How to get the Access Log for the Storage Account?

Question

I want to know how public users download files from my Azure storage account. I am reading the article https://learn.microsoft.com/en-us/rest/api/storageservices/enabling-storage-logging-and-accessing-log-data but still have some problems:

1. In "How to enable Storage Logging using the Azure portal", it said to use "Diagnostic" blade. However, in my account, in "Monitor" section, there is no "Diagnostic" blade. Only in "Moniter(classic") section, there is "Diagnostic Settings" blade. Does that mean the new(non-classic) monitor does not support to get access log?
2. In the Monitor(classic) -> Diagnostic Settings, I see "Hours Metrics" are selected already, does that mean the log is enabled by default?
3. In "Finding your Storage Logging log data", it said one should use "storage-browsing tool" to see the hidden $log container. But where is the "storage-browsing tool"?

[Note: As we migrate from MSDN, this question has been posted by an Azure Cloud Engineer as a frequently asked question] Source: MSDN

Answer 1

• Storage Logging using portal you can enable Metrics.

You can monitor metrics over time in the Azure portal.  Storage account->Monitoring-> Metrics options Access metrics in the Azure portal

• Hour Metrics

The Azure portal does not currently enable you to configure minute metrics in your storage account; you must enable minute metrics using PowerShell or programmatically.

The cmdlets that control Storage Metrics use the following parameters:

MetricsType: possible values are Hour and Minute.

ServiceType: possible values are Blob, Queue, and Table.

MetricsLevel: possible values are None, Service, and ServiceAndApi.

$storagecontext = New-AzStorageContext -StorageAccountName <storageaccountname> -StorageAccountKey <storageaccountkey>   
  
Set-AzStorageServiceMetricsProperty -MetricsType Minute -ServiceType Blob -MetricsLevel ServiceAndApi  -RetentionDays 5`  -Context $storagecontext.context   
  
Get-AzStorageServiceMetricsProperty -MetricsType Hour -ServiceType Blob -Context $storagecontext.Context   

For more information, you may refer to the suggestions mentioned in this article.

• Storage - browsing tool is Microsoft Azure Storage Explorer

Azure Storage Explorer: Easily manage Storage anywhere from Windows, macOS and Linux, Access multiple accounts and subscriptions across Azure, Azure Stack, and the sovereign Cloud, Create, delete, view, and edit storage resources, View and edit Blob, Queue, Table, File, Cosmos DB storage and Data Lake Storage.

Viewing $logs blob containers for Storage Accounts with enabled metrics

Additional information: Third-Party Azure Storage Client Tools

Source: MSDN