Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vCenter Parser: Error in parsing events of type UserEventsLogoutEvent when the value of "number of API invocations" within the raw event message is not an integer. #11542

Open
kevintamlsWork opened this issue Dec 9, 2024 · 2 comments
Assignees
Labels
Parser Parser specialty review needed

Comments

@kevintamlsWork
Copy link

Describe the bug
The vCenter Parser fails to parse events of type UserEventsLogout when the value of "number of API invocations" within the raw event message is not an integer.

To Reproduce
Steps to reproduce the behavior:

  1. Go to Sentinel or Log Analytics
  2. Attempt to perform a search using the KQL query "vCenter () | where Message has ("UserLogoutSessionEvent").
  3. Locate events where in the raw message, has a number containing a comma after "number of API invocations:"
  4. See error

Expected behavior
Events that contain a comma within the APIInvocationCount field to be parsed correctly in all fields.

Screenshots
Some values of fields within events has been redacted.

Working:
Image

Not Working:
Image

Desktop (please complete the following information):

  • OS: Windows 11
  • Browser: Google Chrome
  • Version: 131.0.6778.86

Additional context
N/A

@v-sudkharat
Copy link
Contributor

Hi @kevintamlsWork, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

@v-sudkharat
Copy link
Contributor

@kevintamlsWork, could you please share the sample logs with us on mail id - v-sudkharat@microsoft.com Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Parser Parser specialty review needed
Projects
None yet
Development

No branches or pull requests

4 participants