2.1 Logging
2.1.1 Enable audit Logs
Recommended Action
Azure audit logs are enabled and managed in the Azure portal. To enable log collection for
the Kubernetes master components in your AKS cluster, open the Azure portal in a web
browser and complete the following steps:
- Select the resource group for your AKS cluster, such as myResourceGroup. Don’t
select the resource group that contains your individual AKS cluster resources, such
as MC_myResourceGroup_myAKSCluster_eastus.
- On the left-hand side, choose Diagnostic settings.
- Select your AKS cluster, such as myAKSCluster, then choose to Add diagnostic setting.
- Enter a name, such as myAKSClusterLogs, then select the option to Send to Log Analytics.
- Select an existing workspace or create a new one. If you create a workspace, provide
a workspace name, a resource group, and a location.
- In the list of available logs, select the logs you wish to enable. For this example,
enable the kube-audit and kube-audit-admin logs. Common logs include the kube-
apiserver, kube-controller-manager, and kube-scheduler. You can return and change
the collected logs once Log Analytics workspaces are enabled.
- When ready, select Save to enable collection of the selected logs.