Troubleshoot Azure VNet Flow Logs monitoring

If you've set up Azure VNet Flow Logs monitoring and are running into problems, use the following sections to diagnose common issues with the VNet Flow Logs Forwarder.

No flow log data in New Relic

If flow log data isn't appearing in New Relic, check the following:

• Confirm that NR_LICENSE_KEY is correctly configured.
• Check that VNet Flow Logs are enabled and actively writing PT1H.json blobs to your storage account.
• Verify the Event Grid subscription is active and routing BlobCreated events to the Event Hub.
• Confirm the EVENTHUB_CONSUMER_CONNECTION and EVENTHUB_NAME settings match the Event Hub receiving the events.
• Check the Function App logs in Azure for errors. To see verbose logs, set the AzureFunctionsJobHost__logging__logLevel__Function app setting to Debug.

Duplicate flow log records

The cursor mechanism prevents duplicate processing under normal conditions. If you see duplicates, check the following:

• Check that CURSOR_STORAGE_CONNECTION is correctly configured and the table is accessible.
• Verify there's only one active instance of the consumer processing each Event Hub partition.

Events being skipped (poison event protection)

After MAX_CONSECUTIVE_FAILURES consecutive failures (default 5) processing the same blob, the forwarder marks it as a poison event and skips it to prevent infinite retries. Check the Function App logs for the root cause of the initial failures, fix the issue, and reset the cursor by deleting the corresponding row from the nrvnetflowlogscursors table. The forwarder retries New Relic delivery errors (429, 5xx, and retryable network errors) first. The failure counter only increments after those retries are exhausted or another hard failure occurs.