Azure Front Door

Azure Front Door writes an access log record for every request that it answers. This includes the requests that it serves from cache, which never get to your origin server. Azure cannot send that log to an HTTPS endpoint directly. Log Hero gives you a template that you deploy in your own Azure subscription. The template turns on the access log for one Front Door profile and relays each batch to Log Hero. You do not install code on your site.

Time: about 15 minutes · Access needed: Azure subscription that contains the Front Door profile, Log Hero account

Before you start

Make sure that you have:

An Azure Front Door Standard or Premium profile. Classic Front Door and classic CDN profiles are not supported.
Permission to create resources in the resource group that you pick for the forwarder.
Permission to write diagnostic settings on the resource group of the Front Door profile.
The domain added in Log Hero. If it is not, do the Quickstart first.

Azure bills the resources that the template creates to your subscription. The Event Hub namespace is the main cost, on the order of 20 to 25 US dollars per month. The Function App runs inside the free grant of the consumption plan at typical traffic. See What the template creates.

1. Open the Azure Front Door option

In your Keyword Hero account, open Log Hero → Bot Activity for the domain.
Choose Log Hero token. The setup page opens.
Under How to start?, choose Azure Front Door.
Choose Copy next to the token. You paste it into the Azure form in step 2.

2. Deploy the forwarder in Azure

Sign in to the Azure account that owns your Front Door profile.
On the Log Hero setup page, choose Deploy the Log Hero forwarder in Azure. The deployment form opens in the Azure portal.
Select the subscription.
Select a resource group for the forwarder. A new, dedicated resource group keeps the cleanup simple.
In Front Door profile (Standard or Premium), select your profile.
Paste the token into LogHero API key.
Choose Review + create.
Choose Create.
Wait until the deployment shows the status Succeeded. This takes a few minutes.

The Azure portal cannot fill in the token for you. That is why you copy it in step 1.

If you prefer to deploy the template yourself

The setup page has a Download the template link. Deploy the file with Deploy a custom template in the Azure portal, or with the Azure CLI:

az deployment group create \
  --resource-group <forwarder-resource-group> \
  --template-uri https://lh-handler-integrations.s3.us-east-1.amazonaws.com/lh-handler-frontdoor.json \
  --parameters apiKey=<your-log-hero-token> \
               frontDoorName=<front-door-profile-name> \
               frontDoorResourceGroup=<resource-group-of-the-profile>

The template has two more parameters, ingestionEndpoint and forwarderPackageUrl. Keep their defaults unless Log Hero support tells you otherwise.

What the template creates

The template creates these resources in the resource group that you picked:

An Event Hub that receives the access log records. It is the only push-style destination that Azure offers for these logs. It buffers records for up to one day.
A Function App on the Windows consumption plan. It runs the forwarder package that Log Hero publishes and relays each batch to https://in.app.log-hero.com/frontdoor-logs. When there is no traffic, it scales to zero.
A storage account, which the Function App needs.
Application Insights for the Function App. Delivery errors appear here.

The template also creates one diagnostic setting named loghero-forward-to-eventhub on your Front Door profile. This setting lives in the resource group of the profile, not in the forwarder’s resource group. It enables only the FrontDoorAccessLog category. Your routes, origins and caching rules are not changed.

The deployment’s Outputs tab shows the names of the Function App and the Event Hub namespace. Keep them for troubleshooting.

The template pins an exact version of the forwarder package. A later Log Hero release does not change the code that runs in your subscription.

3. Make sure that hits arrive

In the Azure portal, open your Front Door profile and go to Diagnostic settings. Make sure that loghero-forward-to-eventhub is listed.
Wait about half an hour. The first delivery after the deployment can take up to 20 minutes, because the consumption plan starts the forwarder from cold. After that, records arrive about one minute after the request.
Open Log Hero → Bot Activity. Make sure that the status line reads Log Hero is receiving bot traffic for this domain.
Make sure that Bot hits is not zero.

You do not need to make traffic yourself. Bots arrive on their own, and on most sites the first bot request lands within the hour.

If the deployment fails

Open the deployment in the Azure portal and read Operation details for the failed step. Two causes are common:

The nested deployment on the profile failed. The account lacks permission to write diagnostic settings in the resource group of the profile. Ask an owner of that resource group for the permission, then deploy again.
The selected profile is a classic profile. Deploy again and select a Front Door Standard or Premium profile.

If no hits arrive after half an hour

Work through these checks in order.

Compare the token. A wrong token looks like success. The forwarder sends the batches, Log Hero accepts them, and then drops them before they reach your domain. Open the Function App and go to Environment variables. Compare the value of LOGHERO_API_KEY with the token on the Log Hero setup page, character by character. Records that were sent with a wrong token are lost. After you correct the value, new records arrive.
Check the Event Hub metrics. Open the Event Hub namespace from the deployment’s Outputs tab and go to Metrics. Compare Incoming Messages with Outgoing Messages.
- Incoming messages without outgoing messages: the forwarder does not read the hub. Open the Function App and look at Invocations and Log stream for errors. The hub keeps the records for one day. When the forwarder recovers, it delivers them.
- Incoming and outgoing messages, but nothing in Log Hero: go back to check 1, or the ingestionEndpoint parameter was changed.
- No incoming messages: no records reach the hub. Make sure that the diagnostic setting exists, that FrontDoorAccessLog is enabled in it, and that the profile serves traffic.

Log Hero has no separate delivery status view. The Function App and the Event Hub are the only places where a delivery problem is visible.

What Log Hero reads from the log

The diagnostic setting sends the complete FrontDoorAccessLog record. Log Hero reads nine of its fields and ignores the rest:

time
clientIp
userAgent
requestUri
hostName
httpMethod
httpStatusCode
timeToFirstByte
referer

Four facts about these fields matter for your reports:

clientIp is required. When the record arrives, Log Hero hashes the address and does not store the raw address. The hash identifies the visitor. A record without clientIp is dropped.
The hostname comes from the requested URL. Log Hero takes the host from requestUri. Hits land on the domain that the visitor requested, so the profile does not need to match a domain in Log Hero.
Timing is measured by Front Door. timeToFirstByte is the time Front Door needed to start the response, not the time the visitor waited. The origin integrations measure the time inside your server, so the two values are not comparable.
Every request is logged. Azure has no sampling for this log, and the template does not add any. The bot counts depend on that.

What Front Door does not send

Requests that Front Door never sees. Traffic that goes to your origin directly is invisible here. If your DNS has a bare origin hostname, bots will find it.
Health probes. The template does not enable the health probe log. If it arrives, Log Hero ignores it.
Records older than one day. If the forwarder is stopped for longer than one day, the Event Hub discards the oldest records.

Disconnect the profile

Log Hero cannot remove the resources for you. Delete the diagnostic setting first. It lives on the profile, so deleting the forwarder’s resource group does not remove it.

In the Azure portal, open your Front Door profile and go to Diagnostic settings.
Delete loghero-forward-to-eventhub.
Delete the forwarder’s resource group.

Data stops within the hour. If you connect the profile again later, deploy the template again.

If it does not work

Work through No data arriving. Two causes are specific to Azure Front Door. The first is a wrong token in the Function App, which shows no error anywhere. The second is a forwarder that does not read the Event Hub. Both are covered in If no hits arrive after half an hour.