Sign-in Logs no longer being sent to Eventhub

Gord Taylor 0

I've been using Elastic Cloud to retrieve Sign-in logs from AzureAD since December/2023 without any issues. Suddently on Aug 15th, I stopped receiving events (though I am getting other event types of logs suck as provisioning). I also see a commensurate drop in events going into the eventhub, so I'm confident it's not an Elastic issue.

No changes have been make, and I've also confirmed the eventhub connections string is correct (as I mentioned, I am seeing other logs to that eventhub), and I tried disabling/enabling the delivery to eventhub in case there was something corrupted on the back-end, but the logs still aren't getting to eventhub. Also, no outages or degredation in the Canadian Central.

Anyone else seeing similar issue? I'm not sure what else to troubleshoot.

Thanks,

Gord T.

PRADEEPCHEEKATLA 90,241 Reputation points

2024-08-22T13:35:28.31+00:00

@Gord Taylor - Thanks for the question and using MS Q&A platform.

Based on the information you provided, it seems like you are not receiving Sign-in logs from AzureAD to your Event Hub.

Have you checked if there are any changes made to your Azure AD configuration? It is possible that there might be changes made to your Azure AD configuration that could have caused the issue.

Also, have you tried upgrading to the latest version of the SDK? Upgrading to the latest version of the SDK may help with troubleshooting the issue.

If the issue persists, you may want to check the network security settings such as service endpoints, private endpoints, etc. to ensure that they are properly configured. You can also try obtaining network traces to help with troubleshooting the issue.

I hope this helps! Let me know if you have any other questions.
PRADEEPCHEEKATLA 90,241 Reputation points

2024-08-27T11:08:20.9433333+00:00

@Gord Taylor - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Gord Taylor 0 Reputation points

2024-08-27T16:40:30.84+00:00

Sorry for the delay - my manager was out, so I couldn't get PIM access to properly troubleshoot this issue.

I did check for any changes to AzureAD configuration and there was nothing that I could see (beyond the usual user/group management).

In case there was something broken on the back-end, I deleted the diagnostic settings in Azure Portal, then recreated it (selected all log types). I'm still not seeing SignInLogs - other log types from the diag (like AuditLogs, Provisioning Logs, etc.) flowing fine. You can even see the sudden drop in log events on Aug 15th:

We do have Premium P2 (Entra ID P2), so are licensed for pulling these logs:

This is not an SDK or network setting issue since the logs are being delivered into eventhub from the diag settings (no code involved - everything is menu-based on the Azure Portal/MS interface).

I also have a dozen other Azure instances that are still getting Sign-in logs correctly. Just this one tenant suddenly stopped working and I can't seem to get it going again.
PRADEEPCHEEKATLA 90,241 Reputation points

2024-08-28T11:07:41.56+00:00

@Gord Taylor - Thanks for the additional details.

I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us?
PRADEEPCHEEKATLA 90,241 Reputation points

2024-08-30T12:07:31.57+00:00

@Gord Taylor - Did you get a chance to open a support ticket?

Share via

Sign-in Logs no longer being sent to Eventhub

Your answer