Custom fields are not created when deploying the application about azure-sql-db-auditing-oms-integration HOT 8 CLOSED

Hi Samir,

did you allow the code to run and import audit data into your OMS workspace? I think the type will be defined after OMS will ingest the data. Let us know if this is not the case.

Thanks, Tomer (MSFT)

from azure-sql-db-auditing-oms-integration.

Hi,
I followed the 'readme' file. The steps are very simple. The Web App was deployed successfully. I noticed that the App Service Plan tier is 'free', not a basic plan as the 'readme' file shows.
The job run several times, no data has been imported to OMS
Thanks for your help

from azure-sql-db-auditing-oms-integration.

I will probably need to see you traces from the webapp to understand why no event was imported to OMS. You can send me the details to tomerw at Microsoft.

Thanks, Tomer (MSFT).

from azure-sql-db-auditing-oms-integration.

I had similar results and also received errors that other types were not known. I didn't recall all of them but I know that IP address was among them.

I realized that I probably didn't have much or any data in the logs at the time I did the setup - I had only created the server, not a database. I created a database and generated some audit data and could then create the dashboard but I'm not sure if everything is functioning as intended.

For example, the detail information on Database Authentication Failed doesn't show any data like I would expect (see graphic).

from azure-sql-db-auditing-oms-integration.

Nice solution, but ran into similar issues. Nothing is getting imported, below is what I see in the logs. The logs seem to be OK as I can open them in SSMS:
[04/19/2017 10:22:08 > 23bdfb: INFO] OMS Error: 0 : Failed processing: https://accountname.blob.core.windows.net/sqldbauditlogs/wus-te-sdb-pulse-01/wus-te-sdb-pulse01-db1/SqlDbAuditing_ServerAudit_NoRetention/2017-04-19/08_06_54_168_0.xel. Reason: System.FormatException: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters

from azure-sql-db-auditing-oms-integration.

from azure-sql-db-auditing-oms-integration.

Hi,

It looks like the OMS workspace key is incorrect or bad formatted which cause the operation to fail.
Please Retrieve the OMS workspace key (see: prerequisites under "Retrieve OMS Workspace ID and Access key") and update the app service application settings as shown in the folowing screen shot:

Thanks,
Gal

from azure-sql-db-auditing-oms-integration.

Gal,

Thanks for the feedback I re-installed and it worked.

Thanks.
Felix

from azure-sql-db-auditing-oms-integration.