Not able to fetch the logs from log-analytics workspace for mysql flexible db server.

Question

Not able to fetch the logs from log-analytics workspace for mysql flexible db server.

Anonymous

Subscription(move)

:

Subscription ID

:

Resource group(move)

:

appsteerrgprod01

Status

:

Ready

Location

:

East US 2

Endpoint

:

Administrator login

:

Configuration

:

Memory Optimized, E2ds_v4, 2 vCores, 16 GiB RAM, 69 storage, 1000 IOPS

MySQL version

:

8.0 Upgrade

Availability zone

:

1

Created on

:

2022-01-21 07:37:53.3110151 UTC

For the above database server we are not able to fetch the logs from log-analytics worksapce.
User's image

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-04T10:56:12.2933333+00:00
Hello Punit katnalli, thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates. Could you please help me with the below details:

Can you confirm that you’ve created a Diagnostic setting on the MySQL flexible server and selected the MySqlSlowLogs (and/or other) categories to send to your Log Analytics workspace?

Have you enabled the slow_query_log parameter on the server and set an appropriate long_query_time so that slow queries are actually being logged?

"What time range are you using in the Log Analytics query, and do you see any records at all under AzureDiagnostics for other categories?

Thanks,
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-04T13:11:53.4366667+00:00
Hello Punit katnalli, we understand that you are unable to retrieve logs from your Azure Database for MySQL – Flexible Server in Log Analytics Workspace.

Verify your Diagnostic Setting

In the Azure portal > go to your MySQL flexible server

Monitoring > Diagnostic settings.

Make sure you have a setting that points to your Log Analytics workspace and that you’ve checked at least: MySqlSlowLogs and MySqlAuditLogs (if you need general/audit logs)

click "Save" after any changes.

Azure Database for MySQL Flexible Server supports resource‑specific tables in Azure Monitor Logs. When this mode is in effect, logs are written directly to dedicated tables, and AzureDiagnostics may remain empty even though logging is working as expected.

Microsoft documents that MySQL Flexible Server resource logs can be queried from service‑specific Log Analytics tables, depending on how diagnostics are configured and the ingestion mode used.

Monitoring Data Reference for Azure Database for MySQL - Azure Database for MySQL | Microsoft Learn

When resource‑specific tables are enabled, use: MySqlAuditLogs ,MySqlSlowLogs or MySqlErrorLogs, Instead of AzureDiagnostics. Querying AzureDiagnostics in this case will legitimately return no results, even though logs exist and are being ingested.

Verify server parameters:

On your server’s Server parameters blade, check

slow_query_log = ON (If OFF > no slow logs generated and nothing exported).

long_query_time = (set to a threshold, e.g. 5 or 10 seconds)

log_queries_not_using_indexes = ON (optional, if you want really noisy queries)

If you’re after audit/general logs, also ensure:

audit_log_enabled = ON (Without this, no audit logs generated.)

audit_log_events includes the event types you want (e.g. GENERAL, CONNECT, QUERY, TABLE etc.)

audit_log_include_users / audit_log_exclude_users are configured appropriately.

Reference documents:

Enable and Download Server Logs - Azure Database for MySQL | Microsoft Learn

Monitor Azure Database for MySQL - Azure Database for MySQL | Microsoft Learn

Hope this helps. and please feel free to reach out if you have any further questions. Thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-05T09:49:41.8266667+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, if you have any further question, please let us know. Thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-06T09:35:33.65+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, if you have any further question, please let us know. Thanks
Anonymous

2026-03-06T10:20:18.7933333+00:00

Hi Bharath, Thanks for the reply, I went through the details you mentioned above, We actually enabled all the diagnostic settings and required server parameters. Actually we were getting all the logs before and the log-analytics was working fine, Form recent days we are not able to fetch the logs. Also we haven't made any changes in the configuration.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-06T10:53:27.7633333+00:00
Hello Punit katnalli, Thanks for the update. can you please verify the below steps also,

Verify Diagnostic Settings Are Still Active

Go to your MySQL Flexible Server > Diagnostic settings.

