Send Devolutions Server logs to Azure Log Analytics

This guide provides instructions for creating and configuring all the components needed to send Devolutions Server logs to Azure Log Analytics.

Devolutions Server only forwards connection Activity and Administration logs to Azure Log Analytics, not all log types. If you have audit requirements, confirm this subset covers your needs before relying on it as your only audit trail.

Create a new app registration

1. Open the Azure portal and navigate to App Registrations.
2. Click on New Registration.
3. Give your app a name and click Register (no Redirect URL is necessary).
4. Under Supported account types, select Accounts in this organizational directory only.

Retrieve client ID and tenant ID

After registration, locate Client ID and Tenant ID under the Overview section. These will be required later.

Create a client secret

1. Navigate to Certificates & secrets.
2. Click on New client secret to create a secret.
3. Save the secret value securely, as it will be used later in Devolutions Server.
4. Once the secret expires, you must renew it and update it in Devolutions Server; otherwise, log ingestion will stop.

Set up a Data Collection Endpoint (DCE)

Create a Data Collection Endpoint (DCE) in Azure to receive requests from Devolutions Server.

In Devolutions Server, this corresponds to the Azure Endpoint field.

Create an Azure Log Analytics table

Building the table from Microsoft's generic sample-data flow will create flat columns that don't match this structure, and every field beyond ReportType and MachineName will come through empty. Create the table manually with the schema below instead. Create the table with the following columns (all string unless noted):

Column	Type
TimeGenerated	datetime
ReportType	string
MachineName	string
User	string
ConnectionName	string
ConnectionId	string
VaultName	string
VaultId	string
Message	string
LogDate	string
ConnectionType	string
ConnectionUsername	string
Machine	string
Ticket	string
ActiveTime	string
OnOpenComment	string
OnCloseComment	string

Retrieve immutable ID and stream name

Once the Log analytics table is created, locate the Immutable ID and Stream Name for log streaming.

Configure the DCR transformation

The Data Collection Rule's transform (transformKql) is what maps the incoming CLEF JSON onto the table schema above. Without it, the fields will not populate even if the table and permissions are otherwise correct. Set the transform to:

| extend TimeGenerated = todatetime(['@t'])
| extend p = parse_json(tostring(Properties))
| project TimeGenerated, ReportType, MachineName,
    User = tostring(p.User),
    ConnectionName = tostring(p.ConnectionName),
    ConnectionId = tostring(p.ConnectionId),
    VaultName = tostring(p.VaultName),
    VaultId = tostring(p.VaultId),
    Message = tostring(p.Message),
    LogDate = tostring(p.LogDate),
    ConnectionType = tostring(p.ConnectionType),
    ConnectionUsername = tostring(p.ConnectionUsername),
    Machine = tostring(p.Machine),
    Ticket = tostring(p['Ticket#']),
    ActiveTime = tostring(p.ActiveTime),
    OnOpenComment = tostring(p.OnOpenComment),
    OnCloseComment = tostring(p.OnCloseComment)

Assign permissions to the Data Collection Rule (DCR)

1. From the DCR in Azure, head to Access Control (IAM) – Add role assignment.
2. Select Monitoring Metrics Publisher, then Next.
3. Check User, group, or service principal, and click on Select members.
4. Click on the application created during registration. Click on Review + assign to make sure everything is in order before saving.

See Microsoft documentation for more details on Data Collection Rule (DCR).

Test and activate logging

Click Test Connection to verify your credentials, then generate a connection activity in Devolutions Server and confirm the corresponding row appears in Log Analytics with its fields populated.

Test Connection only validates the credentials used to reach the endpoint, it does not send an actual log entry. A green result confirms connectivity, not that ingestion or the transform is configured correctly. Always verify with a real event afterward.

Devolutions Server configuration

1. Open the Devolutions Server web service.
2. Go to Administration - Server settings - Logging.
3. Enter the information.