Events with DeviceTelemetry type are no longer sent to EventHub when unauthorized access to IoT Hub is attempted

Piotr Machowski 0

Events with DeviceTelemetry type are no longer sent to EventHub when an unauthorized access to IoT Hub is attempted (with invalid authorization).

This functionality used to work, but at this moment events are no longer visible via servicebus connection nor Stream Analytics

1 answer

Sander van de Velde | MVP 33,146 Reputation points MVP

2024-07-09T16:54:06.06+00:00

Hello @Piotr Machowski,

welcome to this moderated Azure community forum.

Did you by chance create a custom route and endpoint in your IoT Hub?

If so, this probably change the default behavior of the normal (eventhub-compatible) route towards eg. Stream Analytics.

The normal route suddenly acts like a fallback, only passing on message not caught by any other route.

To fix this, just add a route pointing to the 'events' endpoint:

This is marked as a 'built-in' endpoint:

Does this solve your problem?

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.
Please sign in to rate this answer.
Piotr Machowski 0 Reputation points

2024-07-10T14:05:36.4366667+00:00

Hi @Sander van de Velde | MVP ,

thank you for your fast response!

No, I do not use any custom route/endpoint. It is also worth to mention that fallback route is enabled and I still receive other events from IoT Hub in Event Hub, so communication itself works correctly.

Sander van de Velde | MVP 33,146 Reputation points MVP

2024-07-10T18:03:23.2166667+00:00

Ok, lets try to find out where the flow is broken.

The telemetry flow you have is?

iot-hub (via the normal (eventhub compatible) endpoint) -> stream analytics -> event hub

Where should I put servicebus in this flow?

There is not a single custom route created?

Do you use $default as consumer group for the iothub input? If so, please use a new consumer group (like asa) so you know for sure your stream analytics job gets its own copy of each incoming telemetry message.

Can you test the iot hub input (there is a test option in the azure portal).

Piotr Machowski 0 Reputation points

2024-07-11T13:40:36.9133333+00:00

My config looks the following way:

IoT Hub --[configured in Diagnostic Settings]--> Event Hub --[Process data: Real time insights]--> Stream Analytics (preview_data_consumer_group consumer group) --[sb://servicebus.windows.net endpoint]--> My application ($Default consumer group)

There is not a single custom route created?

There are no custom routes/custom endpoints configured in IoT Hub, fallback route is active.

Do you use $default as consumer group for the iothub input? If so, please use a new consumer group (like asa) so you know for sure your stream analytics job gets its own copy of each incoming telemetry message.

I use Real time insights on Azure Portal, it uses preview_data_consumer_group consumer group. My application doesn't specify a consumer group, so I suppose it uses $Default.

Can you test the iot hub input (there is a test option in the azure portal).

I haven't found this option in the portal, could you please specify where to find it? Other types of events (e.g. device statistics) are visible in both Real time insights and my application, so I assume that communication is set up correctly.

Sander van de Velde | MVP 33,146 Reputation points MVP

2024-07-11T21:37:03.49+00:00

Hello

Let's focus on the iot hub vs stream analytics connection.

You see you send device telemetry messages via

IoT Hub --[configured in Diagnostic Settings]--> Event Hub

You mean this one?

This is highly unusual!

This is normally used for diagnosing Azure resources.

If you want to connect an IoT hub to an stream analytics job:

Make use of the iot hub input in stream analytics, connecting to the default event endpoint (which turns into a fallback scenario when a route is added but you can specify it as a separate route)

Make use of an eventhub in between using a custom eventhub endpoint and related route in the iot hub and an eventhub input in stream analytics

Do not mix these two scenarios, just use on of the two scenarios just described.

Regarding the connection test, check the green checkmarks / buttons seen in the stream analytics job input page:

Once the data flow into your stream analytics job, you can work out the next step in the flow.

Piotr Machowski 0 Reputation points

2024-07-12T00:01:19.5533333+00:00

I'm sorry, I'm not an expert in this field and I think I have described my setup in a bit unprecise manner. Please let me describe my problem again:

My main goal is to receive events about unauthorized access attempts to IoT Hub devices in my application (IoT Hub is set to be accessible over public network). This was previously achieved by sending events to Event Hub (via Diagnostics Settings) and then subscribing to them using sb://myeventhub.servicebus.windows.net/... endpoint.

At some point these events stopped working, so I wanted to check if they are still sent correctly from IoT Hub to Event Hub, so I have used "Real time insights" functionality of Event Hub from "Process data" tab to take a peek at arriving events - it is not full Stream Analytics setup, just a web-based preview Stream Analytics Query Language.

At this moment this preview shows all the messages that I receive in my application, so I know that this the connection works properly. The missing part are events about unsuccessful authentication (category: DeviceTelemetry, level: Error).

Sander van de Velde | MVP 33,146 Reputation points MVP

2024-07-12T07:07:24.9466667+00:00

Ah, I see. Sorry, I was focused on that flow.

I'm not sure why these attempts are not visible.

The public endpoint can be protected with whitelisted IP ranges. Could that have an effect?

Otherwise, you need to create a support ticket so the Azure support team can check in the background.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Events with DeviceTelemetry type are no longer sent to EventHub when unauthorized access to IoT Hub is attempted

1 answer

Your answer