Share via

StorageDelete logs not appearing in StorageBlobLogs or insights-logs-storagedelete despite diagnostic settings enabled

Lithesh R Poojary 0 Reputation points
2026-05-03T10:11:12.46+00:00

Hi Team,

I have been trying to set up an alert for blob deletions

on Azure Storage Account using Log Analytics workspace

(StorageBlobLogs). Despite spending several hours

troubleshooting, DeleteBlob operations are simply not

getting logged anywhere.

WHAT IS WORKING:

  • PutBlob (uploads) ARE being logged correctly
  • GetBlobServiceProperties, GetContainerProperties are being logged
  • Diagnostic settings show as Enabled on blob sub-resource

WHAT IS NOT WORKING:

  • DeleteBlob never appears in StorageBlobLogs
  • insights-logs-storagedelete container was NEVER created when archiving to storage account
  • insights-logs-storageread and insights-logs-storagewrite containers exist and have data

EVERYTHING I HAVE CHECKED AND RULED OUT:

  1. StorageDelete category IS checked in diagnostic settings
  2. Soft delete for blobs = DISABLED
  3. Soft delete for containers = DISABLED
  4. Blob versioning = DISABLED
  5. Blob change feed = DISABLED
  6. Classic diagnostic settings = DISABLED (Status = Off)
  7. No Data Collection Rules exist in the subscription
  8. Tested deletion via Azure Portal AND Azure CLI
  9. Deleted and recreated diagnostic settings multiple times
  10. Used allLogs category group instead of individual categories - same result
  11. Reproduced on TWO different storage accounts

KEY OBSERVATION:

The insights-logs-storagedelete container is never created

even when archiving logs to a storage account destination.

This suggests Azure backend is not generating StorageDelete

logs at all for these accounts.

REFERENCE:

Similar issue found here but root cause was a DCR

transformation filter - which we have ruled out:

https://learn.microsoft.com/en-us/answers/questions/1822342/adls-gen2-access-logs-via-diagnostic-settings

QUESTION:

Has anyone else faced this issue where StorageDelete

category simply does not generate any logs? Is there

a known issue with Central India regionAny suggestions would be greatly

appreciated.

Azure Monitor
Azure Monitor

An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siva shunmugam Nadessin 10,810 Reputation points Microsoft External Staff Moderator
    2026-05-04T00:58:36.8866667+00:00

    Hello Lithesh R Poojary,

    Thank you for reaching out to the Microsoft Q&A forum.

    When investigated below are the few things to consider.

    Double-check where your logs actually land

    1. If you’re sending diagnostics to Log Analytics, they show up in the AzureDiagnostics table (not a table called “StorageDelete” or “StorageBlobLogs”). Try a query like:
    AzureDiagnostics
| where ResourceProvider == "MICROSOFT.STORAGE"
| where Category == "StorageDelete"
| where OperationName == "DeleteBlob"
| sort by TimeGenerated desc

    If you’re archiving to a storage account, note that the insights-logs-storagedelete container only gets created when the very first delete log arrives. So it’s “normal” not to see the container until a DeleteBlob entry is actually emitted.

    1. Test with soft delete turned on
      • As a quick litmus test, turn Soft Delete for blobs back on (even with a 1-day retention). Now issue a DeleteBlob call and see whether you get a “BlobSoftDeleted” event in your logs. If that shows up, it proves the service is emitting something and may point to a backend filtering issue for permanent deletes.
    2. Consider Event Grid as a reliable workaround
      • Storage’s built-in Event Grid integration will fire a BlobDeleted event for every delete, whether soft or permanent. You can route those to a Logic App, Function, Event Hub or even your Log Analytics workspace today and build your alert on top of those events.
    3. Validate region/backend behavior
      • You mentioned Central India. Can you spin up a quick storage account in another region (e.g. West Europe or East US) with the exact same diagnostic settings and retry? If deletes show up there, we’re definitely looking at a regional Azure backend issue.
    4. When you’re ready to escalate
      • If all of the above still yields zero DeleteBlob logs, please open a standard Azure Support ticket so the Storage engineering team can look at backend logging pipelines in Central India. Include: • Subscription ID, resource group & storage account name • Time stamps of your test deletes • Request-ID (if possible) from the client side 

    Let me know if any further queries - feel free to reach out! 

    References

    • Creating and configuring diagnostic settings: https://docs.microsoft.com/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal#creating-a-diagnostic-setting

    • Storage resource logs destinations: https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings#destinations

    • Query resource logs in Log Analytics: https://docs.microsoft.com/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal#analyzing-logs

    • BlobDeleted events via Event Grid: https://docs.microsoft.com/azure/storage/blobs/storage-blob-events-overview

    Was this answer helpful?

  2. AI answer

    2026-05-03T10:11:26.9366667+00:00

    StorageDelete logs for Azure Storage are only emitted and collected when:

    1. A diagnostic setting exists on the correct resource scope (the storage account/blob sub‑resource), and
    2. The StorageDelete category is selected and routed to at least one destination (Log Analytics, storage, or Event Hubs), and
    3. Azure Monitor resource logs are actually being generated and routed by the platform.

    From the described behavior:

    • StorageRead/StorageWrite are flowing correctly to both Log Analytics (StorageBlobLogs) and the insights-logs-storageread / insights-logs-storagewrite containers.
    • The insights-logs-storagedelete container is never created, and DeleteBlob never appears in StorageBlobLogs.

    Given that:

    • Diagnostic settings must be explicitly created per resource and per category. Resource logs are not collected or stored until a diagnostic setting is created and categories are selected.
    • When archiving to a storage account, Azure automatically creates the destination containers per category only when logs for that category are actually emitted.

    The combination of:

    • StorageRead/StorageWrite containers existing with data, and
    • StorageDelete container never being created,

    indicates that the platform is not emitting StorageDelete resource logs for those DeleteBlob operations, even though the category is selected. This aligns with the key observation that the backend is not generating StorageDelete logs for the affected accounts.

    The provided context does not document any regional limitation or known issue specific to StorageDelete in Central India, nor any additional configuration beyond diagnostic settings that would be required to get StorageDelete logs. It only states that:

    • Resource logs are generated automatically by the resource, but not collected until diagnostic settings route them.
    • Categories for storage include StorageRead, StorageWrite, and StorageDelete, and all are configured the same way in diagnostic settings.

    Because StorageRead/StorageWrite are working with the same diagnostic setting and destinations, and StorageDelete is not appearing anywhere (Log Analytics or storage), this scenario matches a backend/platform issue rather than a configuration problem that can be resolved from the documented guidance.

    The next step is to open a support case with Microsoft, referencing:

    • The storage account names and subscription IDs.
    • The region (Central India).
    • Confirmation that StorageRead/StorageWrite logs are present while StorageDelete logs are not, despite StorageDelete being enabled in the same diagnostic setting.

    Support can then verify whether there is a service-side issue with StorageDelete emission for that region or those accounts.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.