Azure monitor is not collecting AKS audit logs?

Question

Hello,

I need to know which user has created the pod in the AKS but there is no audit log available in Azure monitor. We are pushing all the logs in log analytics workspace but, never connected storage account.

I ran these simple queries but no results. Can anyone suggest the query for auditing the user

AzureDiagnostics | where Category == "kube-apiserver"

AzureDiagnostics
| where ResourceType == "MANAGEDCLUSTERS"

| summarize count() by Category

Answer 1

Hello Tanul,

In one of the above queries, you check the "kube-apiserver" category. You should look in the the "kube-audit" category.

AzureDiagnostics 
| where Category == "kube-audit"

Here are all the categories explained: https://learn.microsoft.com/en-us/azure/aks/monitor-aks-reference#resource-logs

From here, you should further filter based on the time and pod name to find details, including who created it.

Hopefully this is what you are looking for! If you have additional questions, please let us know in the comments.

If this has been helpful, please take a moment to accept answers as this helps increase visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!