Assistance Needed with Log Analytics Setup for Multiple Databases

Question

Hello,

I need assistance in completing the setup of Log Analytics for my databases. I have configured monitoring for three databases with the following categories:

• All logs
• Audits

Here is my setup:

• DB1 and DB2 are located in the same Resource Group (RG1).
• DB3 is located in a separate Resource Group (RG2).
• The Log Analytics Workspace is in a different Resource Group (RG3).
• I have Contributor access to *RG1, **RG2, and *RG3.

Issue:

1. When I run KQL queries with the scope defined as the individual databases:
   • I can retrieve all logs and audits for DB1 and DB2 without any issues.
   • I cannot retrieve any logs for DB3.
2. When I set the scope as the Log Analytics Workspace:
   • I get all results for DB1.
   • I get all results except for the SQLSecurityAuditEvents for DB2.
   • No logs for DB3.

[DB1]

[db2 (No SQLSecurityAuditEvents)]

Additional Insights:

• I have ensured that all three databases have SQL Audit Events enabled.
• KQL Query -

`AzureDiagnostics | where ResourceType == 'SERVERS/DATABASES' | where Resource =='<