Enable Diagnostic Logs for Container Registries

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

04 From the Type equalls all filter box, choose Equals, select Container registry, and choose Apply to list only the Microsoft Azure container registries available in the selected subscription.

05 Click on the name (link) of the Azure container registry that you want to examine.

06 In the resource navigation panel, under Monitoring, select Diagnostic settings.

07 In the Diagnostic settings section, check for any diagnostic settings created for the selected registry. If there are no diagnostic settings available, the Diagnostic Logs monitoring feature is not enabled for the selected Microsoft Azure container registry. If one or more diagnostic settings were created for your registry, choose the diagnostic setting that you want to examine, and select Edit settings. Check the Categories list under Logs to determine the logging configuration available for your registry. Repeat this step for each diagnostic setting created for the selected registry. If one or more log categories are not selected, Diagnostic Logs are not enabled for the selected container registry.

08 Repeat steps no. 5 - 7 for each Azure container registry available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
  --query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
  --subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run acr list command (Windows/macOS/Linux) with custom query filters to list the identifier (ID) of each Azure container registry available in the selected subscription:

az acr list
  --query '[*].id'

05 The command output should return the requested container registry identifiers (IDs):

[
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerRegistry/registries/Project5ContainerRegistry",
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerRegistry/registries/DevAIContainerRegistry"
]

06 Run monitor diagnostic-settings list command (Windows/macOS/Linux) with the ID of the Microsoft Azure container registry that you want to examine as the identifier parameter and custom output filters to describe the name of each diagnostics setting configured for the selected container registry:

az monitor diagnostic-settings list
  --resource "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerRegistry/registries/Project5ContainerRegistry"
  --query '[].name'

07 The command output should return the requested diagnostics setting identifiers (names). If the command output returns an empty array, i.e. [], there are no diagnostic settings configured for the selected Azure Machine Learning (ML) workspace, therefore, the Audit process ends here. Otherwise, you can continue the Audit process with the next step:

[
	"tm-registry-diagnostic-logs",
	"tm-custom-diagnostic-logs"
]

08 Run monitor diagnostic-settings show command (Windows/macOS/Linux) with the name of the diagnostic setting that you want to examine as the identifier parameter, to describe the log categories supported by Azure Container Registry (ACR), configured for the selected diagnostic setting:

az monitor diagnostic-settings show
  --name "tm-registry-diagnostic-logs"
  --resource "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerRegistry/registries/Project5ContainerRegistry"
  --query 'logs'

09 The command output should return the supported log categories and their status:

[
	{
		"category": "ContainerRegistryRepositoryEvents",
		"enabled": false,
		"retentionPolicy": {
		"days": 0,
		"enabled": false
		}
	},
	{
		"category": "ContainerRegistryLoginEvents",
		"enabled": true,
		"retentionPolicy": {
		"days": 0,
		"enabled": false
		}
	}
]

10 Repeat steps no. 8 and 9 for each diagnostic setting created for the selected registry. If none of the diagnostic settings are properly configured, the Diagnostic Logs monitoring feature is not enabled for the selected container registry.

11 Repeat step no. 6 - 10 for each Azure container registry available in the selected Azure subscription.

12 Repeat steps no. 3 – 11 for each subscription created in your Microsoft Azure cloud account.

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

04 From the Type equalls all filter box, choose Equals, select Container registry, and choose Apply to list only the Microsoft Azure container registries available in the selected subscription.

05 Click on the name (link) of the Azure container registry that you want to configure.

06 In the resource navigation panel, under Monitoring, select Diagnostic settings.

07 In the Diagnostic settings section, choose Add diagnostic setting to create a new diagnostic setting. Resource logs won't be collected or stored until you create a diagnostic setting and direct them to one or more locations. A diagnostic setting specifies a list of log categories and/or metrics that you want to collect from an Azure cloud resource, and one or more destinations that you would stream them to.

08 On the Diagnostic setting setup page, perform the following actions:

1. Provide a unique name for your new diagnostic setting in the Diagnostic setting name box.
2. In the Logs section, check the allLogs setting checkbox to select all the log categories supported by Azure Container Registry (ACR).
3. (Optional) In the Metrics section, check the AllMetrics setting checkbox if you want to route the resource's platform metrics to the selected log destinations. By default, platform metrics are sent automatically to Azure Monitor Metrics without any additional configuration required.
4. In the Destination details section, configure one or more log destinations based on your application requirements:
   1. Select Send to Log Analytics workspace and choose a workspace from the Log Analytics workspace dropdown list to send the diagnostic logs.
   2. Select Archive to a storage account and choose a storage account from the Storage account dropdown list to archive the collected logs for at least one year (recommended). The storage account needs to be in the same region as the resource being monitored if the resource is regional.
   3. Select Stream to an event hub to stream the collected logs to an Event Hub. Select the name, namespace, and policy of the event hub that you want to use.
   4. Select Send to partner solution to deliver the log files to a supported third-party system. For supported partner integrations, please refer to this page.
5. Choose Save to apply the configuration changes.

09 Repeat steps no. 5 – 8 for each Azure container registry available within the selected subscription.

10 Repeat steps no. 3 – 9 for each subscription created in your Microsoft Azure cloud account.

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
  --query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
  --subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run monitor diagnostic-settings create command (Windows/macOS/Linux) to create a new diagnostic setting for the specified Microsoft Azure container registry in order to enable the Diagnostic Logs monitoring feature. As an example, the following command request creates a diagnostic setting named "tm-new-registry-diagnostic-logs" for a container registry specified by --resource, that collects and sends all the supported diagnostic logs to a Log Analytics workspace identified by the ID "abcd1234abcd1234abcd1234" and archive the files to an Azure Storage account identified by "abcd1234abcd1234abcd1234". Platform metrics are sent automatically to Azure Monitor Metrics by default and without any configuration. If you need to route the resource's platform metrics to the selected log destinations, include the --metrics parameter in the command request, as shown in the example below:

az monitor diagnostic-settings create
  --name "tm-new-registry-diagnostic-logs"
  --resource "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerRegistry/registries/Project5ContainerRegistry"
  --workspace "abcd1234abcd1234abcd1234"
  --storage-account "1234abcd1234abcd1234"
  --logs '[
		{
			"categoryGroup": "allLogs",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		},
		{
			"categoryGroup": "audit",
			"enabled": false,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		}
	]'
  --metrics '[
		{
			"category": "AllMetrics",
			"enabled": true,
			"retentionPolicy": {
				"enabled": true,
				"days": 0
			}
		}
	]'

05 The command output should return the metadata available for the new diagnostic setting:

{
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerRegistry/registries/Project5ContainerRegistry/providers/microsoft.insights/diagnosticSettings/tm-project5-diagnostic-logs",
	"logs": [
		{
			"categoryGroup": "allLogs",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		},
		{
			"categoryGroup": "audit",
			"enabled": false,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		}
	],
	"metrics": [
		{
			"category": "AllMetrics",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": true
			},
			"timeGrain": "PT1M"
		}
	],
	"name": "tm-new-registry-diagnostic-logs",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"storageAccountId": "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.Storage/storageAccounts/1234abcd1234abcd1234",
	"type": "Microsoft.Insights/diagnosticSettings",
	"workspaceId": "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.OperationalInsights/workspaces/abcd1234abcd1234abcd1234"
}

06 Repeat steps no. 4 and 5 for each Azure container registry provisioned in the selected subscription.

07 Repeat steps no. 3 – 6 for each subscription created within your Microsoft Azure cloud account.