Auth0 Function App logs not posting into Sentinel

[duckngooser]

We have multiple Auth0 function apps that used to successfully load logs into Azure sentinel. The function apps appear to be working as they're successfully authenticating to Auth0 and pulling down the logs based on the Auth0 audit logs and Function App logs. The Function App is logging that it successfully sends "x" number of logs to Sentinel. Upon checking sentinel, we're not finding any logs. We've tried deleting the Auth0 Function App from content hub and re-installing. We've deleted the Auth0AM_CL table on the log analytics workspace to see if it'll re-created. We've tried deleting and recreating one of the function apps, but we end up in the same position. We've verified the Workspace ID/KEY saved in the function app are correct.

Any ideas what we're missing or how to troubleshoot where these logs/events are going?

[v-rusraut]

Hi @duckngooser , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-sudkharat]

@duckngooser, you can verify the below settings :

1. Please update the existing solution to latest one, which is currently - 3.0.0

2. In initial deployment of the connector, check the Workspace ID and Key has been entered:
   

3. You can also confirm the same in function app settings as well:
   

The both the values should be same.

As the table has been deleted from the workspace, So we would suggest please do the fresh installation and deployment of connector in a new workspace.

[v-sudkharat]

@duckngooser, Did you get a change to check on above comment. waiting for your response. Thanks!

[duckngooser]

All of the above settings were correct. I even tried rebuilding one of them. Weirdly enough, they all randomly started working on 11/9 at 4:30am UTC. No changes were made for several days. All of them started working magically without action. I'm wondering if there was some backend issue with the log analytics or something on the MSFT side.