Azure / bicep

Bicep is a declarative language for describing and deploying Azure resources
MIT License
3.21k stars 746 forks source link

Location issue with creating data collection rule via bicep prevents log analytics workspace association #9566

Open marshalexander99 opened 1 year ago

marshalexander99 commented 1 year ago

Bicep version 0.13.1

Describe the bug When attempting to deploy a data collection rule via bicep, the rule doesn't get associated correctly with a log analytics workspace. Deploying via the portal the location 'uksouth' is used vs 'UK South' which comes via the bicep code and works fine with the rest of our landing zone deployment. I can only assume the space in UK South is the issue here and why the association fails.

To Reproduce Run the following bicep code and the log analytics workspace is not correctly associated with the data collection rule, providing that the location is 'UK South' (I'm assuming it doesn't like the space). To get it to work correctly, use 'uksouth'.

param location string = 'UK South'
param laname string = 'LA Workspace'

resource laworkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' existing = {
  name: laname
}

resource dcrrules 'Microsoft.Insights/dataCollectionRules@2021-04-01' = {
  name: 'Production'
  location: location
  kind: 'Windows'
  properties: {
    destinations: {
      logAnalytics: [
        {
          name: laname
          workspaceResourceId: laworkspace.id
        }
      ]
    }
    dataSources: {
      performanceCounters: [
        {
          streams: [
            'Microsoft-Perf'
          ]
          samplingFrequencyInSeconds:10
          counterSpecifiers: [
            '\\Processor Information(_Total)\\% Processor Time'
            '\\Processor Information(_Total)\\% Privileged Time'
            '\\Processor Information(_Total)\\% User Time'
            '\\Processor Information(_Total)\\Processor Frequency'
            '\\System\\Processes'
            '\\Process(_Total)\\Thread Count'
            '\\Process(_Total)\\Handle Count'
            '\\System\\System Up Time'
            '\\System\\Context Switches/sec'
            '\\System\\Processor Queue Length'
            '\\Memory\\% Committed Bytes In Use'
            '\\Memory\\Available Bytes'
            '\\Memory\\Committed Bytes'
            '\\Memory\\Cache Bytes'
            '\\Memory\\Pool Paged Bytes'
            '\\Memory\\Pool Nonpaged Bytes'
            '\\Memory\\Pages/sec'
            '\\Memory\\Page Faults/sec'
            '\\Process(_Total)\\Working Set'
            '\\Process(_Total)\\Working Set - Private'
            '\\LogicalDisk(_Total)\\% Disk Time'
            '\\LogicalDisk(_Total)\\% Disk Read Time'
            '\\LogicalDisk(_Total)\\% Disk Write Time'
            '\\LogicalDisk(_Total)\\% Idle Time'
            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
            '\\LogicalDisk(_Total)\\Disk Reads/sec'
            '\\LogicalDisk(_Total)\\Disk Writes/sec'
            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
            '\\LogicalDisk(_Total)\\% Free Space'
            '\\LogicalDisk(_Total)\\Free Megabytes'
            '\\Network Interface(*)\\Bytes Total/sec'
            '\\Network Interface(*)\\Bytes Sent/sec'
            '\\Network Interface(*)\\Bytes Received/sec'
            '\\Network Interface(*)\\Packets/sec'
            '\\Network Interface(*)\\Packets Sent/sec'
            '\\Network Interface(*)\\Packets Received/sec'
            '\\Network Interface(*)\\Packets Outbound Errors'
            '\\Network Interface(*)\\Packets Received Errors'
          ]
          name:'PerfCounterDataSource'
        }
      ]
      windowsEventLogs: [
        {
          streams: [
            'Microsoft-Event'
          ]
          xPathQueries: [
            'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
            'Security!*[System[(band(Keywords,13510798882111488))]]'
            'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
          ]
          name: 'EventLogsDataSource'
        }
      ]
    }
    dataFlows: [
      {
        streams: [
          'Microsoft-Perf'
          'Microsoft-Event'
        ]
        destinations: [
          laname
        ]
      }
    ]
  }
}

Additional context Add any other context about the problem here.

stephaniezyen commented 1 year ago

Can you provide the entire error message you are receiving and the correlationId of the deployment?

marshalexander99 commented 1 year ago

No error messages are provided. The deployment completes without issue and no other data is produced. The rule simply fails to collect any data until changed to a location without a space in the code.

stephaniezyen commented 1 year ago

If the resource is being created successfully but not working correctly, that is an issue with the Microsoft.Insights/dataCollectionRules resource provider and not with Bicep. I would recommend opening a support ticket for this issue.

I will also reach out to the RP directly.

marshalexander99 commented 1 year ago

Have you recreated the issue? As this works via the portal and not via bicep I feel logging a support ticket will end up with me back here without a proper pointer

stephaniezyen commented 1 year ago

I have recreated the issue, however since we pass the entire request directly to the RP, and it is deploying correctly from our end but not running correctly, it something the resource provider needs to fix.

If the support ticket is being incorrectly routed to our team, we will work with the support team to fix it.

psinnathurai commented 4 months ago

Is there any update on this Issue? I have the same Issue in my LAB. I have create an article about it: https://medium.com/p/82d393aeac14
image