Skip to main content
Sumo Logic

Troubleshoot Azure Blob Storage Log Collection

Follow these steps to learn why log data is not flowing into Sumo from Azure Blob Storage.

If logs don't start flowing into Sumo Logic after you perform the Collect Logs from Azure Blob Storage procedure, see the troubleshooting tips below.

Verify configurations

Make sure that the resources you created in the Collect Logs from Azure Blob Storage procedure were successfully created.

  1. Go to Resource groups, and select the resource group you created or selected in Step 3. Configure Azure resources using ARM Template of the "Collect Logs from Azure Blob Storage" page. You should see resources you created:
    • Two App Service plans. 
    • Three App Services.
    • A Service Bus Namespace.
    • An Event Hubs Namespace.
    • A Storage account.
  2. In the left pane of the Azure Portal, click AppServices, and search for “SUMOBRTaskConsumer”. You should find the “SUMOBRTaskConsumer<random-string>” Function App. Click it. 
  3. Click the Application settings link. Check that the value of the  SumoLogEndpoint field matches the HTTP source URL. 

Verify Block Blob Create Events are getting published

  1. Click All Services. Go to Event Grid Subscription services. 
  2. Select Storage Account and region from the drop down.
  3. Select the Event Subscription created in Step 3 from the list.
  4. Click Metrics.
  5. On the Event Grid Metrics page, check that the  Publish Succeeded and Delivery Succeeded counts are greater than zero.
    event-grid-metrics.png

Verify Event Hub is receiving log messages

To verify that events are appearing in your event hub:

  1. In the left pane of Azure Portal, Click Eventhub.
  2. Search for “SUMOBREventHubNamespace”. You should find the “SUMOBREventHubNamespace<random-string>” Event Hub Namespace. Click it. 
  3. Click the Messages link.
  4. Message summary information appears below the chart. Check that the Incoming Messages count is greater than zero.
    eventhub-messages-metrics.png

Verify Service Bus Queue is receiving tasks

Go to Service Bus Service from the Azure portal and click on SUMOBRTaskQueueNamespace<unique string> Service Bus Namespace. Check that the incoming messages count is greater than zero.
service-bus-metrics.png
 

Verify with LiveTail

In Sumo, open a Live Tail tab and run a search to verify Sumo is receiving events. Search by the source category you assigned to the HTTP Source that receives the log data, for example:

_sourceCategory="azure/ad"

For more information about using Live Tail, see Live Tail