Log analytics workspace reports 10 warnings

Question

Log analytics workspace reports 10 warnings

Rob Underwood 50

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: Invalid property identifier character: . Path 'records[].properties', line 1, position *. (10)

AnuragSingh-MSFT 21,566 Reputation points Moderator

2024-06-20T04:13:48.48+00:00
@Rob Underwood, thank you for posting this question on Microsoft Q&A.

Could you please answer the queries below to help us understand this issue better:

Where do you see this error? Could you share a screenshot masking the confidential information (subscription id, username/email id etc.)

When do you see this error? Is it while performing a specific task?

Is this something that has started occurring recently?
Rob Underwood 50 Reputation points

2024-06-20T13:36:39.2766667+00:00

This seemed to start on June 4th.
AnuragSingh-MSFT 21,566 Reputation points Moderator

2024-06-26T09:34:16.36+00:00
@Rob Underwood, Apologies for the delayed response.

Are you still facing this issue or was it only for a small duration when you were facing this issue?

I checked the workbook, and it uses the query below to get these errors.

_LogOperation | where Level in ("Error", "Warning") | summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Computer, Category, Operation, Details=Detail | project TimeGenerated, Level, Category=strcat(Category, " (", Operation, ")"), Computer=iff(Resource == "", Computer, strcat(Computer, " (", Resource, ")")), FullText=Details | reduce kind=source by FullText with threshold=0.5

If you are still seeing the errors being reported, can you please run the following query to get an understanding of the resource which is causing this issue?

_LogOperation| where Level in ("Error", "Warning")| summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Compu

As the table for which the error is being reported is AzureDiagnostics table, the values are being sent by another resource which is causing this error. The respective resource will have to be investigated to understand the cause.

Please let us know if you have any questions.
AnuragSingh-MSFT 21,566 Reputation points Moderator

2024-07-02T08:32:26.7466667+00:00

@Rob Underwood, Following-up to check if you had a chance to review the answer provided. If the answer did not help, please add more context/follow-up question for it.
Romain Girot 15 Reputation points

2024-07-16T13:32:43.1033333+00:00
Hello @AnuragSingh-MSFT

If it can help : the same problem as @Rob Underwood started to occur recently in our context (same table, but with another independent tenant/subscription).

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[].properties[0]', line 1, position *. (5)

This table AzureDiagnostics is only fed by diagnostic settings from native Azure services here, there no custom feeding of this table in our environment. So it is probably a bug on Microsoft side, about logs format sent via diagnostic settings

When I run the query you've sent (after completing the last truncated work to "Computer"), here is the result :

Level,Resource,Computer,"TimeGenerated [UTC]",Category,Operation,Detail,CorrelationId Warning,,,"7/12/2024, 10:23:30.271 PM",Ingestion,"JSON Format","Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 75. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[75].properties[0]', line 1, position 144459.",
Frawley, Kevin 0 Reputation points

2024-07-24T14:08:51.9766667+00:00

Running into the same issue here. As @Romain Girot suggested "AzureDiagnostics" type is only really sent by Diagnostic Settings. We have a combination of built-in and custom policies. I am wondering if something changed in a built-in policy that is causing this issue. My first occurrence of the issue is 6/5/2024, but not sure if the logs are saved beyond that date anyway. Starting 6/5 we were only seeing 1 a day until mid July. Not sure if this is an issue with one of our own policies, or if it could be with a built-in policy from MS.

When I run the query posted by @AnuragSingh-MSFT I do not get a Resource. So, not sure how else to track down where the issue is coming from.
Miguel Coelho 0 Reputation points

2024-08-01T09:42:25.32+00:00

Hi everyone, is there any news about this issue? I'm having the same issue. And running the LogOperation query to detect the error i have the same results:

Level

Warning

TimeGenerated [UTC]

2024-07-31T14:03:57.347Z

Category

Ingestion

Operation

JSON Format

Detail

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 99. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[99].properties[0]', line 1, position 181910
Frawley, Kevin 0 Reputation points

2024-09-04T11:10:52.53+00:00

@AnuragSingh-MSFT are you able to comment any further on our inquries?

thanks!
Chris Tout 0 Reputation points

2024-10-14T12:12:09.8933333+00:00

Same here @AnuragSingh-MSFT

Started on: 09/10/2024, 06:39:04.336
Most recent occurrence: 13/10/2024, 22:31:24.199
Chris Tout 0 Reputation points

2024-10-14T12:12:29.6366667+00:00

Double post, please delete.
BRUCE AERON MAGCAMIT 0 Reputation points

2024-11-12T17:38:21.9233333+00:00

Seeing this on our tenant as well. I have no clue where to start investigating

3 answers

Your answer

AnuragSingh-MSFT 21,566 Reputation points Moderator

2024-06-20T04:13:48.48+00:00

@Rob Underwood, thank you for posting this question on Microsoft Q&A.

Could you please answer the queries below to help us understand this issue better:

Where do you see this error? Could you share a screenshot masking the confidential information (subscription id, username/email id etc.)

When do you see this error? Is it while performing a specific task?

