Query set to run in my Logic App is timing out and failing

Matthew Agosta 0

Hello everyone. I am trouble shooting an issue with my Logic App in which after an incident triggers, the next step is to run the query and list the results, but this part of the Logic App is what is timing out and failing. When reading the timeout errors it says that after 2 minutes, the query times out and retries. It does this 4 times but always ends up failing. When I run the query manually in the Log Analytics space, it only takes about a minute to get the results the results are not terribly extensive, although I do get an notice saying "Your query is consuming excessive resources". The output results I'm getting is "RequestTimeout: Failed to get HTTP response. Timeout / Operation Canceled Exception"

Does anyone know how I can get this query to finish running successfully? Is there a way to give this query more time to finish before timing out? The query is one built by Microsoft for Log4j detection.

Any help would be greatly appreciated. Thanks!

forum help

Clive Watson 5,716 Reputation points MVP

2024-03-21T14:31:34.1+00:00

Have you tried to shorten the duration of the look back in the query

e.g.

ago(30d) --> ago(7d)

or only projecting the columns you need?

Without seeing the query its hard to troubleshoot
Matthew Agosta 0 Reputation points

2024-03-21T17:31:13.4366667+00:00

This forum wont let me post the query, i think it is too long. The query is one crafted by Microsoft called "Log4j vulnerability exploit aka Log4Shell IP IOC" I know that doesnt help you trouble shoot. Not sure why the forum wont let me post the entire thing here. but ultimately the query is looking at the current time and date.
Clive Watson 5,716 Reputation points MVP

2024-03-22T16:03:28.2266667+00:00

https://github.com/Azure/Azure-Sentinel/blob/a8e7b542f7bdaae09040757d46d55830fa81c31b/Solutions/Apache%20Log4j%20Vulnerability%20Detection/Analytic%20Rules/Log4J_IPIOC_Dec112021.yaml

Do you have lots of logs in CommonSecurityLog (its often this source, but for you you may have to try others), if so try and comment out this section
Matthew Agosta 0 Reputation points

2024-03-27T12:42:36.0133333+00:00

Hi Clive, I appreciate you getting back to me. We do have a lot of logs in the CommonSecurityLogs table. I tried removing this section of the query and I still go the same error. I also tried to remove everything beside this table and still got the same issue again. It seems like this query is just taking a lot of resources to complete. It seems odd to me that running this query in LogAnalytics only takes about a minute, but when it runs through the logic app is takes longer and times out
Clive Watson 5,716 Reputation points MVP

2024-04-03T09:26:54.22+00:00

My only other thought is the logs blade defaults to 24hrs, maybe the query in the Logic App is using more data (30d +), did you try adding a time filter to the query? e.g.

| where TimeGenerated > ago(1d)