Azure Storage Diagnostic Settings logs to Event Hub - Expected latency

Question

Azure Storage Diagnostic Settings logs to Event Hub - Expected latency

TazM-0771 0

Hi everyone,

I'm using Diagnostic Settings on an Azure Storage Account to send storage resource logs to an Azure Event Hub. I'm monitoring events related to Azure File Share creation.

The setup works correctly and events are delivered to Event Hub, but I noticed events usually appear in Event Hub with a delay over 1 minute.

I've searched through the Microsoft documentation but I I haven't been able to find any resource that specific the expected latency, so I have a questions: Is the delay of above 1 minute considered normal for Storage resources? Is there any way to reduce the latency or this is entirely managed by Azure.

I'd appreciate any documentation or insights based on your experience. Thanks!

Vinodh247-1375 43,916 Reputation points Volunteer Moderator

2026-07-29T04:31:07.0666667+00:00
Please confirm if you had a chance to try any of the suggestions provided for your question.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful.

If in case you have any resolution please share the same here with the community as it can be helpful to others. Else, please respond with more details and we will try to see if we can help further.

2 answers

Your answer

Vinodh247-1375 43,916 Reputation points Volunteer Moderator

2026-07-29T04:31:07.0666667+00:00

Please confirm if you had a chance to try any of the suggestions provided for your question.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful.

If in case you have any resolution please share the same here with the community as it can be helpful to others. Else, please respond with more details and we will try to see if we can help further.

Answer 1

Hi, a delay of a minute or a few minutes is normal for Azure Monitor resource logs because diagnostic settings use a buffered delivery pipeline; they are not a real-time event contract and there is no setting to tune that batch interval. First decide whether you are detecting a control-plane share operation or a supported storage data/event operation. For near-real-time automation, Event Grid is usually the better fit where that event type is available; for an ARM control-plane change, Activity Log/Event Grid may be more appropriate than storage resource logs. Keep the diagnostic stream for audit/analytics, and measure end-to-end latency using the event timestamp rather than the Event Hub receive time.

Answer 2

Hi ,

Thanks for reaching out to Microsoft Q&A.

Yes, a delay of ~1 minute (and sometimes a few mins) is normal and expected when using azure storage Diagnostic Settings to stream logs to Event Hub. These logs are not emitted in real time; they are batched and processed through Azure Monitor’s pipeline, which introduces ingestion and delivery latency. Microsoft does not guarantee sub-minute latency for resource logs, typical ranges are 30 secs to a few minutes, depending on load, region, and internal buffering. This behaviour is fully managed by Azure and cannot be tuned or reduced at the Diagnostic Settings level. If you need near real-time detection, you would need to look at alternatives like event Grid (for supported storage events) or direct application level event publishing instead of relying on diagnostic logs.

Are you specifically tracking control plane events (like share creation via ARM) or data-plane operations? Also, what is your downstream requirement do you need sub-30s latency for alerting, or is near-real-time (1 to 3 mins) acceptable?

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

TazM-0771 0 Reputation points

2026-07-13T19:45:23.8133333+00:00

Thanks for the explanation. That aligns with what I observe in my environment.

For my scenario, I'm monitoring blob creation and file share creation events using storage diagnostics settings streamed to Event Hub. My goal is to receive notification in under 30 seconds or as close to real-time as possible.

Could you share any official Microsoft documentation on expected latency? Also, are you aware of any alternative approach that would achieve sub 30 seconds notification creation events? thank you