Check The Log Analytics workspace is still selected. And required log categories are enabled such as MySqlAuditLogs, MySqlSlowLogs and MySqlErrorLogs

Common issue is sometimes diagnostic settings get deleted during redeployments (ARM/Bicep/Terraform) or by Azure Policy remediation.

You can also confirm using CLI:

az monitor diagnostic-settings list \ --resource <mysql-resource-id>

If nothing returns, the diagnostic setting was removed.

Diagnostic settings may appear enabled, but if the Log Analytics workspace was recreated, moved, or redeployed, the underlying workspace Resource ID referenced in the diagnostic setting might change. When this occurs, logs may stop flowing even though the configuration looks unchanged in the portal. It’s recommended to verify that the diagnostic setting still points to the correct active workspace.

You can confirm using Azure CLI:

az monitor diagnostic-settings list \ --resource <mysql-flexible-server-resource-id>

Check the value of workspaceId

Ensure it matches the current Log Analytics workspace resource ID:

az monitor log-analytics workspace show \ --resource-group <rg-name> \ --workspace-name <workspace-name>

Hope this helps! thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-09T12:32:16.52+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, please feel free to reach out if you have any further questions. Thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-10T09:54:28.2166667+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, please feel free to reach out if you have any further questions. Thanks
Anonymous

2026-03-11T09:39:20.5+00:00

Hi Bharath, We have cross checked for the diagnostic setting config which you suggested, Everyhting is configured properly but still not able to fetch any logs.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-12T10:50:40.03+00:00
Hello Punit katnalli, Based on the screenshot, your configuration for the workspace allLogs and audit setting is correct. Since the settings are visually correct but logs have stopped flowing. Since the settings are visually correct but logs have stopped flowing. we need to look at the Ingestion Health and Resource Provider status.

Check the "Ingestion Latency" and Error logs: If the configuration is right but data is missing, the workspace itself usually records why it isn't receiving the data. Run this query in your Log analytics workspace:

_LogOperation | where TimeGenerated > ago(24h) | where Category == "Ingestion" | where Level == "Warning" or Level == "Error" | where Detail contains "MySQL" or Detail contains "<Your Workspace name>" | project TimeGenerated, Operation, Level, Detail, _ResourceId

If you see errors here, it will likely mention "Subscription not registered" or "Throttling."

Verify the "Resource-Specific" vs "AzureDiagnostics" Mode: In your screenshot, you are using the modern Category Groups (allLogs). This almost always defaults to Resource-Specific tables.

Instead of checking AzureDiagnostics, explicitly check if the dedicated tables even exist in the schema:

Clear your query window.

Run: MySqlAuditLogs | take 10

Run: MySqlSlowLogs | take 10

If it returns "Table not found," then the schema hasn't been initialized because no data has reached the workspace since the "break" occurred.

Check for AMPLS (Private Link) Block: Since you are in a PROD environment, check if a Private Link Scope was added to your workspace recently.

If the workspace is part of a Private Link Scope and "Public Ingestion" is disabled, the MySQL server (which is a PaaS service) may be blocked from sending logs unless it has a path through that Private Link.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-16T09:28:59.1+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, if you have any further question, please let us know. Thanks
Anonymous

2026-03-20T04:31:50.1433333+00:00

Hello Punit katnalli,
We haven’t heard back from you. Have you had a chance to work on the solution provided by Bharath Y P ? Please confirm whether the issue has been resolved or if you need any further assistance.

Your answer

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-04T10:56:12.2933333+00:00

Hello Punit katnalli, thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates. Could you please help me with the below details:

Can you confirm that you’ve created a Diagnostic setting on the MySQL flexible server and selected the MySqlSlowLogs (and/or other) categories to send to your Log Analytics workspace?

Have you enabled the slow_query_log parameter on the server and set an appropriate long_query_time so that slow queries are actually being logged?

"What time range are you using in the Log Analytics query, and do you see any records at all under AzureDiagnostics for other categories?

