Snippets

KQL snippet: spot Azure Diagnostic Settings drift

A short query to find writes, deletes and destination changes that explain a sudden disappearance of logs.

20 Jun 2026 azurediagnostic-settingslogskqlmonitoringgovernancerunbookactivity-log

If logs disappear just before or during an incident, first check whether a Diagnostic Settings resource was changed, deleted or redirected to another workspace.

kusto diagnostic-settings-drift.kql

let Window = 7d;
AzureActivity
| where TimeGenerated > ago(Window)
| where OperationNameValue has "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS"
| project TimeGenerated,
        OperationNameValue,
        ActivityStatusValue,
        ResourceGroup,
        ResourceProviderValue,
        ResourceId,
        Caller,
        CorrelationId,
        Properties
| order by TimeGenerated desc

Quick read: a delete explains a full log gap; a successful write may have changed categories or destination; repeated failures may reveal automation trying to restore a non-compliant configuration.