Log analytics workspace reports 10 warnings
Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: Invalid property identifier character: . Path 'records[].properties', line 1, position *. (10)
Azure Monitor
-
AnuragSingh-MSFT 21,246 Reputation points
2024-06-20T04:13:48.48+00:00 @Rob Underwood, thank you for posting this question on Microsoft Q&A.
Could you please answer the queries below to help us understand this issue better:
- Where do you see this error? Could you share a screenshot masking the confidential information (subscription id, username/email id etc.)
- When do you see this error? Is it while performing a specific task?
- Is this something that has started occurring recently?
-
Rob Underwood 5 Reputation points
2024-06-20T13:36:39.2766667+00:00 This seemed to start on June 4th.
-
AnuragSingh-MSFT 21,246 Reputation points
2024-06-26T09:34:16.36+00:00 @Rob Underwood, Apologies for the delayed response.
Are you still facing this issue or was it only for a small duration when you were facing this issue?
I checked the workbook, and it uses the query below to get these errors.
_LogOperation | where Level in ("Error", "Warning") | summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Computer, Category, Operation, Details=Detail | project TimeGenerated, Level, Category=strcat(Category, " (", Operation, ")"), Computer=iff(Resource == "", Computer, strcat(Computer, " (", Resource, ")")), FullText=Details | reduce kind=source by FullText with threshold=0.5
If you are still seeing the errors being reported, can you please run the following query to get an understanding of the resource which is causing this issue?
_LogOperation| where Level in ("Error", "Warning")| summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Compu
As the table for which the error is being reported is AzureDiagnostics table, the values are being sent by another resource which is causing this error. The respective resource will have to be investigated to understand the cause.
Please let us know if you have any questions.
-
AnuragSingh-MSFT 21,246 Reputation points
2024-07-02T08:32:26.7466667+00:00 @Rob Underwood, Following-up to check if you had a chance to review the answer provided. If the answer did not help, please add more context/follow-up question for it.
-
rg54 5 Reputation points
2024-07-16T13:32:43.1033333+00:00 Hello @AnuragSingh-MSFT
If it can help : the same problem as @Rob Underwood started to occur recently in our context (same table, but with another independent tenant/subscription).
Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[].properties[0]', line 1, position *. (5)
This table AzureDiagnostics is only fed by diagnostic settings from native Azure services here, there no custom feeding of this table in our environment. So it is probably a bug on Microsoft side, about logs format sent via diagnostic settings
When I run the query you've sent (after completing the last truncated work to "Computer"), here is the result :
Level,Resource,Computer,"TimeGenerated [UTC]",Category,Operation,Detail,CorrelationId Warning,,,"7/12/2024, 10:23:30.271 PM",Ingestion,"JSON Format","Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 75. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[75].properties[0]', line 1, position 144459.",
-
Frawley, Kevin 0 Reputation points
2024-07-24T14:08:51.9766667+00:00 Running into the same issue here. As @rg54 suggested "AzureDiagnostics" type is only really sent by Diagnostic Settings. We have a combination of built-in and custom policies. I am wondering if something changed in a built-in policy that is causing this issue. My first occurrence of the issue is 6/5/2024, but not sure if the logs are saved beyond that date anyway. Starting 6/5 we were only seeing 1 a day until mid July. Not sure if this is an issue with one of our own policies, or if it could be with a built-in policy from MS.
When I run the query posted by @AnuragSingh-MSFT I do not get a Resource. So, not sure how else to track down where the issue is coming from.
Sign in to comment