Final Update: Tuesday, 19 October 2021 03:07 UTC
Summary of Impact: Between 00:00 UTC on 16 Oct 2021 and 01:45 on 19 Oct 2021, you were identified as a customer using Log Analytics in Australia East who may have encounterd data gaps when querying Security_Event data within resources hosted in this region. This issue is limited to this specific data type, and all other data types are unaffected.
Preliminary Root Cause: We determined that a recent deployment contained a code bug affecting the agent which delivers Security_Event data to Log Analytics.
Mitigation: We deployed a configuration fix to update the service to the previously-known healthy state.
We understand that customers rely on Azure Log Analytics as a critical service and apologize for any impact this incident caused.
-Varun
Update: Monday, 18 October 2021 23:07 UTC
Current Status: We determined that a recent deployment contained a code bug affecting the agent which delivers Security_Event data to Log Analytics. We developed and deployed a configuration change to the service to return the service to a previously-known healthy state, however an additional fix is required to enable this configuration change for the affected agent. This fix will force the agent to refresh the configuration. Once the fix is validated and deployed, customer impact should be mitigated. We expect this process to complete within the next 2-4 hours.
The next update will be provided in 4 hours, or as events warrant.
-Varun
Update: Monday, 18 October 2021 20:38 UTC
We continue to investigate issues within Log Analytics. Root cause is not fully understood at this time. Starting as early as 16 Oct 2021, some customers using Log Analytics in Australia East may experience data gaps when querying Security Event data within resources hosted in this region. This issue is limited to this specific data type, and all other data types are unaffected.. We currently have no estimate for resolution.
- Work Around:
- Next Update: Before 10/18 23:00 UTC
-Varun
