Cloudflare data connector broke

[philfy20]

cloudflare data connector is broken no longer showing the function in the function app. Have tried a clean deployment and get this error

'The template parameter 'MaxRunTime' is not found. Please see https://aka.ms/arm-syntax-parameters for usage details.'",

Issue has affected 4 our customers currently using this data connector. Please resolve believe issue is from recent commits 2 weeks ago

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[masterchrister]

Experiencing the same issue in my end.

[ingest0x]

Our Data Connector has also broken - function no longer present within the function app - this is causing us a huge problem. Attempts to redeploy fail for same reason as OP:

'The template parameter 'MaxRunTime' is not found. Please see https://aka.ms/arm-syntax-parameters for usage details.'",

I don't understand how this can just suddenly happen - this connector has run rock solidly for many many months then suddenly disappears.

[tiagoasousa]

this PR seems to be at fault #9518 @v-atulyadav can this be reverted?

[flatech25]

Experiencing the same issue !

Unable to process template language expressions for resource '/subscriptions/xxxxxxxxxxxxxxxxxxx/resourceGroups/Sentinel_Resource_Group/providers/Microsoft.Web/sites/cloudflareqd2sxr4b4bgr2/config/appsettings' at line '154' and column '17'. 'The template parameter 'MaxRunTime' is not found. Please see https://aka.ms/arm-syntax-parameters for usage details.' (Code: InvalidTemplate)

[boodoesgh]

I also have this issue.

[nathanreevesac3]

Not sure if MaxRunTime is related to Max Headroom at all.

But I am experiencing the same issue.

[v-sudkharat]

Hi @philfy20, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 20-12-2023. Thanks!

[ingest0x]

FYI I have raised a Severity B support case via the Azure Portal support feature.

[v-sudkharat]

@ingest0x, noted. thanks!

[scottmckenzie]

Just discovered that we were affected by this change also. You can roll back to the previous version by updating the WEBSITE_RUN_FROM_PACKAGE app setting to https://raw.githubusercontent.com/Azure/Azure-Sentinel/f159b501922a9d396af6047c40fd93095a3f9778/Solutions/Cloudflare/Data%20Connectors/CloudflareConn.zip

[v-muuppugund]

@scottmckenzie ,We are analyzing the issue and will get back to you with an update

[ingest0x]

thanks @scottmckenzie ! I'll try give that a go today

UPDATE: did as @scottmckenzie suggested and ingestion has resumed. Thanks!

[v-sudkharat]

Hi @scottmckenzie, sharing update with you, we are working on revert the recent changes. Thanks!

[philfy20]

any update on the fix?

[v-sudkharat]

Hi @philfy20, we are checking this issue with respective author, meanwhile just want to know have you raised the support case ticket with Cloudflare team?

Thanks!

[masterchrister]

Hi @philfy20, we are checking this issue with respective author, meanwhile just want to know have you raised the support case ticket with Cloudflare team?

Thanks!

ref support case with Cloudflare "This is owned by Azure, so there is limited action we can take on our side".

[v-sudkharat]

@masterchrister, noted thanks!

[elvischau]

looks like there is an extra layer of folder inside the package https://aka.ms/sentinel-CloudflareDataConnector-functionapp, that cause the original issue where the connector disappearing from the function app

for the deployment issue, i was able to work around it by adding this piece of code into the ARM template between line 10 and 11 (i just put in some defaultValue i see fits)

    "MaxRunTime": {
        "defaultValue": "10",
        "type": "String"
    },
    "MaximumStorageBlobSize": {
        "defaultValue": "2",
        "type": "String"
    },

for the connector disappearing issue, i worked around the issue by repackaging the zip file https://aka.ms/sentinel-CloudflareDataConnector-functionapp manually.

just remove the extra folder in the ZIP file, zip it up again, and then host it on a storage account, lastly, point the WEBSITE_RUN_FROM_PACKAGE to the storage account (using SAS key)

[v-sudkharat]

Hi @philfy20,
We are checking this issue with respective PR author, meanwhile, Could you please follow the below steps and check whether your issue get resolved.

1, Deploy the below Azure deployment file using Custom Deployment-
azuredeploy_Cloudflare_API_FunctionApp.json

2. Once deployment get successful check the function app in your workspace or resource group -

3. Then go to Configuration option and chick on the edit option of WEBSITE_RUN_FROM_PACKAGE and replace the existing Value with below shared one -

https://github.com/Azure/Azure-Sentinel/raw/v-mchatla/Cloudflare/Solutions/Cloudflare/Data%20Connectors/CloudflareConn.zip

4. Once it gets updated save the changes and restart the function app -
   
   

Please let us know once your issue gets resolved.
Thanks!

[v-sudkharat]

Hi @philfy20, Could you please have a look on above comment and let us know if your issue get resolved. Thanks!

[philfy20]

Updating value WEBSITE_RUN_FROM_PACKAGE to -
https://github.com/Azure/Azure-Sentinel/raw/v-mchatla/Cloudflare/Solutions/Cloudflare/Data%20Connectors/CloudflareConn.zip works.

Also seems like updating to https://raw.githubusercontent.com/Azure/Azure-Sentinel/f159b501922a9d396af6047c40fd93095a3f9778/Solutions/Cloudflare/Data%20Connectors/CloudflareConn.zip works.

Thanks

[v-sudkharat]

@philfy20, Thank you for your confirmation. So, closing this issue. If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.

[egallis31]

This still appears to be an issue when utilizing WEBSITE_RUN_FROM_PACKAGE as https://aka.ms/sentinel-CloudflareDataConnector-functionapp

Added the missing parameters manually

When deploying today, the function was "found" but never loaded into the runtime to execute

The rolled-back release work for WEBSITE_RUN_FROM_PACKAGE as https://raw.githubusercontent.com/Azure/Azure-Sentinel/f159b501922a9d396af6047c40fd93095a3f9778/Solutions/Cloudflare/Data%20Connectors/CloudflareConn.zip

[beachfires]

When will the Sentinel connector store version of this be fixed?

[pir8g33k]

Any update on CF connector with sentinel, the deployment via sentinel portal still having issue, looking forward to fixed this

[v-sudkharat]

Hi @pir8g33k and @beachfires, Apologies for the inconvenience. We are following up with the PR author who made the fix, but as of now, we have not received any response from them. We kindly request you to raise an issue ticket with Cloudflare's support team by sending an email to [email protected] or by visiting their support page at https://support.cloudflare.com/.

[o-l-a-v]

@v-sudkharat Cloudflare has already said this is not on them, but on Azure?

• Cloudflare data connector broke #9601 (comment)

[v-sudkharat]

Hi @o-l-a-v, thank you for sharing this update with us. We have shared this information with our team, and they are working on it. Please expect an ETA by 11 Jan 2024.

Thanks!

[v-sudkharat]

Hi @o-l-a-v, @pir8g33k, @beachfires, thanks for being connected with us. The fix has been merged and it get reflected into Cloudflare Solution.

Thanks!

[pir8g33k]

Hi @o-l-a-v, @pir8g33k, @beachfires, thanks for being connected with us. The fix has been merged and it get reflected into Cloudflare Solution.

Thanks!

Ok Great thanks for the update and looking forward, i was able to redeploy with the solution you provided above, it would be great if the new fixes applied on sentinel portal deployment file

[beachfires]

We have not seen the new release yet within Azure Sentinel Content Hub. When will you be releasing it?