{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "slug": "dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion", "url": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/" }, "title": "Account for checkpoint reset when recreating Event Hubs log ingestion", "summary": "What can happen to retained events when a direct Event Hubs-to-Logs association is removed and rebuilt?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:08+00:00", "modified_at": "2026-09-10T02:08:04+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 249, "potentially_affected": "Existing eligible direct Event Hubs ingestion into Azure Monitor Logs, a public-preview feature.", "dse_recommendation": "Treat removal of the last ingestion association as a checkpoint change, not just temporary configuration cleanup.", "primary_source": { "name": "Ingest events from Azure Event Hubs into Azure Monitor Logs (Preview) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/ingest-logs-event-hub", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Direct Event Hubs ingestion into Azure Monitor Logs is in public preview. Microsoft states that removing all related DCR associations stops ingestion; deleting those associations or their DCRs also resets Event Hub checkpointing. When an association is created, ingestion includes events already retained in the hub as well as new arrivals. Recreating configuration therefore needs a deliberate review of the retained-event starting point. Microsoft Learn.

\n

Applicability

\n

Apply this review to an existing eligible direct-ingestion setup. Confirm the Event Hub, consumer group, associations, rules, and destination table before a rebuild. Check the current preview prerequisites and regional capacity if establishing a new deployment; this article does not replace that readiness work.

\n

DSE recommendation

\n

Treat removal of the last ingestion association as a checkpoint change, not just temporary configuration cleanup. Record what is already stored at the destination and what remains retained at the source. Ask the ingestion owner to define how any re-read events will be recognized and reconciled. Do not assume that restoring a similarly named association preserves the former progress record.

\n

Verification

\n

Rehearse the approved rebuild in a test stream containing identifiable retained events and fresh arrivals. Compare destination records before and after association recreation. Preserve observed re-reading, gaps, and timing as separate findings rather than hiding them in a total row count. Use the resulting evidence to approve the production reconciliation approach before removing an existing ingestion relationship.

\n

Official references

\n

Microsoft Learn: Ingest Event Hubs events into Azure Monitor Logs (Public Preview). Source reviewed September 9, 2026.

", "content_text": "Source facts\nDirect Event Hubs ingestion into Azure Monitor Logs is in public preview. Microsoft states that removing all related DCR associations stops ingestion; deleting those associations or their DCRs also resets Event Hub checkpointing. When an association is created, ingestion includes events already retained in the hub as well as new arrivals. Recreating configuration therefore needs a deliberate review of the retained-event starting point. Microsoft Learn.\nApplicability\nApply this review to an existing eligible direct-ingestion setup. Confirm the Event Hub, consumer group, associations, rules, and destination table before a rebuild. Check the current preview prerequisites and regional capacity if establishing a new deployment; this article does not replace that readiness work.\nDSE recommendation\nTreat removal of the last ingestion association as a checkpoint change, not just temporary configuration cleanup. Record what is already stored at the destination and what remains retained at the source. Ask the ingestion owner to define how any re-read events will be recognized and reconciled. Do not assume that restoring a similarly named association preserves the former progress record.\nVerification\nRehearse the approved rebuild in a test stream containing identifiable retained events and fresh arrivals. Compare destination records before and after association recreation. Preserve observed re-reading, gaps, and timing as separate findings rather than hiding them in a total row count. Use the resulting evidence to approve the production reconciliation approach before removing an existing ingestion relationship.\nOfficial references\nMicrosoft Learn: Ingest Event Hubs events into Azure Monitor Logs (Public Preview). Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nDirect Event Hubs ingestion into Azure Monitor Logs is in public preview. Microsoft states that removing all related DCR associations stops ingestion; deleting those associations or their DCRs also resets Event Hub checkpointing. When an association is created, ingestion includes events already retained in the hub as well as new arrivals. Recreating configuration therefore needs a deliberate review of the retained-event starting point. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/ingest-logs-event-hub).\n\n## Applicability\n\nApply this review to an existing eligible direct-ingestion setup. Confirm the Event Hub, consumer group, associations, rules, and destination table before a rebuild. Check the current preview prerequisites and regional capacity if establishing a new deployment; this article does not replace that readiness work.\n\n## DSE recommendation\n\nTreat removal of the last ingestion association as a checkpoint change, not just temporary configuration cleanup. Record what is already stored at the destination and what remains retained at the source. Ask the ingestion owner to define how any re-read events will be recognized and reconciled. Do not assume that restoring a similarly named association preserves the former progress record.\n\n## Verification\n\nRehearse the approved rebuild in a test stream containing identifiable retained events and fresh arrivals. Compare destination records before and after association recreation. Preserve observed re-reading, gaps, and timing as separate findings rather than hiding them in a total row count. Use the resulting evidence to approve the production reconciliation approach before removing an existing ingestion relationship.\n\n## Official references\n\n[Microsoft Learn: Ingest Event Hubs events into Azure Monitor Logs (Public Preview)](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/ingest-logs-event-hub). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "url": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for checkpoint reset when recreating Event Hubs log ingestion", "item": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "url": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/", "headline": "Account for checkpoint reset when recreating Event Hubs log ingestion", "description": "What can happen to retained events when a direct Event Hubs-to-Logs association is removed and rebuilt?", "abstract": "What can happen to retained events when a direct Event Hubs-to-Logs association is removed and rebuilt?", "articleBody": "Source facts\nDirect Event Hubs ingestion into Azure Monitor Logs is in public preview. Microsoft states that removing all related DCR associations stops ingestion; deleting those associations or their DCRs also resets Event Hub checkpointing. When an association is created, ingestion includes events already retained in the hub as well as new arrivals. Recreating configuration therefore needs a deliberate review of the retained-event starting point. Microsoft Learn.\nApplicability\nApply this review to an existing eligible direct-ingestion setup. Confirm the Event Hub, consumer group, associations, rules, and destination table before a rebuild. Check the current preview prerequisites and regional capacity if establishing a new deployment; this article does not replace that readiness work.\nDSE recommendation\nTreat removal of the last ingestion association as a checkpoint change, not just temporary configuration cleanup. Record what is already stored at the destination and what remains retained at the source. Ask the ingestion owner to define how any re-read events will be recognized and reconciled. Do not assume that restoring a similarly named association preserves the former progress record.\nVerification\nRehearse the approved rebuild in a test stream containing identifiable retained events and fresh arrivals. Compare destination records before and after association recreation. Preserve observed re-reading, gaps, and timing as separate findings rather than hiding them in a total row count. Use the resulting evidence to approve the production reconciliation approach before removing an existing ingestion relationship.\nOfficial references\nMicrosoft Learn: Ingest Event Hubs events into Azure Monitor Logs (Public Preview). Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:24:08+00:00", "dateModified": "2026-09-10T02:08:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-468-account-for-checkpoint-reset-when-recreating-event-hubs-log-ingestion/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for checkpoint reset when recreating Event Hubs log ingestion" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Ingest events from Azure Event Hubs into Azure Monitor Logs (Preview) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/ingest-logs-event-hub" } } ] } }