CODEWITHSUNDEEP
azure-log-analytics
ZZZSharePoint
ZZZSharePoint

Reputation: 1361

get size of my kube audit log ingested daily in azure

I would like to know how can I get the size (in terms of GB) of my kub audit log ingested on daily basis. Is there a KQL query which I can run in my log analytics workspace to find that out? The reason I want is because I would like to calculate the azure consumption. Thanks

Upvotes: 0

Views: 849

Answers (1)

David Likvornik
David Likvornik

Reputation: 51

By using the usage table, it is possible to review how much data was ingested into an LA workspace.

Scope spans from solutions to data types (which correlates usually to the destination table, but not always).

Kube-audit is only exportable by default to the AzureDiagnostic table, a table shared among many azure resources, hence - it is impossible to differentiate the source of each record within the total count.

for example, I've being using the following query to review how much data was ingested at the scope of my AzureDiagnostic table in the last 10 days:

Usage
| where TimeGenerated > startofday(ago(10d))
| where DataType == 'AzureDiagnostics'
| summarize IngestedGB = sum(Quantity) / 1000 by bin(TimeGenerated, 1h)
| render timechart

enter image description here

In my case all data originated from Kube-audit logs, but, it shouldn't be the case of most users:

AzureDiagnostics
| where TimeGenerated > startofday(ago(10d))
| summarize count() by bin(TimeGenerated, 1h), Category
| render timechart

enter image description here

Upvotes: 0

Related Questions