Part of MultiTenantDiagnosticSettings. Specifies the settings for a particular log.

The retention policy for this log.

A value indicating whether this log is enabled.

Name of a Diagnostic Log category for a resource type this setting is applied to. To obtain the list of Diagnostic Log categories for a resource, first perform a GET diagnostic settings operation.

The diagnostic settings Category.

The type of the diagnostic settings category.

The diagnostic settings category resource.

Azure resource type

Azure resource name

Azure resource Id

The properties of a Diagnostic Settings Category.

The diagnostic settings.

The workspace ID (resource ID of a Log Analytics workspace) for a Log Analytics workspace to which you would like to send Diagnostic Logs. Example: /subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2

The resource ID of the storage account to which you would like to send Diagnostic Logs.

The service bus rule Id of the diagnostic setting. This is here to maintain backwards compatibility.

The list of logs settings.

The name of the event hub. If none is specified, the default event hub will be selected.

The resource Id for the event hub authorization rule.

The diagnostic setting resource.

Azure resource type

Azure resource name

Azure resource Id

Properties of a Diagnostic Settings Resource.

Error definition.

Description of the error.

Internal error details.

Service specific error code which serves as the substatus for the HTTP error code.

Error definition.

Description of the error.

Internal error details.

Service specific error code which serves as the substatus for the HTTP error code.

Specifies the retention policy for the log.

A value indicating whether the retention policy is enabled.

The number of days for the retention in days. A value of 0 will retain the events indefinitely.

ClientDiscovery properties.

Contains the localized display information for this particular operation / action. These value will be used by several clients for (1) custom role definitions for RBAC; (2) complex query filters for the event service; and (3) audit history / records for management operations.

The resource. The localized friendly form of the resource related to this action/operation – it should match the public documentation for the resource provider. It should use Title Casing. This value should be unique for a particular URL type (e.g. nested types should not reuse their parent’s display.resource field). e.g. "Virtual Machines" or "Scheduler Job Collections", or "Virtual Machine VM Sizes" or "Scheduler Jobs"

The publisher. The localized friendly form of the resource publisher name.

The provider. The localized friendly form of the resource provider name – it is expected to also include the publisher/company responsible. It should use Title Casing and begin with "Microsoft" for 1st party services. e.g. "Microsoft Monitoring Insights" or "Microsoft Compute."

The operation. The localized friendly name for the operation, as it should be shown to the user. It should be concise (to fit in drop downs) but clear (i.e. self-documenting). It should use Title Casing. Prescriptive guidance: Read Create or Update Delete 'ActionName'

The description. The localized friendly description for the operation, as it should be shown to the user. It should be thorough, yet concise – it will be used in tool tips and detailed views. Prescriptive guidance for namespaces: Read any 'display.provider' resource Create or Update any 'display.provider' resource Delete any 'display.provider' resource Perform any other action on any 'display.provider' resource Prescriptive guidance for namespaces: Read any 'display.resource' Create or Update any 'display.resource' Delete any 'display.resource' 'ActionName' any 'display.resources'

Operations discovery class.

Properties. Reserved for future use.

Origin. The intended executor of the operation; governs the display of the operation in the RBAC UX and the audit logs UX. Default value is "user,system"

Name of the API. The name of the operation being performed on this particular object. It should match the action name that appears in RBAC / the event service. Examples of operations include: Microsoft.Compute/virtualMachine/capture/action Microsoft.Compute/virtualMachine/restart/action Microsoft.Compute/virtualMachine/write Microsoft.Compute/virtualMachine/read * Microsoft.Compute/virtualMachine/delete Each action should include, in order: (1) Resource Provider Namespace (2) Type hierarchy for which the action applies (e.g. server/databases for a SQL Azure database) (3) Read, Write, Action or Delete indicating which type applies. If it is a PUT/PATCH on a collection or named value, Write should be used. If it is a GET, Read should be used. If it is a DELETE, Delete should be used. If it is a POST, Action should be used.

Object type