Do not equate Log Analytics export failures with a count of lost records

Source facts

Log Analytics export rules continuously send new records from selected tables to Storage or Event Hubs. When a destination lacks capacity or availability, export retries continue for up to twelve hours and can produce duplicate records. Data is discarded if the destination remains unavailable after that retry period. Microsoft Learn.

Export Failures counts unsuccessful requests, including throttling and access failures. Microsoft explicitly says this counter does not establish missing data because failed attempts are retried. Records Exported counts records in successful operations. Microsoft Learn.

Applicability

Apply this review to continuous Log Analytics data exports to Azure Storage or Event Hubs. These rules export arrivals from configuration time, not historical records already in the workspace. Keep historical export work separate from recovery of a current delivery problem. Microsoft Learn.

DSE recommendation

DSE recommends giving destination availability an operational owner and responding before the retry window is exhausted. Track the failed-request interval, throttling or access cause, and recovery time. Define how the receiving system identifies repeated records. Do not report an exact loss count from the failure metric alone or assume successful-request totals prove unique delivery.

Verification

Compare representative source records with received records across an approved test interval. Include delayed and repeated arrivals in the reconciliation. Preserve the destination metrics, timestamps and unresolved record differences. Close the issue only after distinguishing retry attempts, confirmed duplicates and records whose delivery remains unverified.

Official references

Microsoft Learn: Log Analytics data export rules.