# AKS Cluster Monitoring Not Enabled

> Container Insights left disabled on an AKS cluster means node health, pod performance, and container logs are invisible during incidents. ZopNight's rule RC-1352 reads the omsagent addon state the discoverer stamps as logging_enabled and fires only on an explicit "false", abstaining whenever the flag is missing.

Source: https://zop.dev/integrations/azure/recommendations/aks-cluster-monitoring-not-enabled
Updated: 2026-08-19

---

## A cluster you cannot see into

An AKS cluster without Container Insights reports almost nothing about itself. Node memory
pressure, pod restarts, evictions, and container stdout all happen unobserved; the first sign
of a capacity problem is usually an application error, and by then the pod that caused it may
already be gone along with its logs. Kubernetes' own `kubectl top` and event stream cover the
last few minutes at best. The addon is what gives the cluster a history.

## The omsagent flag behind the finding

The Azure discoverer reads each cluster's addon profile through Azure Resource Graph (a
read covered by the built-in Reader role) and derives `logging_enabled` from whether the
Container Insights agent (`addonProfiles.omsagent.enabled`) is on. Rule RC-1352 fires only on
an explicit `"false"`. A previous incarnation read a `monitoring` tag that no producer ever
emitted, so it was dead on real data; the rewritten rule takes provider evidence only and
abstains whenever the addon state was not surfaced.

## List clusters missing Container Insights

```bash
az aks list \
  --query "[].{name:name, rg:resourceGroup, insights: addonProfiles.omsagent.enabled}" \
  -o table
```

Rows showing a null or false `insights` column are the clusters this rule will flag.

## The cost side of turning it on

Enabling the addon is one command, but ingestion is not free: Container Insights writes to a
Log Analytics workspace, billed per GB, and a chatty cluster can produce a surprising volume.
Cost controls exist for that: collection intervals, namespace filtering, and basic-tier
tables. The practical move is to enable it with a scoped configuration rather than leaving it off
entirely. A medium-severity visibility gap is cheaper to close than to explain after an
outage.

## Where this rule ends and RC-1355 begins

Container Insights covers what runs on the nodes. Control-plane logs (the API server and
audit trail) travel through a separate diagnostic-settings resource, checked independently
by rule RC-1355. Enabling one does not satisfy the other; a fully observable cluster needs
both, and the two findings can legitimately appear together on the same cluster.