Azure-quickstart-templates: Web app diagnostics logs not written to blob container

[jjminio]

301-web-app-diagnostics-logs-blob-container

Issue Details

There are no issues deploying the arm template and the 'App Service/Diagnostic Logs' seems to be configured as expected with the 'Application Logging (Blob)' as 'On' state and using the ' The problem is that under the created container the 'expected' structure with the webapp name is not created neither logs are being stored... It's just empty.

The 'App Service/Application settings/Application settings/DIAGNOSTICS_AZUREBLOBCONTAINERSASURL' value seems to have a valid Account SAS token https://.blob.core.windows.net/?sv=2015-04-05&ss=bfqt&srt=sco&sp=rwdlacup&st=2018-10-01T00:00:00.0000000Z&se=2218-10-30T00:00:00.0000000Z&sig=

Creating the storage account manually and assigning a new container during the webapp diagnostic config works as expected, but SAS token structure is different:
https://.blob.core.windows.net/?sv=2017-04-17&sr=c&sig=&st=2018-12-27T13:42:25Z&se=2218-12-27T13:42:25Z&sp=rwdl

I've tried to create a service SAS token as above at the arm template using below code but also fails not creating the expected logs structure under the container

"variables": [
"applogsServiceSasFunctionValues": {
      "canonicalizedResource": "[concat('/blob/', parameters('diagnosticsStorageAccountName'), '/appservice-applogs')]",
      "signedPermission": "rwdl",
      "signedStart": "2018-12-27T00:00:00Z",
      "signedExpiry": "2218-12-27T00:00:00Z",
      "signedResource": "c"
    }
]

{
  "condition": "[not(empty(variables('diagnosticsStorageAccountName')))]",
          "type": "Microsoft.Web/sites/config",
          "apiVersion": "2018-02-01",
          "name": "[concat(parameters('siteName'), '/logs')]",
          "dependsOn": [
            "[parameters('siteName')]",
            "[variables('diagnosticsStorageAccountName')]"
          ],
          "properties": {
            "applicationLogs": {
              "azureBlobStorage": {
                "level": "[variables('diagnosticsLogsLevel')]",
                "sasUrl": "[if(not(empty(variables('diagnosticsStorageAccountName'))),concat(reference(concat('Microsoft.Storage/storageAccounts/', parameters('diagnosticsStorageAccountName')), '2016-01-01').primaryEndpoints.blob, 'appservice-webserverlogs', '?', listServiceSas(resourceId('Microsoft.Storage/storageAccounts', variables('diagnosticsStorageAccountName')), '2018-02-01', variables('applogsServiceSasFunctionValues')).serviceSasToken),json('null'))]",
                "retentionInDays": "[variables('diagnosticsLogsRetentionInDays')]"
              }
            },

Repro steps

1. Deploy arm template 301-web-app-diagnostics-logs-blob-container
2. Navigate to the storage account created and explore the container. It should contains a '

[Cloud217]

Same issue here. Reconfig using the portal works instantly. Did you manage to work arround this problem?

[archonandrewhunt]

I got in touch with Azure support and they identified that the docs are incorrect. Here is their new recommended approach:

storage account SAS key should be provided in specific format. And also our recommendation would be to use ServiceSAS key instead of AccountSAS key.

"serviceSasProperties": {
    "canonicalizedResource": "[concat('/blob/', parameters('storagename'),'/',parameters('containerName'))]",
    "signedResource": "c",
    "signedPermission": "rwdl",
    "signedstart":"2017-08-20T11:00:00Z",
    "signedExpiry": "2020-08-20T11:00:00Z"
}

"azureBlobStorage": {
    "sasUrl": "[concat('https://',parameters('storagename'),'.blob.core.windows.net/',parameters('containername'),'?',listServiceSas(parameters('storagename'), '2018-07-01', variables('serviceSasProperties')).serviceSasToken)]",
    "retentionInDays": 35,
    "enabled": true
}

[pierluca]

What worked for me was following @archonandrewhunt recommendations + setting the DIAGNOSTICS_AZUREBLOBCONTAINERSASURL and WEBSITE_HTTPLOGGING_CONTAINER_URL

[kkopuru]

Is this working for anyone? It just works fine when I pass in hardcoded SAS url.

This is what I have been trying.

"variables": {
        "serviceSasProperties": {
            "canonicalizedResource": "[concat('/blob/', parameters('storageAccountName'),'/',parameters('blobContainerName'))]",
            "signedServices": "b",
            "signedPermission": "rwl",
            "signedstart":"2017-08-20T11:00:00Z",
            "signedExpiry": "2293-01-20T15:09:30Z",
            "signedResource": "c"
        }
    },

 "resources": [
                {
                    "apiVersion": "2018-02-01",
                    "name": "logs",
                    "type": "config",
                    "dependsOn": [
                        "[resourceId('Microsoft.Web/Sites', parameters('appName'))]"
                    ],
                    "properties": {
                        "httpLogs": {
                            "fileSystem": {
                                "retentionInMb": 35,
                                "retentionInDays": 7,
                                "enabled": false
                            },
                            "azureBlobStorage": {
                                "sasUrl": "[concat('https://',parameters('storageAccountName'),'.blob.core.windows.net/',parameters('blobContainerName'),'?',listServiceSas(parameters('storageAccountName'), '2018-07-01', variables('serviceSasProperties')).serviceSasToken)]",
                                "retentionInDays": 7,
                                "enabled": true
                            }
                        },
                        "failedRequestsTracing": {
                            "enabled": true
                        },
                        "detailedErrorMessages": {
                            "enabled": true
                        }
                    }
                }
            ]

[BMuuN]

I can confirm @archonandrewhunt solution does work however you must ensure both the Storage Account and logs Config are in the same template else you'll get the error:

The template reference 'logs' is not valid: could not find template resource or resource copy with this name.

