Azure / oms-log-analytics-firehose-nozzle

Microsoft Azure Log Analytics Nozzle
Apache License 2.0
11 stars 14 forks source link

How to confirm if there's no problem on Nozzle in case of log message lost #34

Open YutaroMatsuyama opened 3 years ago

YutaroMatsuyama commented 3 years ago

I'm facing an issue that some of log messages generated by "cf push"-ed application might be lost when I try to confirm them from Azure OMS by using KUSTO query.

Here's a detail regarding my facing issue: 1, An application, hereafter calling it as A, generates some logs and these are forwarded to OMS via Nozzle. 2, I assume that all generated logs from A are preserved at least when they pass through Nozzle, as I confirmed them with "cf app-nozzle A" plugin. 3, However, when I try to find them through Azure OMS with KUSTO query, some of them are lost. (=wasn't displayed as the result of query.)

As of now, what I've done is: 1, Ask Microsoft to investigate it from OMS side, and I shared syslog of VMs which Nozzle is deployed on because of their request, the results of "cf app-nozzle A" and that of "cf logs A". They can't specify the root cause so far. 2, They recommended me to raise a case here in GitHub, and I'm just issuing now.

My questions are as follows: 1, I expect that I can affirm there's no problem in or inside Nozzle as all logs are preserved when they're passing through Nozzle. However, I should confirm if there's other way to confirm there's no problem as well. Do you have any log that would help my investigation? 2, Do you have any idea which logs I should check regarding this case?

Thank you in advance.