Azure SQL Server and Database audit logs empty

Question

I've got an Azure SQL Server with 1 Azure SQL Database (small size, serverless).

I'm wanting to assess auditing to log Analytics workspace for easier interrogation. I've configured auditing at the SQL Server level and ticked the option for logging to the Log Analytics workspace and pointed it at a (new) LogAnalytics workspace I had already created. I'm not logging to Azure storage or Event Hub - just LogAnalytics.

I've generated some activity on my database and yet there is nothing showing in the audit records or when I try an explore it in the LogAnalytics workspace.

For good measure at the database level I turned on auditing there too and pointed at the LogAnalytics workspace (although as I understand auditing setting is inherited from the server level setting). Made no difference.

I feel like I'm missing something super obvious here - just don't know what!?

Thanks

Answer 1

@Timothy Palmer Thank you for reaching out and sorry to hear about this issue.

It seems like you have configured auditing at the SQL Server level and also database level and pointed it to a Log Analytics workspace which is so far correct. However, you are not seeing any audit records in the workspace even after generating some activity on your database.

It should work if your database is not paused and have some recent activities.

https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-analyze-audit-logs?view=azuresql

You can try running some queries in the Log Analytics workspace to see if the data is being stored correctly. Here is an example query that you can use to retrieve audit logs:

AzureDiagnostics
| where Category == "SQLSecurityAuditEvents"

I would also suggest checking on your permissions.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access?tabs=portal#azure-rbac

Please let me know the result.

Regards,

Oury