Service-fabric: Service Fabric Analytics solution addon in Log Analytics doesn't work

[sistoimenov]

Hello,

I tried to configure log analytics for my service fabric cluster but it doesn't seem to send any logs to Log Analytics. I managed to set up Application Insights but I also wanted to get log analytics working to have all of my resources in one place.

First of all this documentation is broken https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-service-fabric-azure-resource-manager - the first two links "Deploy to Azure" do not open the template...

I tried to manually setup Service Fabric Analytics. I installed the OMS solution and then from the azure portal I selected WORKSPACE DATA SOURCES -> Storage accounts logs, then I added Events, ETW Logs and Service Fabric Events with the following sources (table names): WADWindowsEventLogsTable, WADETWEventTable and WADServiceFabric*EventTable - after save I waited like an hour and in OMS nothing was populated - it was saying that there are 0 applications, services and nodes.

I also tried to set it up from the arm template - again nothing was populated in OMS and log analytics

Then I noticed that in my blob storage where the service fabric logs and counters are the tables have the following names: WADPerformanceCountersTable, WADServiceFabricReliableActorEventTable, WADServiceFabricReliableServiceEventTable and WADServiceFabricSystemEventTable - you can see these table names do not match the one which are available in the Service Fabric Analytics solution in OMS. My guess is that after some update the table names were changed and the solution was not updated. Unfortunately there isn't a way on your own to update the data sources in the Service Fabric Analytics solution to reflect the new names. What I did is I tried to set these table names in the arm template for the Service Fabric Analytics OMS solution and then when I checked in the portal only WADPerformanceCountersTable was present which is strange because it is not present to be selected from the UI. The other table names were not present.

Service Fabric version that I use is: 6.1.472.9494 with 6 nodes working on Windows 2016 datacenter (without containers)

Please advise if I am not configuring log analytics correctly or share an update if this is a bug on your side.

[srrengar]

Hey @sistoimenov

Can you confirm for me if you can see logs in the Storage account tables WADServiceFabricSystemEventTable, and WADServiceFabricReliableServiceEventTable? Unfortunately manually adding in the storage account names in the ARM template does not work. Only the WADServiceFabric*EventTable pattern is supported and it seems you already added the Service Fabric Events. If you do have logs there and the storage account you selected in the OMS workspace data sources is correct then I can reach out to the OMS team to help.

I have also filed a GitHub issue on that article to address the broken link. In the meantime here is another sample template you can try. Let me know how it goes
https://github.com/krnese/azure-quickstart-templates/tree/master/service-fabric-oms

This sample and the detailed steps to add the Service Fabric solution are here
https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-diagnostics-oms-setup

[tudorsibiu90]

I have the same issue. I tried what you suggested. I see the logs in the storage account but the OMS workspace or solution shows absolutely 0 data. Please help.

[Dan-cws]

Same problem here. I can see the entries in the tables with storage Explorer, but no data is shown in OMS workspace.

[srrengar]

Just double checking can you verify the OMS workspace is reading from the correct storage tables and storage account as noted in the steps here: https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-diagnostics-oms-setup#connect-the-log-analytics-workspace-to-your-cluster?

If so, try recreating the OMS workspace and Service Fabric Analytics solution through the portal. Let me know how it goes

[tudorsibiu90]

It doesn't work. The only way to make it work is to deploy via ARM template, and the only one working is
https://github.com/krnese/azure-quickstart-templates/tree/master/service-fabric-oms

If they are not created in the same deployment, it doesn't work. I triple checked all the storage accounts. even made sure that the tables were populated with data and still nothing.

I am sure you can reproduce this faulty behaviour as well.

[srrengar]

Has anyone been able to repro this from the portal recently?

[masnider]

@peterpogorski has been working to update our examples and getting started templates here, so should be able to point you to a known good example and then we can troubleshoot from there if things are still not working.