Is this something that has started occurring recently?
Rob Underwood 50 Reputation points

2024-06-20T13:36:39.2766667+00:00

This seemed to start on June 4th.
AnuragSingh-MSFT 21,566 Reputation points Moderator

2024-06-26T09:34:16.36+00:00

@Rob Underwood, Apologies for the delayed response.

Are you still facing this issue or was it only for a small duration when you were facing this issue?

I checked the workbook, and it uses the query below to get these errors.

_LogOperation | where Level in ("Error", "Warning") | summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Computer, Category, Operation, Details=Detail | project TimeGenerated, Level, Category=strcat(Category, " (", Operation, ")"), Computer=iff(Resource == "", Computer, strcat(Computer, " (", Resource, ")")), FullText=Details | reduce kind=source by FullText with threshold=0.5

If you are still seeing the errors being reported, can you please run the following query to get an understanding of the resource which is causing this issue?

_LogOperation| where Level in ("Error", "Warning")| summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Compu

As the table for which the error is being reported is AzureDiagnostics table, the values are being sent by another resource which is causing this error. The respective resource will have to be investigated to understand the cause.

Please let us know if you have any questions.
AnuragSingh-MSFT 21,566 Reputation points Moderator

2024-07-02T08:32:26.7466667+00:00

@Rob Underwood, Following-up to check if you had a chance to review the answer provided. If the answer did not help, please add more context/follow-up question for it.
Romain Girot 15 Reputation points

2024-07-16T13:32:43.1033333+00:00

Hello @AnuragSingh-MSFT

If it can help : the same problem as @Rob Underwood started to occur recently in our context (same table, but with another independent tenant/subscription).

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[].properties[0]', line 1, position *. (5)

This table AzureDiagnostics is only fed by diagnostic settings from native Azure services here, there no custom feeding of this table in our environment. So it is probably a bug on Microsoft side, about logs format sent via diagnostic settings

When I run the query you've sent (after completing the last truncated work to "Computer"), here is the result :

Level,Resource,Computer,"TimeGenerated [UTC]",Category,Operation,Detail,CorrelationId Warning,,,"7/12/2024, 10:23:30.271 PM",Ingestion,"JSON Format","Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 75. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[75].properties[0]', line 1, position 144459.",
Frawley, Kevin 0 Reputation points

2024-07-24T14:08:51.9766667+00:00

Running into the same issue here. As @Romain Girot suggested "AzureDiagnostics" type is only really sent by Diagnostic Settings. We have a combination of built-in and custom policies. I am wondering if something changed in a built-in policy that is causing this issue. My first occurrence of the issue is 6/5/2024, but not sure if the logs are saved beyond that date anyway. Starting 6/5 we were only seeing 1 a day until mid July. Not sure if this is an issue with one of our own policies, or if it could be with a built-in policy from MS.

When I run the query posted by @AnuragSingh-MSFT I do not get a Resource. So, not sure how else to track down where the issue is coming from.
Miguel Coelho 0 Reputation points

2024-08-01T09:42:25.32+00:00

Hi everyone, is there any news about this issue? I'm having the same issue. And running the LogOperation query to detect the error i have the same results:

Level

Warning

TimeGenerated [UTC]

2024-07-31T14:03:57.347Z

Category

Ingestion

Operation

JSON Format

Detail

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 99. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[99].properties[0]', line 1, position 181910
Frawley, Kevin 0 Reputation points

2024-09-04T11:10:52.53+00:00

@AnuragSingh-MSFT are you able to comment any further on our inquries?

thanks!
Chris Tout 0 Reputation points

2024-10-14T12:12:09.8933333+00:00

Same here @AnuragSingh-MSFT

Started on: 09/10/2024, 06:39:04.336
Most recent occurrence: 13/10/2024, 22:31:24.199
Chris Tout 0 Reputation points

2024-10-14T12:12:29.6366667+00:00

Double post, please delete.
BRUCE AERON MAGCAMIT 0 Reputation points

2024-11-12T17:38:21.9233333+00:00

Seeing this on our tenant as well. I have no clue where to start investigating

Answer 1

Mohsin Khairdi 0

I am also facing the same problem in our tenant, getting alerts from workspace. I tried queries mentioned don this page and only I could find is:

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 32. Exception message: Unexpected character encountered while parsing value: e. Path 'records[32].properties', line 1, position 44779.

User's image

Unable to find out exactly which resource is sending malformed Json.
_ResourceId

<EMPTY_VALUE>

Is there any solution to this problem?

0 comments

Answer 2

Anonymous

Hi All,

Same issue. Any updates from anyone?

Anonymous

2024-11-12T20:16:44.21+00:00

Hi All,

I raised a case with MS and they identified it as a log coming from the PostgreSQL Flexible Servers. They have a fix ready for it and will be deploying to all instances.

Hopefully, you will see it disappear in the coming month.
BRUCE AERON MAGCAMIT 0 Reputation points

2025-01-14T20:28:03.24+00:00

I don't know when it started for us but I noticed it this week after i turned on psql diagnostics logs for Query Performance Insight for our PostgreSQL Flexible Server. Has it been fixed on your end?

Answer 3

Kyle L 0

Same issue here would be good to get an update from Microsoft.

0 comments