Azure Database for MySQL Flexible Server: Dedicated diagnostic setting still sends MySqlAuditLogs to AzureDiagnostics

Question

Azure Database for MySQL Flexible Server: Dedicated diagnostic setting still sends MySqlAuditLogs to AzureDiagnostics

Zafar Shaikh 0

I am using Azure Database for MySQL Flexible Server and want to send MySqlAuditLogs and MySqlSlowLogs to resource-specific Log Analytics tables instead of the legacy AzureDiagnostics table.

I configured the diagnostic setting as follows:

az monitor diagnostic-settings create \
  --name dblogs \
  --resource "/subscriptions/<subscription-id>/resourceGroups/Network/providers/Microsoft.DBforMySQL/flexibleServers/db" \
  --workspace "/subscriptions/<subscription-id>/resourceGroups/Network/providers/Microsoft.OperationalInsights/workspaces/logws" \
  --export-to-resource-specific true \
  --logs '[{"category":"MySqlSlowLogs","enabled":true},{"category":"MySqlAuditLogs","enabled":true}]'

When I check the diagnostic setting, Azure reports:

{
  "destination": "Dedicated",
  "logs": [
    "MySqlSlowLogs",
    "MySqlAuditLogs"
  ]
}

Specifically:

az monitor diagnostic-settings show \
  --name dblogs \
  --resource "/subscriptions/<subscription-id>/resourceGroups/Network/providers/Microsoft.DBforMySQL/flexibleServers/db" \
  --query "{destination:logAnalyticsDestinationType,workspace:workspaceId,logs:logs[].category}" \
  -o json

returns:

{
  "destination": "Dedicated",
  "logs": [
    "MySqlSlowLogs",
    "MySqlAuditLogs"
  ],
  "workspace": ".../workspaces/logws"
}

However, new MySqlAuditLogs records are still being ingested into the AzureDiagnostics table.

For example, I can query:

AzureDiagnostics
| where Category == "MySqlAuditLogs"
| where _ResourceId contains "db"
| where TimeGenerated > ago(1h)

and receive new records.

At the same time, querying the resource-specific table:

MySqlAuditLogs
| where _ResourceId contains "db"
| where TimeGenerated > ago(1h)

returns no results.

I also noticed that Microsoft's documentation appears to have some conflicting information:

The diagnostic setting supports Dedicated / resource-specific mode.
There is a MySqlAuditLogs resource-specific table documented in Azure Monitor.
However, the Azure Database for MySQL Flexible Server supported logs documentation appears to map MySqlAuditLogs and MySqlSlowLogs to AzureDiagnostics.

Questions

For Azure Database for MySQL Flexible Server, are MySqlAuditLogs and MySqlSlowLogs currently supported in resource-specific Log Analytics tables?
If they are supported, why does setting logAnalyticsDestinationType to Dedicated still result in new records being written to AzureDiagnostics?
Is Dedicated currently ignored for these MySQL diagnostic categories?
Is there a specific API version, Azure region, MySQL Flexible Server version, or diagnostic-settings configuration required to enable the resource-specific tables?
If resource-specific tables are not currently supported for these categories, is there an official Microsoft roadmap or timeline for supporting them?

I am specifically trying to determine whether this is expected behavior, a service limitation, or a configuration/API issue.

Thank you.

0 comments

1 answer

Your answer

Answer 1

Hello @Zafar Shaikh

What you're seeing appears to be expected behavior for Azure Database for MySQL Flexible Server at present, rather than an issue with your CLI syntax or API version.

Although the diagnostic setting accepts logAnalyticsDestinationType = Dedicated and subsequently reports the destination as Dedicated, Microsoft's current supported-logs documentation maps both MySqlAuditLogs and MySqlSlowLogs for Microsoft.DBforMySQL/flexibleServers to AzureDiagnostics, not to resource-specific tables.

Microsoft's MySQL Flexible Server monitoring documentation reinforces this. It lists the relevant Log Analytics tables as AzureActivity, AzureDiagnostics, and AzureMetrics, and its examples for both audit and slow-query logs query AzureDiagnostics.

In your situation, changing the API version, region, MySQL version, or recreating the diagnostic setting will not cause MySqlAuditLogs or MySqlSlowLogs to be stored in dedicated tables. Although the diagnostic-setting control plane supports the Dedicated destination type, the resource provider's category-to-table mapping ultimately determines where those logs are ingested.

Your working query is therefore currently the appropriate one:

AzureDiagnostics
| where Category == "MySqlAuditLogs"
| where _ResourceId contains "db"
| where TimeGenerated > ago(1h)

Interestingly, there is documentation for tables named MySqlAuditLogs, which makes this confusing. However, the authoritative supported-log mapping for Microsoft.DBforMySQL/flexibleServers currently maps these categories to AzureDiagnostics. Microsoft's newer platform-logs reference also explicitly maps MySQL Flexible Server MySqlAuditLogs and MySqlSlowLogs to AzureDiagnostics.

So treat the behavior you're seeing as a current service limitation/documentation inconsistency, not a configuration problem.

I also couldn't find a published Microsoft roadmap or GA date for moving these Flexible Server categories to resource-specific Log Analytics tables. If dedicated tables are a requirement for your logging architecture, I'd recommend opening an Azure support request and asking Microsoft to confirm the roadmap for resource-specific mode for Microsoft.DBforMySQL/flexibleServers.

References:

Monitoring data reference for Azure Database for MySQL Flexible Server

Monitor Azure Database for MySQL Flexible Server

Hope this clarifies why Dedicated is shown in the diagnostic setting while the actual records continue to land in AzureDiagnostics.

=============================================================================

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution.