Retrieve detailed logs for actions performed against a cosmos container back in time

Question

We have no audit logs setup in Cosmos DB.
And last week the content in a container got wiped in one of our database.
We can see in metrics that the container has been wiped and the time, but we can't see what caused it.
Can we get more detailed information about what exactly triggered this, if it was a script or similar?

Best regards Anders

Answer 1

Hi @Anders Kardell,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Apologies for causing the issue.

Can we get more detailed information about what exactly triggered this, if it was a script or similar?

To get more detailed information about what triggered the deletion, you can enable audit logging for control plane operations in Cosmos DB.

Here are the steps to set it up:

1. Sign in to the Azure portal and navigate to your Azure Cosmos DB account.
2. Open the Diagnostic settings pane, provide a Name for the logs to create.
3. Select ControlPlaneRequests for log type and select the Send to Log Analytics option.
4. Optionally, send the diagnostic logs to Azure Storage, Azure Event Hubs, Azure Monitor, or a third party.

By enabling these logs, you can track detailed operations, including who performed the action and what method was used. This will help you identify the cause of the deletion.

Please follow the steps mentioned in this document https://learn.microsoft.com/en-us/azure/cosmos-db/audit-control-plane-logs#enable-diagnostic-logs-for-control-plane-operations to audit logging for control plane operations in Cosmos DB.

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further queries do let us know.