bicep icon indicating copy to clipboard operation
bicep copied to clipboard

Location issue with creating data collection rule via bicep prevents log analytics workspace association

Open marshalexander99 opened this issue 2 years ago • 6 comments

Bicep version 0.13.1

Describe the bug When attempting to deploy a data collection rule via bicep, the rule doesn't get associated correctly with a log analytics workspace. Deploying via the portal the location 'uksouth' is used vs 'UK South' which comes via the bicep code and works fine with the rest of our landing zone deployment. I can only assume the space in UK South is the issue here and why the association fails.

To Reproduce Run the following bicep code and the log analytics workspace is not correctly associated with the data collection rule, providing that the location is 'UK South' (I'm assuming it doesn't like the space). To get it to work correctly, use 'uksouth'.

param location string = 'UK South'
param laname string = 'LA Workspace'

resource laworkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' existing = {
  name: laname
}

resource dcrrules 'Microsoft.Insights/dataCollectionRules@2021-04-01' = {
  name: 'Production'
  location: location
  kind: 'Windows'
  properties: {
    destinations: {
      logAnalytics: [
        {
          name: laname
          workspaceResourceId: laworkspace.id
        }
      ]
    }
    dataSources: {
      performanceCounters: [
        {
          streams: [
            'Microsoft-Perf'
          ]
          samplingFrequencyInSeconds:10
          counterSpecifiers: [
            '\\Processor Information(_Total)\\% Processor Time'
            '\\Processor Information(_Total)\\% Privileged Time'
            '\\Processor Information(_Total)\\% User Time'
            '\\Processor Information(_Total)\\Processor Frequency'
            '\\System\\Processes'
            '\\Process(_Total)\\Thread Count'
            '\\Process(_Total)\\Handle Count'
            '\\System\\System Up Time'
            '\\System\\Context Switches/sec'
            '\\System\\Processor Queue Length'
            '\\Memory\\% Committed Bytes In Use'
            '\\Memory\\Available Bytes'
            '\\Memory\\Committed Bytes'
            '\\Memory\\Cache Bytes'
            '\\Memory\\Pool Paged Bytes'
            '\\Memory\\Pool Nonpaged Bytes'
            '\\Memory\\Pages/sec'
            '\\Memory\\Page Faults/sec'
            '\\Process(_Total)\\Working Set'
            '\\Process(_Total)\\Working Set - Private'
            '\\LogicalDisk(_Total)\\% Disk Time'
            '\\LogicalDisk(_Total)\\% Disk Read Time'
            '\\LogicalDisk(_Total)\\% Disk Write Time'
            '\\LogicalDisk(_Total)\\% Idle Time'
            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
            '\\LogicalDisk(_Total)\\Disk Reads/sec'
            '\\LogicalDisk(_Total)\\Disk Writes/sec'
            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
            '\\LogicalDisk(_Total)\\% Free Space'
            '\\LogicalDisk(_Total)\\Free Megabytes'
            '\\Network Interface(*)\\Bytes Total/sec'
            '\\Network Interface(*)\\Bytes Sent/sec'
            '\\Network Interface(*)\\Bytes Received/sec'
            '\\Network Interface(*)\\Packets/sec'
            '\\Network Interface(*)\\Packets Sent/sec'
            '\\Network Interface(*)\\Packets Received/sec'
            '\\Network Interface(*)\\Packets Outbound Errors'
            '\\Network Interface(*)\\Packets Received Errors'
          ]
          name:'PerfCounterDataSource'
        }
      ]
      windowsEventLogs: [
        {
          streams: [
            'Microsoft-Event'
          ]
          xPathQueries: [
            'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
            'Security!*[System[(band(Keywords,13510798882111488))]]'
            'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
          ]
          name: 'EventLogsDataSource'
        }
      ]
    }
    dataFlows: [
      {
        streams: [
          'Microsoft-Perf'
          'Microsoft-Event'
        ]
        destinations: [
          laname
        ]
      }
    ]
  }
}

Additional context Add any other context about the problem here.

marshalexander99 avatar Jan 17 '23 17:01 marshalexander99

Can you provide the entire error message you are receiving and the correlationId of the deployment?

stephaniezyen avatar Jan 20 '23 21:01 stephaniezyen

No error messages are provided. The deployment completes without issue and no other data is produced. The rule simply fails to collect any data until changed to a location without a space in the code.

marshalexander99 avatar Jan 20 '23 21:01 marshalexander99

If the resource is being created successfully but not working correctly, that is an issue with the Microsoft.Insights/dataCollectionRules resource provider and not with Bicep. I would recommend opening a support ticket for this issue.

I will also reach out to the RP directly.

stephaniezyen avatar Jan 20 '23 21:01 stephaniezyen

Have you recreated the issue? As this works via the portal and not via bicep I feel logging a support ticket will end up with me back here without a proper pointer

marshalexander99 avatar Jan 20 '23 21:01 marshalexander99

I have recreated the issue, however since we pass the entire request directly to the RP, and it is deploying correctly from our end but not running correctly, it something the resource provider needs to fix.

If the support ticket is being incorrectly routed to our team, we will work with the support team to fix it.

stephaniezyen avatar Jan 20 '23 22:01 stephaniezyen

Is there any update on this Issue? I have the same Issue in my LAB. I have create an article about it: https://medium.com/p/82d393aeac14
image

psinnathurai avatar May 13 '24 07:05 psinnathurai