Configure Event Hubs for Azure Logic Apps

This page covers the Event Hubs tab of a Subscription configuration in the Nodinite Azure Logic Apps Logging and Monitoring Agent. The Event Hub carries the Logic Apps diagnostic stream, and the agent needs it for two features:

• Logging: the diagnostic events are the source of every Log Event from your workflows (Configure Logging).
• Failed runs: the agent evaluates the outcome of workflow runs from the same stream (Configure Workflow Monitoring).

Because both features depend on it, the Event Hub is a shared building block, and it often lives somewhere other than your workflows. This page explains why, and how to describe that in Nodinite.

Understanding where the Event Hub lives

Each Logic App has a Diagnostic setting that sends its runtime events to an Event Hub. Azure lets that Event Hub sit in a different subscription from the Logic App, as long as two rules hold:

Source: Diagnostic settings in Azure Monitor - Destinations.

Why Microsoft recommends a separate subscription

It can look odd to put the Event Hub somewhere else than the workflows it serves. The reason is how most organizations structure Azure today: Microsoft's Azure landing zone guidance separates workload subscriptions, owned by the integration teams, from platform subscriptions, owned by a central platform or operations team. Shared monitoring resources, such as Log Analytics workspaces and diagnostic Event Hubs, belong on the platform side:

• Ownership: the platform team owns the Event Hub namespace, its network rules, and its access; integration teams only deploy workflows and their Diagnostic settings.
• Least privilege: the Nodinite App Registration gets Azure Event Hubs Data Receiver on one central namespace, instead of rights in every workload subscription.
• Reuse: many workload subscriptions, and many Logic Apps, can send to the same Event Hub, which keeps the number of Event Hubs and checkpoint containers small.
• Lifecycle: removing or recreating a workload subscription doesn't break the diagnostic pipeline for the others.
• Cost and billing: monitoring cost lands on the platform budget, separate from the workload budgets.

Diagram: Workflows (blue) in two workload subscriptions send diagnostics to one Event Hub and checkpoint container (teal) in a platform subscription. The agent (orange) reads the stream and calls the REST API of each workload subscription for run details.

Mapping your Azure layout to Subscription configurations

In the agent, each Azure subscription has its own Subscription configuration with its own tabs, which is how you describe a cross-subscription setup. The Event Hubs tab and the Logging tab are independent, so a configuration can have either one, or both. The Event Hubs tab holds a list: one Subscription configuration can have many Event Hub entries.

A Subscription configuration plays one of three roles:

Important

The configuration must match the customer environment. Add an Event Hub entry for every Event Hub that a Diagnostic setting in Azure sends Logic Apps diagnostics to, on the Subscription configuration for the subscription where that Event Hub lives. Configure each Event Hub only once, since two entries reading the same Event Hub would compete for the same checkpoint.

The required roles are listed in the Prerequisites and AzureApplicationsAccess - Least Privileges. If the platform and workload subscriptions use different App Registrations, set each one on its own Authentication tab.

Combining the roles in larger environments

The roles combine freely; there is no fixed 1:1 between workflows, Event Hubs, and Subscription configurations. A real environment can have:

• Many Event Hubs in one subscription, for example one per region, one per environment, or one per team. Each becomes its own entry, with its own checkpoint container, on the same Subscription configuration.
• Many Event Hub subscriptions, for example when each region or business unit has its own platform subscription, or when RBAC means the Nodinite App Registration only gets Event Hubs Data Receiver on specific namespaces. Each subscription gets its own configuration, each with its own list of entries.
• Many workload subscriptions sharing them: the workflows in one workload subscription can send diagnostics to Event Hubs in several Event Hub subscriptions, and one Event Hub can receive diagnostics from several workload subscriptions.

Here's an example with one workload subscription that has Logging enabled, and two Event Hub subscriptions with several entries each:

Diagram: One workload subscription (blue) sends diagnostics to three Event Hubs (teal) spread over two platform subscriptions, one per region. The agent (orange) reads all three, and they are configured as three entries on two Subscription configurations.

Checklist for mapping a complex environment

1. List every Diagnostic setting on your Logic Apps that sends to an Event Hub, and note the Event Hub namespace and name it targets.
2. Group those Event Hubs by the subscription they live in. Each subscription becomes one Subscription configuration with one entry per Event Hub, and each entry has its own checkpoint container.
3. Make sure the App Registration on each configuration's Authentication tab has Azure Event Hubs Data Receiver on those Event Hubs and Storage Blob Data Contributor on their checkpoint containers.
4. Enable Logging on the configurations for the subscriptions that hold the workflows, whether or not those configurations also have Event Hub entries.
5. Check that no Event Hub appears twice, in the same or in different configurations.