This is not a helpful error message but does indicate there is an issue with the storage account reference.

If (like me) your resources are spread across multiple template files then the work around is to fully qualify the storage account name on the method listServiceSas(), for example:

listServiceSas(concat('Microsoft.Storage/storageAccounts/', parameters('StorageAccount_ServerLogs_Name')), '2018-07-01', variables('serviceSasApplicationProperties')).serviceSasToken

With the storage account name being passed in as Microsoft.Storage/storageAccounts/logs rather than logs the deployment succeeded, logs are saving to the container and the JSON markup looks correct on https://resources.azure.com.

With little documentation on app diagnostics and SAS blob access I'm not sure if this is intended functionality or if it's working by chance as there's no mention of the account name format on the Microsoft Docs.

For reference here's a snippet of my template:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "StorageAccount_ServerLogs_Name": {
            "defaultValue": "logs",
            "type": "String"
        },
        "Sites_AppPortal_Name": {
            "defaultValue": "application-portal",
            "type": "String"
        }
    },
    "variables": {
        "BlobLogsApplication": "application-logs",
        "BlobLogsWebServer": "webserver-logs",
        "serviceSasApplicationProperties": {
            "canonicalizedResource": "[concat('/blob/', parameters('StorageAccount_ServerLogs_Name'), '/', variables('BlobLogsApplication'))]",
            "signedVersion ": "2018-03-28",
            "signedResource": "c",
            "signedPermission": "rwdl",
            "signedExpiry": "2050-01-01T00:00:00Z"
        },
        "serviceSasWebServerProperties": {
            "canonicalizedResource": "[concat('/blob/', parameters('StorageAccount_ServerLogs_Name'), '/', variables('BlobLogsWebServer'))]",
            "signedVersion ": "2018-03-28",
            "signedResource": "c",
            "signedPermission": "rwdl",
            "signedExpiry": "2050-01-01T00:00:00Z"
        }
    },
    "resources": [
        {
            "apiVersion": "2018-02-01",
            "type": "config",
            "name": "logs",
            "tags": {
                "displayName": "Application Logs"
            },
            "dependsOn": [
                "[resourceId('Microsoft.Web/Sites', parameters('Sites_AppPortal_Name'))]"
            ],
            "properties": {
                "applicationLogs": {
                    "azureBlobStorage": {
                        "level": "Error",
                        "sasUrl": "[concat('https://', parameters('StorageAccount_ServerLogs_Name'), '.blob.core.windows.net/', variables('BlobLogsApplication'), '?', listServiceSas(concat('Microsoft.Storage/storageAccounts/', parameters('StorageAccount_ServerLogs_Name')), '2018-07-01', variables('serviceSasApplicationProperties')).serviceSasToken)]",
                        "retentionInDays": 45
                    }
                },
                "httpLogs": {
                    "azureBlobStorage": {
                        "enabled": true,
                        "sasUrl": "[concat('https://', parameters('StorageAccount_ServerLogs_Name'), '.blob.core.windows.net/', variables('BlobLogsWebServer'), '?', listServiceSas(concat('Microsoft.Storage/storageAccounts/', parameters('StorageAccount_ServerLogs_Name')), '2018-07-01', variables('serviceSasWebServerProperties')).serviceSasToken)]",
                        "retentionInDays": 45
                    }
                },
                "failedRequestsTracing": {
                    "enabled": true
                },
                "detailedErrorMessages": {
                    "enabled": true
                }
            }
        }
    ]
}

[erikholsson]

I recently faced this same issue and sadly the solutions above didn't work for me. Instead of using the "config" object I solved the issue by adding the snippet below to the "resources" section of my app service template. This creates a container in my storage account and creates/updates the correct folder structure for the logs. Not sure why this doesn't seem to be documented as it also eliminates the need for creating a SAS token programatically.

{
  "type": "providers/diagnosticSettings",
  "name": "[concat('Microsoft.Insights/', variables('diagnosticSettingName'))]",
  "apiVersion": "2017-05-01-preview",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('adminBackendName'))]"
  ],
  "properties": {
    "name": "[variables('diagnosticSettingName')]",
    "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', variables('logStorageAccount'))]",
    "logs": [
      {
        "category": "AppServiceConsoleLogs",
        "enabled": true,
        "retentionPolicy": {
          "days": 9,
          "enabled": true
        }
      }
    ]
  }
}

Also a friendly reminder that 301-web-app-diagnostics-logs-blob-container hasn't been updated, so it's still broken.