Your IT workflows just got faster. Devolutions 2026.2 is now available.
Explore the release
Ctrlk
Book a demoOn-demand labAcademyDownload center
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Send Devolutions Server logs to Azure Log Analytics

This guide provides instructions for creating and configuring all the components needed to send Devolutions Server logs to Azure Log Analytics.

Create a new app registration

  1. Open the Azure portal and navigate to App Registrations.

  2. Click on New Registration.

  3. Give your app a name and click Register (no Redirect URL is necessary).

  4. Under Supported account types, select Accounts in this organizational directory only.

Retrieve client ID and tenant ID

After registration, locate Client ID and Tenant ID under the Overview section. These will be required later.

Create a client secret

  1. Navigate to Certificates & secrets.

  2. Click on New client secret to create a secret.

  3. Save the secret value securely, as it will be used later in Devolutions Server.

  4. Once the secret expires, you must renew it and update it in Devolutions Server; otherwise, log ingestion will stop.

Set up a Data Collection Endpoint (DCE)

Create a Data Collection Endpoint (DCE) in Azure to receive requests from Devolutions Server.

In Devolutions Server, this corresponds to the Azure Endpoint field.

Create an Azure log analytics table

Follow Microsoft's tutorial to create a Log Analytics table in Azure for sample data. See the required sample data sent by Devolutions Server at the end of this article.

Retrieve immutable ID and stream name

Once the Log analytics table is created, locate the Immutable ID and Stream Name for log streaming. Log ingestion setup does not require further configuration here.

Assign permissions to the Data Collection Rule (DCR)

  1. From the DCR in Azure, head to Access Control (IAM) – Add role assignment.

  2. Select Monitoring Metrics Publisher, then Next.

  3. Check User, group, or service principal, and click on Select members.

  4. Click on the application created during registration. Click on Review + assign to make sure everything is in order before saving.

See Microsoft documentation for more details on Data Collection Rule (DCR).

Test and activate logging

Click Test Connection or activate logs to verify they are sent into Sentinel.

KQL commands

Here are some KQL queries to help you quickly analyze the logs sent by Devolutions Server in your Azure Log Analytics environment.

Description

Commands

Filter debug events

Table_Name | where tostring(Event.Level) != "Debug"

Destructure entries log

Table_Name | where tostring(Event.Level) != "Debug" | extend eventData = parse_json(Event) | extend LogEvent_Properties = parse_json(tostring(eventData.Properties.LogEvent_Properties)) | project Timestamp = eventData.Timestamp, Level = eventData.Level, Message = eventData.MessageTemplate, ConnectionID = LogEvent_Properties.ConnectionID, ConnectionName = LogEvent_Properties.ConnectionName, Duration = LogEvent_Properties.Duration, GroupDate = LogEvent_Properties.GroupDate, MachineName = LogEvent_Properties.MachineName, Username = LogEvent_Properties.Username

Devolutions Server configuration

  1. Open the Devolutions Server web service.

  2. Go to Administration - Server settings - Logging.

  3. Enter the information.

Devolutions Server sample data

Here is the sample data sent by Devolutions Server:

PreviousSend a trace reportNextSend real-time notifications to external services with webhooks

Last updated

Was this helpful?