Why there is no AzureDiagnostics table for Azure Key Vault Managed HSM in Log Analytics workspace

Hi Waqas,

Thanks for reaching out to Microsoft Q&A.

Azure Key Vault Managed HSM uses a different logging mechanism compared to standard Azure Key Vault instances. This is why you wont see the AzureDiagnostics table for Managed HSM in Log Analytics workspace.

For Azure Key Vault Managed HSM, logs are sent to Azure Monitor Logs using a different schema and table. Instead of the AzureDiagnostics table, Managed HSM logs are stored in a resource-specific table named AzureDiagnostics_CL.

To query logs for Azure Key Vault Managed HSM, you should use the AzureDiagnostics_CL table in your Log Analytics workspace. Here's an example query:

AzureDiagnostics_CL
| where ResourceType == "MICROSOFT.KEYVAULT/MANAGEDHSMS"
| where TimeGenerated > ago(1d)

This query will retrieve logs from the past day for all Managed HSM instances.

It's important to note that you need to enable diagnostic settings for your Managed HSM to send logs to Log Analytics workspace. You can do this through the Azure portal, Azure CLI, or Azure PowerShell.

If you're not seeing the AzureDiagnostics_CL table, ensure that:

1. Diagnostic settings are properly configured for your Managed HSM.
2. You've allowed enough time for logs to be collected and appear in the workspace.
3. Your Log Analytics workspace is in a supported region for Managed HSM logging.

Regarding the article about enabling diagnostic settings using Azure CLI commands that send events to blob storage in JSON format, this is an alternative logging method. While it doesn't allow for direct querying in Log Analytics, you can use other tools to analyze these logs or import them into a system that allows for querying

https://video2.skills-academy.com/lt-lt/azure/key-vault/general/monitor-key-vault-reference.

you might want to consider using Azure Data Explorer or other log analysis tools that can work with JSON-formatted logs, if you're still having issues or need to query logs stored in blob storage,

https://video2.skills-academy.com/en-us/azure/key-vault/general/monitor-key-vault#collection-and-routing

Waqas: Please confirm if we are still connected on this discussion. Let me know if you need more info or help. Also let me know if the above suggestion helped.

@Waqas Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Thanks @Vinodh247 and @Givary-MSFT for your response.

It looks like a limitation of Azure Key Vault Managed HSM. I will look in to suggested alternatives.

@Vinodh247 I don't see "AzureDiagnostics_CL" table in my Log Analytics workspace. May be Diagnostic settings are not properly configured for my Managed HSM. I don't see an option in the UI. I will check if Diagnostic settings can be enabled from the command line.

Thanks.