microsoft / AzureNetworkWatcherNSGFlowLogsConnector

Ingest NSG flow logs and transmit to your log analytics system.
MIT License
38 stars 100 forks source link

Duplicate records in eventhub message #26

Open buchagj opened 3 years ago

buchagj commented 3 years ago

We are seeing 2 duplicate records per event hub message. Is this by design or is there an issue? This is our first time using this function app. Any assistance would be appreciated.

sample message in eventhub: { body: '{"records":[{"time":"2021-09-10T20:02:30.0094229Z","category":"NetworkSecurityGroupFlowEvent","operationName":"NetworkSecurityGroupFlowEvents","resourceId":"/SUBSCRIPTIONS/F9EA7F5D-324F-4C97-8B60-6734F9DC6F76/RESOURCEGROUPS/SIC-DEMO-DEV/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SICDEMO-NSG","version":2.0,"nsgRuleName":"DefaultRule_AllowVnetInBound","mac":"000D3A3CECED","startTime":"1631304101","sourceAddress":"172.16.0.9","destinationAddress":"172.16.0.11","sourcePort":"61914","destinationPort":"80","transportProtocol":"T","deviceDirection":"I","deviceAction":"A","flowState":"B"},{"time":"2021-09-10T20:02:30.0094229Z","category":"NetworkSecurityGroupFlowEvent","operationName":"NetworkSecurityGroupFlowEvents","resourceId":"/SUBSCRIPTIONS/F9EA7F5D-324F-4C97-8B60-6734F9DC6F76/RESOURCEGROUPS/SIC-DEMO-DEV/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SICDEMO-NSG","version":2.0,"nsgRuleName":"DefaultRule_AllowVnetInBound","mac":"000D3A3CECED","startTime":"1631304101","sourceAddress":"172.16.0.9","destinationAddress":"172.16.0.11","sourcePort":"61914","destinationPort":"80","transportProtocol":"T","deviceDirection":"I","deviceAction":"A","flowState":"B"}]}', properties: None, offset: 355480, sequence_number: 275, enqueued_time=datetime.datetime(2021, 9, 13, 16, 37, 12, 592000, tzinfo=datetime.timezone.utc) }