New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Manually ASIM Deployment - Failed to validate, Conflict #8623
Comments
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal. |
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal. |
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal. |
Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal. |
Hi @rcegan, we are checking on this and we will provide an update soon. |
Hi @rcegan, waiting for update from concerned team, once we receive an update will let you know. |
1 similar comment
Hi @rcegan, waiting for update from concerned team, once we receive an update will let you know. |
Hi @rcegan, we are still waiting for update from concerned team, we will get back to you once there is an update. |
1 similar comment
Hi @rcegan, we are still waiting for update from concerned team, we will get back to you once there is an update. |
I was able to work around the problem by deploying the resources to a different location than the log analytics workspace itself. Solves my issue but I suspect that's probably not the intended behaviour |
According to the error message, it is working as expected. Try deleting the previous one and installing in the same location, it should work fine. |
@rcegan thanks for raising this issue. Can you please share the location details where it failed and where it worked for you? |
I was working with Australia Southeast and Australia East. Deploying to Australia Southeast, with the log analytics workspace in the same location, the deployment failed (due to a resource already existing in that location - the workspace itself). Picking a different location (Australia East) it appeared to work fine. |
Hi, This behavior is as expected due to the following reason. Because the ASIM parsers already exists, this will result in an error as described above. There are 2 workarounds to remediate this issue:
It is more an issue related to Log Analytics than Microsoft Sentinel or ASIM as they are dependent on Log Analytics. What I can do is create a PowerShell script that updates the ASIM parsers is they already exists and use the ASIM yaml files as input. Or create and ARM template that uses a Script Extension to run the PowerShell script in a different context. This might need some extra permissions in the Azure Subscription / Resource Group but need to validate this first. |
@rcegan I created a new workspace, deployed Process Event parsers multiple times on same workspace. I didn't got that error. Am I missing anything that you tried? Which schema parser you were trying to deploy. Can you please retry on a new and on the same workspace you previously tried, see if you are still getting that error? |
Hi @rcegan, Gentle Reminder: We are awaiting for your response on this issue. If you still need to keep this issue active please respond on it in the next 2 days. If we don't receive response, we will be close this issue. |
Sorry to add to the noise, but I'm having the exact same problem. Tried deploying all ASIM parsers and then just one-by-one, same error message "Conflict" I've tried putting the LAW in Australia Southeast and the LAW in Australia East, and also putting them in the same region, no difference to the output. Drilling into the error message isn't any more help, just states eTAG for specific error was outdated newer data exists. If you are using eTag please use the latest one and try again in a few minutes. Operation Id: '4918a525df68776dd0a7063aaa6db6dd' (Code: NewerDataExists) Trying to redeploy multiple times to get other deployments to succeed does not help either. |
@rcegan @jusso-dev FYI, this issue is being investigated. |
@rcegan @jusso-dev @azurekid |
Describe the bug
Upon trying to deploy ASIM parsers via the 'Deploy to Azure' button and filling out the required parameters, a 'Conflict' error appears with the following error: (workspace, location and resource group have been omitted)
Upon giving it a different name, it creates a new LAW in the designated resource group.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
The parsers should deploy into the targeted workspace and become available for query.
Screenshots
Desktop (please complete the following information):
Additional context
I have all required permissions to deploy this content.
The text was updated successfully, but these errors were encountered: