SQL Auditing Logs Not Reaching Log Analytics or Blob for ppeid-sql-server

Question

Hello Azure Support,

We are experiencing an issue where audit logs from our SQL Server instance are not being delivered to Log Analytics or Blob Storage, despite all diagnostic settings being correctly configured.

---

---

🧪 Repro Steps:

1. Enabled auditing at both the database and server level
2. Created multiple diagnostic settings to forward audit logs to:
   • Log Analytics workspace (ppeid-workspace)
     • Storage account (ppeidauditstore)
     1. Confirmed diagnostic settings were saved and active (including Blob and Log Analytics)
     2. Ran multiple auditable events from SSMS:

sql

CopyEdit

UPDATE Checks SET First_Name = 'TestLogTrigger' WHERE Check_ID = 1;

1. Waited up to 40 minutes after each query

---

❌ Observed Behavior:

• No logs appear in Log Analytics using:

kql

CopyEdit

AzureDiagnostics

| where Category == "SQLSecurityAuditEvents"

| sort by TimeGenerated desc

• No .xel files are present in the Blob Storage containers under:
  /ppeid-sql-server/yyyy/mm/dd/

---

✅ What We Need:

Please confirm:

1. Is the audit pipeline active and functional for this subscription and server?
2. Is there any misregistration, backend throttling, or permission failure blocking audit log delivery?
3. Is there a known delay or outage affecting SQLSecurityAuditEvents or diagnostic forwarding?

We’re happy to provide screenshots, queries, and logs as needed. This setup is intended for production use, so accurate audit telemetry is a top priority.

Thank you for your help!

Sincerely,
Bob Wilson
PPE