRequired
BuffersizeThe maximum number of messages the logger will accumulate before sending them all as a bulk100
TimeoutThe read/write/connection timeout in milliseconds.180,000 = 3 minutes

At the bottom of the page, select Review + Create, and then click Create to deploy. Deployment can take a few minutes.


Only new logs that are created from the moment the integration process is complete are sent to Logs that were added before this integration are not sent to

Check for your logs

Give your logs some time to get from your system to ours, and then open Open Search Dashboards. You can filter for logs of type azure_blob_trigger to see the incoming logs.

If you still don’t see your logs, see log shipping troubleshooting.