Forum Discussion

ChristianHellman's avatar
ChristianHellman
Copper Contributor
Mar 05, 2021

Auditlogs from before setting up the export

Hello,

 

I was wondering if I'm not supposed to be able to query audit logs from before the export was set up to the workspace?

Currently I'm only getting results from after the export was setup, am I missing something?

Kind regard,

azure monitor

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Sep 18, 2026

    Enabling a Diagnostic Setting today does not automatically backfill older resource logs into Log Analytics.

     

    Diagnostic Settings begin routing logs after they are configured.

     

    There is one important distinction for the Azure Activity Log.

     

    Azure keeps Activity Log events natively for a limited retention period, so recent Activity Log entries may still be visible through the Azure portal even though they were never exported to Log Analytics.

     

    However, configuring Log Analytics afterwards will not automatically import that historical Activity Log data into the workspace.

     

    For long-term retention you should configure Diagnostic Settings in advance and route the required logs to:

     

    Log Analytics

    Storage Account

    Event Hub

    So the short answer is: No, enabling the export now will not retroactively populate old resource/audit logs in Log Analytics.