Encountered a StorageException while trying to fetch the diagnostic events

saicharan 0
Viewed 635

Out of nowhere started seeing this error when opened function apps, Application is working though.

Unable to retrieve diagnostics and error information for your function app. 
Encountered a StorageException while trying to fetch the diagnostic events. 
Please make sure the connection string in the app setting "AzureWebJobsStorage" has the permissions to access Azure Table Storage

Storage account network access is set to "Enabled from selected virtual networks and IP addresses". Even with this settings there was no error before.

but now the above error message is gone only when changed to "Enabled from all networks".

Recently updated functionapp to dotnet 6.0 and v4 runtime even after, there was no error. Not sure if this has anything to do with this.

How do I fix for this?

azure-functions-runtime azure-storage azure-storage-account azure-functions azure
5 Answers

We noticed the same issue in several of our functionapps. We also have configured the functionapp to be able to access the storage account via a subnet in a vnet, which worked fine until a few days ago. The functionapp itself is still working as intended, but it started showing this message a few days ago. As a test we did 'Enable from all networks' on the storage account, which resolved the warning message. I suspect there is some other service besides the functionapp which needs access to the storage account to read the functionapp diagnostic information. If I would know which service we could grant it access to the storage account without needing to 'Enable from all networks'

Robert Wielink0

This was caused by a platform level alert raised by a diagnostic component, and although it had no impact on the production workloads, the verbiage wasn't clear and the level misleading. The event has been disabled and you should no longer see this come up.

To expand, this error was reported by the control plane for the diagnostic component, which is meant to surface diagnostic events raised by production components to the portal, but not involved in any production workload flow and had no impact on the App's functionality.

Fabio Cavalcante0

I raised a support ticket with Microsoft regarding this issue and was told that there seems to be a platform issue for App Services in West Europe region and they are currently investigating.

Iokanaan Iokan0

Same issue here, the function has network integration with outbound subnet defined, which subnet is whitelisted ins storage account networking setting in "Enable from specific IPs and networks" section. Whis setting was working without issue until recently.

Maciej T0

When you're enabling the Storage Account to be set to Enabled from selected virtual networks and IP addresses you are restricting the Account to only be accessed by clients on the networks defined.

When it is set to Enabled from all networks then any client can access your Storage Account if they have the access key.

The reason you are getting an error saying the Account Key is incorrect, I suspect, is because you're getting a 401 - Unauthorized response and the Function is translating that for you to give you a helpful error message; this is because the network the function app is running on isn't specified in the list of selected virtual networks and IP addresses.

If you want to restrict network access to the Storage Account AND use a Function App you'll need to look at Subnet Delegation and Private Endpoints as a way of creating a Virtual Network link between your Function App and Storage Account.

More on that can be found here

Here is a quickstart template on how to deploy that.

Pete Philters0
Related