Log analytics workspace reports 10 warnings

Rob Underwood 25

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: Invalid property identifier character: . Path 'records[].properties', line 1, position *. (10)

AnuragSingh-MSFT 21,376 Reputation points

2024-06-20T04:13:48.48+00:00
@Rob Underwood, thank you for posting this question on Microsoft Q&A.

Could you please answer the queries below to help us understand this issue better:

Where do you see this error? Could you share a screenshot masking the confidential information (subscription id, username/email id etc.)

When do you see this error? Is it while performing a specific task?

Is this something that has started occurring recently?
Rob Underwood 25 Reputation points

2024-06-20T13:36:39.2766667+00:00

This seemed to start on June 4th.
AnuragSingh-MSFT 21,376 Reputation points

2024-06-26T09:34:16.36+00:00
@Rob Underwood, Apologies for the delayed response.

Are you still facing this issue or was it only for a small duration when you were facing this issue?

I checked the workbook, and it uses the query below to get these errors.

_LogOperation | where Level in ("Error", "Warning") | summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Computer, Category, Operation, Details=Detail | project TimeGenerated, Level, Category=strcat(Category, " (", Operation, ")"), Computer=iff(Resource == "", Computer, strcat(Computer, " (", Resource, ")")), FullText=Details | reduce kind=source by FullText with threshold=0.5

If you are still seeing the errors being reported, can you please run the following query to get an understanding of the resource which is causing this issue?

_LogOperation| where Level in ("Error", "Warning")| summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Compu

As the table for which the error is being reported is AzureDiagnostics table, the values are being sent by another resource which is causing this error. The respective resource will have to be investigated to understand the cause.

Please let us know if you have any questions.
AnuragSingh-MSFT 21,376 Reputation points

2024-07-02T08:32:26.7466667+00:00

@Rob Underwood, Following-up to check if you had a chance to review the answer provided. If the answer did not help, please add more context/follow-up question for it.
rg54 5 Reputation points

2024-07-16T13:32:43.1033333+00:00
Hello @AnuragSingh-MSFT

If it can help : the same problem as @Rob Underwood started to occur recently in our context (same table, but with another independent tenant/subscription).

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[].properties[0]', line 1, position *. (5)

This table AzureDiagnostics is only fed by diagnostic settings from native Azure services here, there no custom feeding of this table in our environment. So it is probably a bug on Microsoft side, about logs format sent via diagnostic settings

When I run the query you've sent (after completing the last truncated work to "Computer"), here is the result :

Level,Resource,Computer,"TimeGenerated [UTC]",Category,Operation,Detail,CorrelationId Warning,,,"7/12/2024, 10:23:30.271 PM",Ingestion,"JSON Format","Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 75. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[75].properties[0]', line 1, position 144459.",
Frawley, Kevin 0 Reputation points

2024-07-24T14:08:51.9766667+00:00

Running into the same issue here. As @rg54 suggested "AzureDiagnostics" type is only really sent by Diagnostic Settings. We have a combination of built-in and custom policies. I am wondering if something changed in a built-in policy that is causing this issue. My first occurrence of the issue is 6/5/2024, but not sure if the logs are saved beyond that date anyway. Starting 6/5 we were only seeing 1 a day until mid July. Not sure if this is an issue with one of our own policies, or if it could be with a built-in policy from MS.

When I run the query posted by @AnuragSingh-MSFT I do not get a Resource. So, not sure how else to track down where the issue is coming from.
Miguel Coelho 0 Reputation points

2024-08-01T09:42:25.32+00:00

Hi everyone, is there any news about this issue? I'm having the same issue. And running the LogOperation query to detect the error i have the same results:

Level

Warning

TimeGenerated [UTC]

2024-07-31T14:03:57.347Z

Category

Ingestion

Operation

JSON Format

Detail

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 99. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[99].properties[0]', line 1, position 181910
Frawley, Kevin 0 Reputation points

2024-09-04T11:10:52.53+00:00

@AnuragSingh-MSFT are you able to comment any further on our inquries?

thanks!

1 answer

Kyle L 0 Reputation points

2024-09-04T01:58:59.1266667+00:00

Same issue here would be good to get an update from Microsoft.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Log analytics workspace reports 10 warnings

1 answer

Your answer