Azure - What are differences between Diagnostic Log vs Activity Log

Question

• Function: What is difference between diagnostic log and activity log? When to use which?
• Sources: DL can be emitted by any kind of IaaS or PaaS resources/sub-resources after we configure from the Azure portal blade. While AL is for all resources as well where some activity is done by user, or app. Is this understanding correct ?
• Destination store: DL can be stored / directed to SA or Event Hub or Log analytics WS. AL are part of Azure Monitor and the storage of the logs are abstracted.
• Retention: what is retention of DL and AL? I believe for Activity Log its 90 days.

Answer 1

Function: What is difference between diagnostic log and activity log? When to use which?

From the docs:

• Resource logs/Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself.

• Activity logs provide an insight into the operations performed on each Azure resource in the subscription from the outside, known as the management plane

Sources: DL can be emitted by any kind of IaaS or PaaS resources/sub-resources after we configure from the Azure portal blade. While AL is for all resources as well where some activity is done by user, or app. Is this understanding correct ?

Yes, the understanding is correct

Destination store: DL can be stored / directed to SA or Event Hub or Log analytics WS. AL are part of Azure Monitor and the storage of the logs are abstracted.:

You can also export the activity logs and store it to storage account or log analytics workspace.

Retention: what is retention of DL and AL? I believe for Activity Log its 90 days. :

• For diagnostic logs: 30days
• For Activity logs: 90 days