Thanks,
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-05T09:49:41.8266667+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, if you have any further question, please let us know. Thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-06T09:35:33.65+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, if you have any further question, please let us know. Thanks
Anonymous

2026-03-06T10:20:18.7933333+00:00

Hi Bharath, Thanks for the reply, I went through the details you mentioned above, We actually enabled all the diagnostic settings and required server parameters. Actually we were getting all the logs before and the log-analytics was working fine, Form recent days we are not able to fetch the logs. Also we haven't made any changes in the configuration.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-06T10:53:27.7633333+00:00

Hello Punit katnalli, Thanks for the update. can you please verify the below steps also,

Verify Diagnostic Settings Are Still Active

Go to your MySQL Flexible Server > Diagnostic settings.

Check The Log Analytics workspace is still selected. And required log categories are enabled such as MySqlAuditLogs, MySqlSlowLogs and MySqlErrorLogs

Common issue is sometimes diagnostic settings get deleted during redeployments (ARM/Bicep/Terraform) or by Azure Policy remediation.

You can also confirm using CLI:

az monitor diagnostic-settings list \ --resource <mysql-resource-id>

If nothing returns, the diagnostic setting was removed.

Diagnostic settings may appear enabled, but if the Log Analytics workspace was recreated, moved, or redeployed, the underlying workspace Resource ID referenced in the diagnostic setting might change. When this occurs, logs may stop flowing even though the configuration looks unchanged in the portal. It’s recommended to verify that the diagnostic setting still points to the correct active workspace.

You can confirm using Azure CLI:

az monitor diagnostic-settings list \ --resource <mysql-flexible-server-resource-id>

Check the value of workspaceId

Ensure it matches the current Log Analytics workspace resource ID:

az monitor log-analytics workspace show \ --resource-group <rg-name> \ --workspace-name <workspace-name>

Hope this helps! thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-09T12:32:16.52+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, please feel free to reach out if you have any further questions. Thanks
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-10T09:54:28.2166667+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, please feel free to reach out if you have any further questions. Thanks
Anonymous

2026-03-11T09:39:20.5+00:00

Hi Bharath, We have cross checked for the diagnostic setting config which you suggested, Everyhting is configured properly but still not able to fetch any logs.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-12T10:50:40.03+00:00

Hello Punit katnalli, Based on the screenshot, your configuration for the workspace allLogs and audit setting is correct. Since the settings are visually correct but logs have stopped flowing. Since the settings are visually correct but logs have stopped flowing. we need to look at the Ingestion Health and Resource Provider status.

Check the "Ingestion Latency" and Error logs: If the configuration is right but data is missing, the workspace itself usually records why it isn't receiving the data. Run this query in your Log analytics workspace:

_LogOperation | where TimeGenerated > ago(24h) | where Category == "Ingestion" | where Level == "Warning" or Level == "Error" | where Detail contains "MySQL" or Detail contains "<Your Workspace name>" | project TimeGenerated, Operation, Level, Detail, _ResourceId

If you see errors here, it will likely mention "Subscription not registered" or "Throttling."

Verify the "Resource-Specific" vs "AzureDiagnostics" Mode: In your screenshot, you are using the modern Category Groups (allLogs). This almost always defaults to Resource-Specific tables.

Instead of checking AzureDiagnostics, explicitly check if the dedicated tables even exist in the schema:

Clear your query window.

Run: MySqlAuditLogs | take 10

Run: MySqlSlowLogs | take 10

If it returns "Table not found," then the schema hasn't been initialized because no data has reached the workspace since the "break" occurred.

Check for AMPLS (Private Link) Block: Since you are in a PROD environment, check if a Private Link Scope was added to your workspace recently.

If the workspace is part of a Private Link Scope and "Public Ingestion" is disabled, the MySQL server (which is a PaaS service) may be blocked from sending logs unless it has a path through that Private Link.
Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-03-16T09:28:59.1+00:00

Hello Punit katnalli, I just wanted to kindly follow up to check, If the provided answer is helpful, if you have any further question, please let us know. Thanks
Anonymous

2026-03-20T04:31:50.1433333+00:00

Hello Punit katnalli,
We haven’t heard back from you. Have you had a chance to work on the solution provided by Bharath Y P ? Please confirm whether the issue has been resolved or if you need any further assistance.