Auditing Azure File Storage Service

Question

It is documented that Storage Analytics logging currently does not work for File storage service.

Storage Analytics metrics are available for the Blob, Queue, Table, and File services.

Storage Analytics logging is available for the Blob, Queue, and Table services.

https://learn.microsoft.com/en-us/rest/api/storageservices/enabling-and-configuring-storage-analytics

Knowing this I was hoping I could identify File service usage via the metrics, however I wasn't able to isolate something I could conclusively see as being for file usage. The capacity didn't seem to go up and ingress / egress I couldn't isolate as being just for files.

How best to audit File usage?

Answer 1

There is a workaround for getting metrics/analytics on storage services, specifically Azure files. It is not in storage analytics as of yet. There is an option in the .net SDK, which allows you to view different metrics. Though, you have to use the resource ID, this is done via Azure Storage Metrics:

If you want to list the metric definitions for blob, table, file, or queue, you must specify different resource IDs for each service with the API.

Code Sample:

  public static async Task ListStorageMetricDefinition()
    {
        // Resource ID for storage account
        var resourceId = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}";
        var subscriptionId = "{SubscriptionID}";
        // How to identify Tenant ID, Application ID and Access Key: https://azure.microsoft.com/documentation/articles/resource-group-create-service-principal-portal/
        var tenantId = "{TenantID}";
        var applicationId = "{ApplicationID}";
        var accessKey = "{AccessKey}";

        // Using metrics in Azure Monitor is currently free. However, if you use additional solutions ingesting metrics data, you may be billed by these solutions. For example, you are billed by Azure Storage if you archive metrics data to an Azure Storage account. Or you are billed by Operation Management Suite (OMS) if you stream metrics data to OMS for advanced analysis.
        MonitorClient readOnlyClient = AuthenticateWithReadOnlyClient(tenantId, applicationId, accessKey, subscriptionId).Result;
        IEnumerable<MetricDefinition> metricDefinitions = await readOnlyClient.MetricDefinitions.ListAsync(resourceUri: resourceId, cancellationToken: new CancellationToken());

        foreach (var metricDefinition in metricDefinitions)
        {
            //Enumrate metric definition:
            //    Id
            //    ResourceId
            //    Name
            //    Unit
            //    MetricAvailabilities
            //    PrimaryAggregationType
            //    Dimensions
            //    IsDimensionRequired
        }
    }

Source:Azure Storage metrics in Azure Monitor

And you can also do it via Portal as below: