streaming storage account audit logs onto Event hub

MrFlinstone 761 Reputation points
2026-06-03T16:45:36.4166667+00:00

I would like to send audit logs relating to access to a blob account onto an event hub, I was wondering if there is a guide on how to configure, I have configured an event hub and under the diagnostic settings for blob, configured audit logs to be sent to event hub, however I cannot see the messages on the event hub data explorer.

I was wondering if I have done anything wrong here.

Thanks in advance.

Azure Event Hubs
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amira Bedhiafi 43,036 Reputation points MVP Volunteer Moderator
    2026-06-03T18:48:41.1133333+00:00

    Hello !

    Thank you for posting on MS Learn Q&A.

    You probably configured the right feature but I would check these points for Blob access audit logs, the relevant diagnostic log categories are StorageRead, StorageWrite and StorageDelete and they land under the StorageBlobLogs schema when sent to Log Analytics and the same categories are also valid when routing to Event Hubs.

    https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage-reference

    Generate new blob activity after enabling diagnostics where you upload, download, list, or delete a blob after the diagnostic setting is saved. Resource logs are not collected until a diagnostic setting is created and routed.

    In the Event Hub namespace check Incoming Messages. If this increases, the logs are arriving and the issue is only with how you are viewing them.

    In Event Hubs Data Explorer, select the exact event hub, consumer group, and use Oldest position or a custom timestamp. If you use Newest position, it only receives events sent after the view operation starts so previously delivered diagnostic events may not appear.

    https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-data-explorer

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.