Recommendations for placement and cost

Place the agent in the same region as the Event Hubs

Azure decides that the Event Hub is in the same region as the Logic Apps. Where the agent runs is your choice, and it decides the network cost. Two flows cross the network: the diagnostic stream from the Event Hub, which is small, and the run details and payloads that the agent fetches through the Logic Apps REST API, which is usually much larger.

Subscription boundaries don't add network cost; Azure bills data transfer by region, not by subscription. A cross-subscription setup in one region is therefore as cheap as a single-subscription setup. For the volume tables, see Azure Costs for Blob Storage and Event Hub.

Workflows in several regions

With a single agent, the agent reads cross-region from at least one region. You have two options:

With one agent per region, the large REST API traffic stays inside each region, and only the filtered Log Events travel to Nodinite. Keep in mind:

• ⚠️ Network access back to Nodinite: each agent logs through the Log API or directly to the SQL Server Log Databases, so every regional agent needs network access to them, for example over a VPN, ExpressRoute, or private endpoints.
• Each agent has its own Monitoring Agent Configuration, with only the Subscription configurations and Event Hub entries for its region. Configure each Event Hub in one agent only, since two agents reading it would compete for the same checkpoint.
• The Log Agent Value Id on the Logging tab is only a label that helps you filter Log Events in Log Views. Regional agents can share one Id or use one each, for example per region; choose what makes searching easiest for your developers, business users, and Nodinite administrators. See What is a Log Agent.

Recommended practices

Keeping the Event Hub cost low

The agent reads the Event Hub with a streaming reader that holds an open connection and receives events as they arrive. The agent reads very frequently, but Azure doesn't bill per read; the Standard tier charges for throughput units (TUs) per hour plus a small ingress fee per event. Each Event Hub you add costs capacity and needs its own checkpoint container, so:

• Use as few Event Hubs as possible: one Event Hub per region, shared by many Diagnostic settings, is usually enough.
• Start with one throughput unit: the diagnostic stream is small, because the agent fetches run details through the REST API instead of carrying payloads in the stream. We have not seen a Logic Apps diagnostic Event Hub run out of throughput.
• Size retention for outages, not for history: retention decides how long the agent, or Nodinite, can be offline before diagnostic events expire and are lost. Basic allows 1 day, Standard up to 7 days, and Premium more. Retention, not throughput, is what usually pushes customers to a higher tier.

For the full cost breakdown, see Azure Costs for Blob Storage and Event Hub. For the much larger cost of Azure's own run history, see Reduce Azure Logic Apps Run History Retention to Lower TCO.

Event Hubs tab

You can enter information about what Event Hubs to fetch diagnostics data from the Event Hubs tab. This setting is vital for the Logging feature and for monitoring failed runs:
The Event Hubs tab lists one entry per Event Hub in this subscription.

Click the Add button to add an Event Hub configuration.

Repeat this step for each Event Hub in this subscription that receives Logic Apps diagnostics, including diagnostics from workflows in other subscriptions.

The following options exist:

• Use a Client Connection (recommended)
• Use SAS keys (obsolete)

App Registration is still required for Azure REST API access and subscription-level operations, regardless of whether this Event Hub entry uses SAS keys or client credentials.

The following fields are common to both alternatives:

Important

You must make sure to comply with the Prerequisites! Otherwise; The Logging feature is not operational.

Diagram: Each Event Hub entity has exactly one checkpoint container, where the agent stores how far it has read.

Using a Client Connection (recommended)

^{New 6.1.29} To avoid using a SAS key, you can check the 'Use Client Secret Credential' checkbox.

Here's an example of the recommended way to connect with the Azure Event Hub.

Using a Connection String

If you are still using Connection Strings (SAS keys), please adjust access rights for the Client on the Authentication tab and change the configuration to use the client credentials.

Here's an example of the legacy settings to connect with the Azure Event Hub.

Next Steps

• Configure Logging
• Configure Workflow Monitoring
• Back to Subscription configuration

Related Topics

• Prerequisites
• Azure Costs for Blob Storage and Event Hub
• Reduce Azure Logic Apps Run History Retention to Lower TCO
• About Logic Apps Logging options
• AzureApplicationsAccess - Least Privileges
• Configuration
• Logic Apps Log Agent