Merge pull request #2312 from craddm/document-workspace-logs

Add workspace log docs

docs/source/management/logs.md

@@ -7,7 +7,7 @@ Some of these logs are ingested into a central location, an Azure [Log Analytics
 
 Each SRE has its own Log Analytics Workspace.
 You can view the workspaces by going to the Azure portal and navigating to [Log Analytics Workspaces](https://portal.azure.com/#browse/Microsoft.OperationalInsights%2Fworkspaces).
-Select which log workspace you want to view by clicking on the workspace named `shm-<YOUR_SHM_NAME>-sre-<YOUR_SRE_NAME>-log`.
+Select which Log Analytics Workspace you want to view by clicking on the workspace named `shm-<YOUR_SHM_NAME>-sre-<YOUR_SRE_NAME>-log`.
 
 The logs can be filtered using [Kusto Query Language (KQL)](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-query-overview).
 
@@ -20,8 +20,8 @@ These include,
 - package proxy
 - Gitea and Hedgedoc
 
-Logs from all containers are ingested into the [SREs log workspace](#log-workspace).
-There are two tables,
+Logs from all containers are ingested into the [SRE's log analytics workspace](#log-workspace).
+There are two logs
 
 `ContainerEvents_CL`
 : Event logs for the container instance resources such as starting, stopping, crashes and pulling images.
@@ -30,6 +30,23 @@ There are two tables,
 : Container process logs.
 : This is where you can view the output of the containerised applications and will be useful for debugging problems.
 
+## Workspace logs
+
+Logs from all user workspaces are ingested into the [SRE's log analytics workspace](#log-workspace) using the [Azure Monitor Agent](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview).
+
+There are three logs
+
+`Perf`
+: Usage statistics for individual workspaces, such as percent memory used and percent disk space used.
+
+`Syslog`
+: [syslog](https://www.paessler.com/it-explained/syslog) events from workspaces.
+: Syslog is the _de facto_ standard protocol for logging on Linux and most applications will log to it.
+: These logs will be useful for debugging problems with the workspace or workspace software.
+
+`Heartbeat`
+: Verification that the Azure Monitor Agent is present on the workspaces and is able to connect to the [log analytics workspace](#log-workspace).
+
 ## Firewall logs
 
 The firewall plays a critical role in the security of a Data Safe Haven.