Azure monitor is not collecting AKS audit logs?

Tanul 1,251 Reputation points
2023-05-29T14:17:27.0166667+00:00

Hello,

I need to know which user has created the pod in the AKS but there is no audit log available in Azure monitor. We are pushing all the logs in log analytics workspace but, never connected storage account.

I ran these simple queries but no results. Can anyone suggest the query for auditing the user

AzureDiagnostics | where Category == "kube-apiserver"

AzureDiagnostics
| where ResourceType == "MANAGEDCLUSTERS"

| summarize count() by CategoryUser's image

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,826 questions
Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,877 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrei Barbu 2,576 Reputation points Microsoft Employee
    2023-05-29T14:25:33.5233333+00:00

    Hello Tanul,

    In one of the above queries, you check the "kube-apiserver" category. You should look in the the "kube-audit" category.

    AzureDiagnostics 
| where Category == "kube-audit"

    Here are all the categories explained: https://learn.microsoft.com/en-us/azure/aks/monitor-aks-reference#resource-logs

    From here, you should further filter based on the time and pod name to find details, including who created it.

    Hopefully this is what you are looking for! If you have additional questions, please let us know in the comments.

    If this has been helpful, please take a moment to accept answers as this helps increase visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!