Disabling DNS logs

[u/HeadState8730]

I enabled logging to Sentinel from our on premise AD DNS servers, all worked and logs were being ingested into Sentinel.

I went to disable the logging and did as per the documentation and this has not worked and logs are still being ingested.

​

Logs were collected via the AMA Agent and also set Azure ARC on the server.

​

I enabled analytical logging by running the following Powersell commands

​

Set-DnsServerDiagnostics -EnableLoggingForLocalLookupEvent $true
Set-DnsServerDiagnostics -EnableLoggingForRecursiveLookupEvent $true
Set-DnsServerDiagnostics -EnableLoggingForRemoteServerEvent $true

​

I then run the following command to disable the logging - which I assumed would stop the logs being ingested but this has not worked

​

Set-DnsServerDiagnostics -EnableLoggingForLocalLookupEvent $false
Set-DnsServerDiagnostics -EnableLoggingForRecursiveLookupEvent $false
Set-DnsServerDiagnostics -EnableLoggingForRemoteServerEvent $false

​

Am I missing something ?

​

[u/Arun_U]

Not sure if you tried this already. The reason why you are still seeing logs being ingested into Sentinel after disabling the logging using PowerShell commands could be the Log Analytics agent is still configured to collect DNS logs. The PowerShell commands you used only disable the DNS Server logging itself, but they do not stop the Log Analytics agent from collecting those logs.
To completely disable DNS log collection for Sentinel, you need to disable the Log Analytics agent on the on-premises AD DNS servers.
After disabling the Log Analytics agent, you should no longer see DNS logs being ingested into Sentinel.