Azure Classic file shares (Storage Account) not showing logs for Delete

Question

Azure Classic file shares (Storage Account) not showing logs for Delete

Le Thai Hien 0

I have a Classic File Share in Azure Storage Account. It has Soft Delete enabled.

In Diagnostic settings, I already enabled all logs for File (StorageRead, StorageWrite, StorageDelete).

However, when I upload a file and then delete it, the logs (StorageFileLogs) don't show anything related to Delete. (It still shows CreateFile, PutRange, etc.)

How do I view logs for Delete action? (Found a similar question here https://learn.microsoft.com/en-us/answers/questions/5879088/storagedelete-logs-not-appearing-in-storagebloblog. It looks like there's an issue with generating Delete logs from Azure side)

Suchitra Suregaunkar 14,425 Reputation points Microsoft External Staff Moderator

2026-06-01T18:37:49.06+00:00

Hello Le Thai Hien

Thank you for posting your query on Microsoft Q&A platform.

We are looking into this issue and will keep you posted updates.

Thanks,
Suchitra.
Suchitra Suregaunkar 14,425 Reputation points Microsoft External Staff Moderator

2026-06-01T18:52:50.5366667+00:00
Hello Le Thai Hien

Thank you for posting your question on Microsoft Q&A.

There are a few important things to verify here:

1. How you are deleting the file matters for the log query.

Delete operations in Azure File Shares are logged differently depending on the protocol used:

If deleting via Azure Portal (HTTPS/REST API): The delete will appear as a single DeleteFile operation in StorageFileLogs.

If deleting via a mounted SMB share: The delete will appear with Category = "StorageDelete" and SmbCommandMinor = "FileCloseAndDelete".

Use the appropriate KQL query based on your method:

For HTTPS/Portal deletions:

StorageFileLogs | where OperationName == "DeleteFile" | where TimeGenerated > ago(1d) | sort by TimeGenerated desc

For SMB deletions:

StorageFileLogs | where Protocol == "SMB" | where Category == "StorageDelete" | where SmbCommandMinor == "FileCloseAndDelete" | where TimeGenerated > ago(1d) | sort by TimeGenerated desc

2. Azure Storage logging is best-effort.

As documented by Microsoft, resource logs are logged on a best-effort basis, the completeness and timeliness of logs are not guaranteed. Logs can take some time to appear (sometimes up to an hour or more after the operation).

3. If logs still do not appear then this may be a backend issue.

There have been similar reports where StorageDelete logs are simply not generated by the Azure backend, while StorageRead and StorageWrite work correctly with the same diagnostic settings. This suggests a platform-side issue rather than a configuration problem.

Recommended next steps:

Wait at least 1 hour after performing the delete and then re-query.

Test in a different Azure region - create a storage account in another region (e.g., East US or West Europe) with the same diagnostic settings and test if delete logs appear there.

Use Event Grid as a workaround - Azure Storage's built-in Event Grid integration fires a Microsoft.Storage.BlobDeleted / file deleted event for every delete. You can route these events to a Log Analytics workspace, Logic App, or Event Hub to build alerts.

References:

Monitor Azure Files

StorageFileLogs table reference

Azure Storage Analytics logging (best-effort note)

Hope this helps! Please let me know if you have any further questions.

Thanks,

Suchitra.
Suchitra Suregaunkar 14,425 Reputation points Microsoft External Staff Moderator

2026-06-02T22:26:56.2066667+00:00

Hello Le Thai Hien

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.

2 answers

Your answer

Suchitra Suregaunkar 14,425 Reputation points Microsoft External Staff Moderator

2026-06-01T18:37:49.06+00:00

Hello Le Thai Hien

Thank you for posting your query on Microsoft Q&A platform.

We are looking into this issue and will keep you posted updates.

Thanks,
Suchitra.
Suchitra Suregaunkar 14,425 Reputation points Microsoft External Staff Moderator

2026-06-02T22:26:56.2066667+00:00

Hello Le Thai Hien

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.

Answer 1

Hello @Le Thai Hien

Thank you for reaching out to the Microsoft Q&A forum!

Based on your description and the fact that you are seeing CreateFile and PutRange events, you are interacting with the Azure file share via the REST API (such as through the Azure Portal, Azure Storage Explorer, or AzCopy) rather than via an SMB mount.

Here is the breakdown of why you might not be seeing the delete logs and how logging is categorized:

1. Logging Differences (REST API vs. SMB Protocol) The way file deletions are logged depends entirely on how the file was accessed and deleted:

Via REST API: Deleting a file triggers a DeleteFile operation, which natively falls under the StorageDelete category. Since you see CreateFile and PutRange (which are REST operations), you should rightfully expect to see DeleteFile in your StorageFileLogs when you delete a file.
Via SMB: If you were modifying files via a mounted network drive (SMB), the SMB protocol maps file deletion to a SetInfo operation (marking the file for deletion) followed by a Close operation. Both of these operations fall under the StorageWrite category, meaning SMB deletions do not appear in StorageDelete.

2. Missing StorageDelete Logs (Backend Telemetry) Since you are operating via the REST API and have already confirmed that StorageRead and StorageWrite logs are generating correctly, the absence of StorageDelete logs strongly indicates a backend telemetry emission issue. This is very similar to the blob deletion behavior you linked to. If the platform backend is failing to emit the StorageDelete category specifically for file shares in your Storage Account's region, no amount of diagnostic reconfiguration on your end will fix it.

3. Soft Delete Clarification As an additional note regarding your setup: Azure Files soft delete operates specifically at the file share level to protect the entire share from accidental deletion. It does not apply to individual files within the share. When an individual file is deleted from the file share, it is permanently removed immediately.

Action Plan

To resolve the missing StorageDelete logs, you will need to open an Azure Support ticket. The Azure Storage engineering team will need to investigate the backend logging pipelines for your specific region and storage account.

When creating the ticket, please include:

Your Storage Account name and Subscription ID.
The exact timestamps of your test deletes.
Confirmation that StorageWrite logs successfully emit to the workspace, but StorageDelete fails to create logs or containers entirely.

Official References

Please 'Upvote' (Thumbs-up) and 'Accept' as answer if the response was helpful. This will help other community members find help with similar issues.

Best regards,

Andrew S Taylor

Answer 2

kagiyama yutaka 3,510

I think the delete for Azure Files goes to StorageFileLogs / StorageDelete, and when it still does not show there with file → StorageDelete on, you talk to support.

0 comments

Share via

Azure Classic file shares (Storage Account) not showing logs for Delete

2 answers

Action Plan

Official References

Your answer