Skip to content
  • There are no suggestions because the search field is empty.

Azure Parameters

Azure ParametersAzure Parameters

Microsoft Azure is a cloud computing platform and infrastructure for building, deploying, and managing applications and services through a global network of Microsoft-managed data centers.

Workflow

This workflow illustrates the basic tasks needed to start collecting events through Log Collection.

netwitness_lcwf.png

What do you want to do?

  • Role:

    Administrator

  • I Want to...:

    Perform basic Log Collection implementation

  • Documentation:

    Basic Implementation


  • Role:

    Administrator

  • I Want to...:

    Set up a lockbox to maintain lockbox settings.

  • Documentation: Set Up a Lockbox




*You can perform this task here.

Related Topics

Azure Event Source Configuration Parameters

This topic describes the Azure event source configuration parameters.

Basic ParametersBasic Parameters

Note: Required parameters are marked with an asterisk. All other parameters are optional.

  • Name:

    Name *

  • Description:

    Enter an alpha-numeric, descriptive name for the source. This value is only used for displaying the name on this screen.


  • Name:

    Enabled

  • Description:

    Select the checkbox to enable the event source configuration to start collection. The checkbox is selected by default.


  • Name:

    Client ID *

  • Description:

    The Client ID is found the Azure Application Configure tab. Scroll down until you see it.


  • Name:

    Client Secret *

  • Description:

    When you are configuring the event source, the client secret is displayed when you are creating a key, and you select a duration of validation.

    Make sure to save this, because you will only be able to see it once, and it cannot be retrieved later.



  • Name:

    Federation Metadata Endpoint *

  • Description:

    In your Azure application, click the View Endpoints button (near the bottom of the pane).

    There are a lot of links that all begin with the same string. Compare the URLs and find the common string that begins most of them. This common string is the endpoint that you need to enter here.


  • Name:

    Subscription ID *

  • Description:

    You can find this in the Microsoft Azure dashboard: click on Subscriptions at the bottom of the list on the left.


  • Name:

    Tenant Domain *

  • Description:

    Go to the active directory and click on the directory. In the URL, the tenant domain is the string directly following manage.windowsazure.com/. The tenant domain is the string up to and including the .com.


  • Name:

    Resource Group Names *

  • Description:

    In Azure, select Resource groups from the left navigation pane, then select your group.


  • Name:

    Start Date *

  • Description:

    Choose the date from which to start collecting. Default's to the current date.


  • Name:

    Test Connection

  • Description:

    Checks the configuration parameters specified in this dialog to make sure they are correct.


Advanced ParametersAdvanced Parameters

Click netwitness_advcdexpandbtn.png next to Advanced to view and edit the advanced parameters, if necessary.

  • Name:

    Polling Interval

  • Description:

    Interval (amount of time in seconds) between each poll. The default value is 180.
    For example, if you specify 180, the collector schedules a polling of the event source every 180 seconds. If the previous polling cycle is still underway, the collector waits for that cycle to finish. If you have a large number of event sources that you are polling, it may take longer than 180 seconds for the polling to start because the threads are busy.


  • Name:

    Max Duration Poll

  • Description:

    Maximum duration, in seconds, of a polling cycle. A zero value indicates no limit.


  • Name:

    Max Events Poll

  • Description:

    The maximum number of events per polling cycle (how many events collected per polling cycle).


  • Name:

    Max Idle Time Poll

  • Description:

    Maximum duration, in seconds, of a polling cycle. A zero value indicates no limit.


  • Name:

    Command Args

  • Description:

    Optional arguments to be added to the script invocation.


  • Name:

    Debug

  • Description:

    Caution: Only enable debugging (set this parameter to On or Verbose) if you have a problem with an event source and you need to investigate this problem. Enabling debugging will adversely affect the performance of the Log Collector.

    Enables or disables debug logging for the event source. Valid values are:

    • Off = (default) disabled
    • On = enabled
    • Verbose = enabled in verbose mode ‐ adds thread information and source context information to the messages.

    This parameter is designed to debug and monitor isolated event source collection issues. If you change this value, the change takes effect immediately (no restart required). The debug logging is verbose, so limit the number of event sources to minimize performance impact.