# AKS Cluster Diagnostic Logging Not Enabled > Rule RC-1355 fires when an AKS cluster has no diagnostic setting shipping control-plane logs: kube-apiserver, kube-audit, kube-audit-admin, or kube-controller-manager. ZopNight resolves this with a secondary Resource Graph lookup over microsoft.insights/diagnosticsettings; only an explicit diagnostic_logging_enabled of "false" fires, and an absent flag abstains. Source: https://zop.dev/integrations/azure/recommendations/aks-cluster-diagnostic-logging-not-enabled Updated: 2026-08-19 --- ## Control-plane logs nobody is collecting In AKS, Microsoft operates the control plane, so kube-apiserver, kube-audit and kube-controller-manager output exists only while a diagnostic setting exports it. There is no node to SSH into afterwards. Without one, the cluster keeps no record of which identity read a secret, deleted a namespace, or created a privileged pod. During an incident that gap is unrecoverable: the logs were never written anywhere, so no amount of forensics gets them back. ## Two signals, two rules AKS has two separate observability surfaces that are easy to conflate. Container Insights is the omsagent addon collecting node and workload telemetry, which is rule RC-1352's subject. Diagnostic settings are a distinct ARM resource under `microsoft.insights/diagnosticsettings` that exports the control-plane log categories. A cluster can have either without the other, which is why RC-1355 is keyed to its own signal rather than reusing the addon flag. ## How ZopNight proves the gap Azure Resource Graph does not surface diagnostic settings on the cluster row itself, so the discoverer runs a secondary lookup over `microsoft.insights/diagnosticsettings` scoped to managed clusters, checking for at least one enabled control-plane category (kube-apiserver, kube-audit, kube-audit-admin, or kube-controller-manager) and stamps `diagnostic_logging_enabled` accordingly. The read is covered by the built-in Reader role. The rule fires only on an explicit `"false"`; when the lookup produced nothing, it abstains rather than firing on missing data, and the legacy customer-editable tag is ignored entirely. ## Turning on kube-audit without drowning in it The full kube-audit category logs every request, including reads, and on a busy cluster the Log Analytics bill will show it. The kube-audit-admin category records only write operations, which is the usual compromise for compliance evidence at tolerable cost. Send either to a Log Analytics workspace when you need to query, or to a storage account when you only need retention. ## Verify diagnostic settings from the CLI ```bash az monitor diagnostic-settings list \ --resource $(az aks show -n -g --query id -o tsv) \ --query "[].{name:name, enabled:logs[?enabled].category}" -o table ``` Empty output, or settings whose enabled categories include none of the four control-plane logs, is the state this finding describes.