Enable an Azure function to forward NSG logs from your Azure Blob Storage account to your Logz.io account.

Before you begin, you’ll need:

  • An Azure Blob Storage account of the type StorageV2 (general purpose v2) dedicated to NSG logs and called Logzio_NSG_BLOB
  • A virtual machine instance in Azure resource group connected to the storage account
  • Network Watcher enabled in the region of the virtual machine
Configure the NSG flow to your Azure Blob Storage account
Register Insights provider
  1. Log in to the Azure Portal.
  2. Navigate to All services > Subscriptions.
  3. Select the subscription that the Azure resource group belongs to.
  4. Select Settings > Resource providers.
  5. Make sure that Status for the microsoft.insights provider is set to Registered. If not, set it to Registered.
Enable NSG flow log
  1. For your VM, navigate to Networking > NSG > NSG flow.
  2. From the list of NSGs, select the NSG with the name of your VM.
  3. Set the Flow logs status to on.
  4. Select the required Flow logs version.
  5. In the Storage accound field, select the Logzio_NSG_BLOB Azure Blob Storage account.
  6. Select the required retention period.
  7. If required, enable the Traffic Analytics.
  8. Save the configuration.
Connect your Azure Blob Storage account to Logz.io

Open the link below and fill in the form according to the table.

Deploy to Azure

Parameter Description Required/Default
Resource group Select your existing resource group. Required
Location Select the same region as the Azure services that will stream data to this Blob Storage. Required
Logzio host Use the listener URL specific to the region where your Logz.io account is hosted. Click to look up your listener URL. Required
Log shipping token Your Logz.io log shipping token directs the data securely to your Logz.io Log Management account. The default token is auto-populated in the examples when you’re logged into the Logz.io app as an Admin. Manage your tokens. Required
Blob Storage Account Name Logzio_NSG_BLOB Required
Format Select the supported parsing format: json Required
Buffersize The maximum number of messages the logger will accumulate before sending them all as a bulk 100
Timeout The read/write/connection timeout in milliseconds. 180,000 = 3 minutes

At the bottom of the page, select Review + Create, and then click Create to deploy. Deployment can take a few minutes.

Only new logs that are created from the moment the integration process is complete are sent to Logz.io. Logs that were added before this integration are not sent to Logz.io.

Check Logz.io for your logs

Give your logs some time to get from your system to ours, and then open Kibana. You can filter for logs of type blobStorage to see the incoming logs.

If you still don’t see your logs, see log shipping troubleshooting.