Azure FileShare Auditing Queries

Question

Hey Team,

I have Azure File Share which holds bunch of documents. I turned on Diagnostic settings and Logs categories are StorageRead, StorageDelete and StorageWrite and sending them to Log Analytics. However, having issues with creating right query which allows to list StorageDelete events. Can you please help with that please.

Thanks a lot

Answer 1

@Abduazim Sobitov Thanks for your patience and co-operation.

Are you by chance using Premium Files? If so, are you able to see the Delete operations in Azure Monitor as shown below?

If the answer is no, and you are for sure that deletes are occurring, We can work closer on this issue?

To monitor metadata operations on your share, you can access and use Azure metrics in the portal.

1. In the Azure portal, go to your storage account.
2. On the left pane, under Monitoring, select Metrics.
3. Select File as the metric namespace for your storage account scope.
4. Select Transactions as the metric.
5. Add a filter for API name. Create/Close
6. Optionally you can use Split by to breakdown per operations

I was able to confirm that the operation might be logged under “Closed”  
  
So try using this query.  
  
StorageFileLogs   
| where Category == "StorageDelete"  

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.