{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
        "slug": "dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/"
        },
        "title": "Do not equate Log Analytics export failures with a count of lost records",
        "summary": "How should a continuous-export operator interpret retries, duplicate delivery and destination failures?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:26:41+00:00",
        "modified_at": "2026-09-10T01:40:02+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 241,
        "potentially_affected": "Continuous Log Analytics data exports to Azure Storage or Event Hubs.",
        "dse_recommendation": "Investigate destination failures using retry context and record-level reconciliation instead of treating a failure counter as lost-event evidence.",
        "primary_source": {
            "name": "Log Analytics Data Export Rules in Azure Monitor - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Log Analytics export rules continuously send new records from selected tables to Storage or Event Hubs. When a destination lacks capacity or availability, export retries continue for up to twelve hours and can produce duplicate records. Data is discarded if the destination remains unavailable after that retry period. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<p>Export Failures counts unsuccessful requests, including throttling and access failures. Microsoft explicitly says this counter does not establish missing data because failed attempts are retried. Records Exported counts records in successful operations. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this review to continuous Log Analytics data exports to Azure Storage or Event Hubs. These rules export arrivals from configuration time, not historical records already in the workspace. Keep historical export work separate from recovery of a current delivery problem. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends giving destination availability an operational owner and responding before the retry window is exhausted. Track the failed-request interval, throttling or access cause, and recovery time. Define how the receiving system identifies repeated records. Do not report an exact loss count from the failure metric alone or assume successful-request totals prove unique delivery.</p>\n<h2>Verification</h2>\n<p>Compare representative source records with received records across an approved test interval. Include delayed and repeated arrivals in the reconciliation. Preserve the destination metrics, timestamps and unresolved record differences. Close the issue only after distinguishing retry attempts, confirmed duplicates and records whose delivery remains unverified.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Log Analytics data export rules</a>.</p>",
        "content_text": "Source facts\nLog Analytics export rules continuously send new records from selected tables to Storage or Event Hubs. When a destination lacks capacity or availability, export retries continue for up to twelve hours and can produce duplicate records. Data is discarded if the destination remains unavailable after that retry period. Microsoft Learn.\nExport Failures counts unsuccessful requests, including throttling and access failures. Microsoft explicitly says this counter does not establish missing data because failed attempts are retried. Records Exported counts records in successful operations. Microsoft Learn.\nApplicability\nApply this review to continuous Log Analytics data exports to Azure Storage or Event Hubs. These rules export arrivals from configuration time, not historical records already in the workspace. Keep historical export work separate from recovery of a current delivery problem. Microsoft Learn.\nDSE recommendation\nDSE recommends giving destination availability an operational owner and responding before the retry window is exhausted. Track the failed-request interval, throttling or access cause, and recovery time. Define how the receiving system identifies repeated records. Do not report an exact loss count from the failure metric alone or assume successful-request totals prove unique delivery.\nVerification\nCompare representative source records with received records across an approved test interval. Include delayed and repeated arrivals in the reconciliation. Preserve the destination metrics, timestamps and unresolved record differences. Close the issue only after distinguishing retry attempts, confirmed duplicates and records whose delivery remains unverified.\nOfficial references\nMicrosoft Learn: Log Analytics data export rules.",
        "content_markdown": "## Source facts\n\nLog Analytics export rules continuously send new records from selected tables to Storage or Event Hubs. When a destination lacks capacity or availability, export retries continue for up to twelve hours and can produce duplicate records. Data is discarded if the destination remains unavailable after that retry period. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export).\n\nExport Failures counts unsuccessful requests, including throttling and access failures. Microsoft explicitly says this counter does not establish missing data because failed attempts are retried. Records Exported counts records in successful operations. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export).\n\n## Applicability\n\nApply this review to continuous Log Analytics data exports to Azure Storage or Event Hubs. These rules export arrivals from configuration time, not historical records already in the workspace. Keep historical export work separate from recovery of a current delivery problem. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export).\n\n## DSE recommendation\n\nDSE recommends giving destination availability an operational owner and responding before the retry window is exhausted. Track the failed-request interval, throttling or access cause, and recovery time. Define how the receiving system identifies repeated records. Do not report an exact loss count from the failure metric alone or assume successful-request totals prove unique delivery.\n\n## Verification\n\nCompare representative source records with received records across an approved test interval. Include delayed and repeated arrivals in the reconciliation. Preserve the destination metrics, timestamps and unresolved record differences. Close the issue only after distinguishing retry attempts, confirmed duplicates and records whose delivery remains unverified.\n\n## Official references\n\n[Microsoft Learn: Log Analytics data export rules](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Do not equate Log Analytics export failures with a count of lost records",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/",
                "headline": "Do not equate Log Analytics export failures with a count of lost records",
                "description": "How should a continuous-export operator interpret retries, duplicate delivery and destination failures?",
                "abstract": "How should a continuous-export operator interpret retries, duplicate delivery and destination failures?",
                "articleBody": "Source facts\nLog Analytics export rules continuously send new records from selected tables to Storage or Event Hubs. When a destination lacks capacity or availability, export retries continue for up to twelve hours and can produce duplicate records. Data is discarded if the destination remains unavailable after that retry period. Microsoft Learn.\nExport Failures counts unsuccessful requests, including throttling and access failures. Microsoft explicitly says this counter does not establish missing data because failed attempts are retried. Records Exported counts records in successful operations. Microsoft Learn.\nApplicability\nApply this review to continuous Log Analytics data exports to Azure Storage or Event Hubs. These rules export arrivals from configuration time, not historical records already in the workspace. Keep historical export work separate from recovery of a current delivery problem. Microsoft Learn.\nDSE recommendation\nDSE recommends giving destination availability an operational owner and responding before the retry window is exhausted. Track the failed-request interval, throttling or access cause, and recovery time. Define how the receiving system identifies repeated records. Do not report an exact loss count from the failure metric alone or assume successful-request totals prove unique delivery.\nVerification\nCompare representative source records with received records across an approved test interval. Include delayed and repeated arrivals in the reconciliation. Preserve the destination metrics, timestamps and unresolved record differences. Close the issue only after distinguishing retry attempts, confirmed duplicates and records whose delivery remains unverified.\nOfficial references\nMicrosoft Learn: Log Analytics data export rules.",
                "datePublished": "2026-09-10T00:26:41+00:00",
                "dateModified": "2026-09-10T01:40:02+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-315-do-not-equate-log-analytics-export-failures-with-a-count-of-lost-records/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Do not equate Log Analytics export failures with a count of lost records"
                },
                "articleSection": [
                    "Business Continuity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 241,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Log Analytics Data Export Rules in Azure Monitor - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export"
                }
            }
        ]
    }
}