Application Gateway for Containers: access and firewall logs intermittently not emitted (same gaps in Log Analytics and Storage)

Problem On an Application Gateway for Containers (AGC) resource in East US 2, TrafficControllerAccessLog and TrafficControllerFirewallLog are intermittently missing for requests the gateway served. Gaps last from 15 minutes to over 2 hours. In those windows the AGC TotalRequests metric shows traffic, but no log records exist in any diagnostic destination. Daily, between 10% and 97% of requests are logged.

Environment

• AGC (traffic controller) in East US 2, one frontend, WAF policy attached
• Diagnostic setting sending both categories to a Log Analytics workspace (no daily cap)
• No changes to the AGC, frontend, Gateway API resources or diagnostic settings during the affected period: Activity Log is clean and every resource has been at generation 1 since 2026-10-01

Troubleshooting completed

1. Metric vs. logs. We compared TotalRequests (PT15M, Total) with log row counts per 15-minute window. Many windows have traffic but zero log rows, often several in a row (up to about 150 minutes).
2. Parallel destination test. We added a second diagnostic setting sending the same two categories to a Storage account, running alongside the Log Analytics setting for 24 hours (2026-11-02T23:30Z to 2026-11-03T23:00Z, 94 windows):
   • Access log: 27,146 records in Log Analytics and 27,146 in Storage. Matched by trackingId: 25,737 distinct IDs in each, 0 in Storage only, 0 in Log Analytics only.
   • Firewall log: 82,545 records in each.
   • 21 of 94 windows had traffic in the metric but zero records in both destinations, for both categories. About 18 more were partial, with identical gaps in both.
   • For the 03:00 UTC hour, no hourly blob was written to Storage at all.
3. Backend correlation. Our backends log the same request ID as the AGC trackingId for a subset of requests. Of 21 such requests in the test period, 17 appear in both destinations and 4 appear in neither. All 4 were served successfully, and none appears in only one destination.
4. No pattern by request. Missing records span all HTTP methods, status codes and hosts.
5. Log Analytics ruled out. Ingestion latency, workspace limits and throttling were all ruled out. The Storage results also exclude the workspace as the cause.

Conclusion so far Two independent destinations receive exactly the same records and miss exactly the same ones, and in one hour nothing reached the diagnostic pipeline at all. The records appear never to be emitted by the AGC logging pipeline, upstream of Azure Monitor diagnostic settings. Microsoft Support (case 2610290040000885) agreed with this assessment.

Question Is there a known issue with AGC access/firewall log emission, in East US 2 or generally? Has anyone else seen intermittent missing AGC logs across all destinations? We need complete access logs for audit and security monitoring, so we're looking for a root cause and fix rather than a workaround.