Error reading log from an azure storage account using TA-Azure

[Benedetta]

Hello,

we are trying to read Windows Security Log (from different azure servers, gathered in a storage account) using the TA-Azure app.
Using the app version "122" we see duplicate events, it seems that the checkpoint value is not stored.
Instead, using the app version "123" we don't collect any events. Looking at the internal index we found the following error:
"Message from "python /opt/splunk/etc/apps/TA-Azure/bin/AzureDiagnostics.py" - ERROR AzureDiagnostics: 372 - Error steaming date: 'int' object has no attribute 'lstrip'"
 
How do we solve the problems?

[Benedetta]

Hi,

we noticed that in the code the timestamp (largest_partition_key) is initialized to 0. When the query return no entities (by the fact that we are analyzing a limited time range without any security event), the timestamp is not updated and remain equal to 0.

What we have done, as I workaround, is comment on the following part in the code:
[row 369 - save_checkpoint(checkpoint_dir, checkpoint_file_name, json.dumps(jsonMarker))], in order to avoid that a timestamp=0 will be saved as a checkpoint. The checkpoint is updated only when the query collects some events and return the last timestamp read.

[DJAXX03]

Benedetta,

Did you ever get a resolution to this? I am having the same issue and can't collect logs as expected.