Azure Audit en blob Storage me genera una carpeta llamada RO

Hi Mr. M,

Welcome to Microsoft Q&A, and thank you for posting your detailed question about the "RO" folder appearing in your Azure Audit Blob Storage.

When Azure SQL Database auditing is enabled to write audit logs to Blob Storage, audit logs are created in a structured directory hierarchy within the storage container. These logs are organized primarily by date, such as folders named "2025-10-02" containing .xel files that capture detailed audit events for that specific day.

What is the "RO" Folder?

The RO folder stands for Read-Only Replica. Azure SQL Database, especially in high availability and geo-replication scenarios, can have one or more read-only replicas of the database to offload read workloads or enable disaster recovery.

Audit logs generated by these Read-Only Replicas are stored separately inside this RO folder. Although the file format (.xel) and column structure remain consistent with the primary database audit logs, the content reflects auditing information specifically related to operations against the read-only replicas

Why are RO logs smaller and separate?

• The .xel files in the RO folder tend to be smaller (often less than 50 KB) because read-only replicas typically generate fewer audit events, mostly read-only queries and replica-specific activity.
• These logs contain similar audit columns but hold different event data distinct from the primary database logs, avoiding duplication.
• This separation helps administrators clearly distinguish between audit events occurring on the primary database and those on read-only replicas, which is especially useful for compliance, monitoring, and troubleshooting in geo-distributed or highly available environments.

Why didn’t it appear in your test environment?

• If in a test environment you do not see such a folder, it is likely because read-only replicas are not configured there. This separation helps keep primary database audit logs distinct from the replicas' audit logs, aiding in precise auditing and troubleshooting.
• Thus, the presence of the RO folder is expected behavior in environments where read-only replicas exist and are audited separately.

How to query these logs?

You can use the sys.fn_get_audit_file function to query both daily and RO logs:

SELECT *
FROM sys.fn_get_audit_file (
  'https://<storage-account>.blob.core.windows.net/<container>/RO/', 
  NULL, 
  NULL
);

Replace the placeholders with your actual storage account, container, server name, database name, audit name, and date folder.

This will allow you to analyze and monitor audit events from the read-only replicas alongside the primary database logs.

In summary, the RO folder’s presence is expected and indicates audit logs from read-only replicas that Azure SQL Database tracks separately for clear differentiation and auditing completeness. This setup is especially relevant in production environments with geo-replication or high availability enabled.

Feel free to ask if you need further clarification on this.

If the provided information answers your query, please do "Accept Answer", it will help others who might be facing similar challenges.

Thanks,

Harish.