Azure-Sentinel
Azure-Sentinel copied to clipboard
Azure
Data connector Oracle cloud infrastructure failed with error "the cursor is outside the retention period and is now invalid"
We have deployed Oracle cloud infrastructure data connector from Microsoft Sentinel content gallery. As process provided instructions to provision Azure function app and configure the data connector. As of first run the data ingested fine, but after few days below error start coming
I have deleted and re-deployed the same connector but error persists.
Oracle support reply as below: As we have checked on our side, we're not getting any heartbeat from the customer's side stream/tenancy.
Also, the request frequency is very less because of which the cursor is getting out of retention. For this, we suggest to add handling in your code to recreate the cursor if expired.
The customer can add in the code to create the cursor again for handling this issue. As in, once they start the consumer they can create the cursor and call the same code again if cursor expires.
Hi @sandeep5234, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 11-03-2024 . Thanks!
Hi @sandeep5234 ,Still need some more time ,working on analysis ,will update you,meanwhile could you please share invocation logs from app insights with stack traces to [email protected]
Hi @sandeep5234 , Gentle reminder,could you please share invocation logs from app insights with stack traces to [email protected],working on cursor creation options through code
Hi @sandeep5234 ,Gentle reminder, could you please share invocation logs from app insights with stack traces to [email protected],working on cursor creation options through code,still need some time on further analysis.
@v-muuppugund sorry for the delay, I have sent the information on provided email. Please let me know.
@v-muuppugund sorry for the delay, I have sent the information on provided email. Please let me know.
@sandeep5234 ,Thanks for sharing the details over an email,will check and update you
@sandeep5234 ,as discussed today morning, we have tested package for this issue (https://github.com/Azure/Azure-Sentinel/issues/9203) but unable to proceed due to cursor issue and will merge the group and group instance name changes PR with these issue changes ,test and close it,just want to update.
@PCNZ FYI
@v-muuppugund sorry for the delay, I have sent the information on provided email. Please let me know.
@sandeep5234 ,Thanks for sharing the details over an email,will check and update you
Hi @sandeep5234 ,Analysed the logs and working on option for retaining cursor retention period in python,will update you
Hi @sandeep5234 ,I have done some code changes and working on local testing for the changes,Will share the package with you for detailed testing
Hi @sandeep5234 , Still need some time for local testing
Thank you @v-muuppugund
Hi @sandeep5234 ,Will update you over teams with package url this week for further testing if needed will have call again
Hi @sandeep5234 , Still need some time for local testing
Thank you @v-muuppugund
Hi @sandeep5234 ,Will update you over teams with package url this week for further testing if needed will have call again
Hi @sandeep5234 ,Still need some more time on this and share the package url over teams,will update you
Hi @sandeep5234 , I have added changes in same package, As shared the steps over teams last call,Could you please test this package (https://github.com/Azure/Azure-Sentinel/raw/users/v-muppugundu/OCIDocumentationupdates/Solutions/Oracle%20Cloud%20Infrastructure/Data%20Connectors/OCILogsConn.zip )and let me know if any issues
Hi @sandeep5234 ,Could you please test the package shared over teams and let me know if any issues.
Hi @sandeep5234 ,As discussed today over teams,could you please test and let me know if any issues
Hi @sandeep5234 ,Thanks for confirmation over teams ,the issue has been resolved,Please let me know if any issues.