Welcome back.
In this lesson, we are going to talk about "Auditing Data".
So what does that mean, exactly?
Well, we're going to talk about why we audit.
We're going to talk about the Azure services
that we can audit in.
And then we're going to take a live look
at how we actually configure auditing in Azure.
So with that, let's take a look at why we audit.
Well, the first reason is tracking database events.
So we might have security concerns, and we want
to look for anomalies.
Things that don't fit in.
This is an excellent reason to audit.
Second reason, regulatory compliance.
So this is not the only factor, usually,
but auditing database events might be something
that you have to do because of regulatory issues.
Third, we want to look at trends.
So this falls into security, like I mentioned in the first,
and this also falls into operations as well.
Because we can start to see maybe database events
that aren't optimized.
And so we can figure out ways to increase resources,
or ways to redefine database events,
or when those database events happen
in order to streamline and optimize the environment.
So this is just a couple of reasons why we want to audit.
Now, let's talk about where we audit.
Well, as far as the DP-203 is concerned,
Synapse and SQL Database, and that is as a feature.
And you'll see what I mean by that in a minute,
but there's basically a box that says 'auditing',
and we can audit in Synapse and SQL Database.
However, there are several other places
as a practice, right?
You can audit in quite a few different areas,
and you should be auditing
in quite a few different areas in Azure,
just not necessarily by clicking on the Audit button.
So for the DP-203, when we talk about auditing,
think about Synapse and SQL Database as a feature.
Again, you'll see what I mean here in just a second.
So with that, let's actually jump into the portal
and let's take a look at auditing.
So here, we find ourselves in my Synapse workspace.
Now, the first thing you need to understand is
if you want to turn on auditing,
you need to do that from within a pool.
So we're going to go ahead
and click on my SQL pool that I've created.
And once we do that, you'll notice that down here
under Security, I now have an Auditing tab.
And I can click on Auditing.
So I have a couple of different options here.
The first is, I need to choose whether I just want
to have auditing for this specific SQL pool, or
whether I want to have auditing on for the entire workspace.
If I want to have it on for the entire workspace,
I'm going to click on this, and then I'll just turn it on.
Or, I can also come back and I can just turn it on
for my SQL pool event.
And once I do that, it's going to ask me where I want
to store my log information.
So I can choose a Log Analytics account,
or I can choose a storage account,
or an event hub that I want to pass the data through.
And so I'm going to choose where I want to have it stored.
And so for this case, let's just go ahead
and pick one of my Log Analytics accounts,
and I'll go ahead and click on Save.
And you'll see that, that quickly, it has now saved
my auditing settings.
And I will now be tracking those database events
in this specific SQL pool, but not at the workspace level.
That's it. It's pretty easy to turn on,
but it is something that you need to configure
and turn on if you want to use it.
So with that, let's jump in and talk
about just a couple of key points to remember.
First off, auditing is useful
for security, compliance, operations.
You should be auditing,
whether you're clicking the button to audit,
or whether you're manually setting up auditing
through Log Analytics or something else.
You need to be auditing.
Next, auditing is used in SQL Database and Synapse.
So this is specifically for the DP-203.
You saw the little box, we clicked on the Auditing.
That's how we set it up in SQL Database and Synapse.
Keep in mind, SQL Database is not on the DP-203.
And this could be set at the server or the database level.
All right, that's it.
I'll see you in the next lesson.