-
Notifications
You must be signed in to change notification settings - Fork 3.3k
Open
Labels
MonitorMonitor, Monitor Ingestion, Monitor QueryMonitor, Monitor Ingestion, Monitor Querycustomer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.needs-team-attentionWorkflow: This issue needs attention from Azure service team or SDK teamWorkflow: This issue needs attention from Azure service team or SDK team
Description
- Package Name: azure-mgmt-monitor
- Package Version: 7.0.0
- Operating System: Linux Fedora 42
- Python Version: 3.13.12
Describe the bug
LogsQueryClient failing to work returning "Code: PathNotFoundError"
To Reproduce
Steps to reproduce the behavior:
$ cat sentinel-mvp.py
import argparse
from datetime import timedelta
from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient, LogsQueryStatus
parser = argparse.ArgumentParser(
description="Run Sentinel ransomware detection queries"
)
parser.add_argument("--workspace", required=True)
parser.add_argument("--timespan", default=1) # days
args = parser.parse_args()
credential = DefaultAzureCredential()
client = LogsQueryClient(credential)
query = "SecurityEvent | take 1"
response = client.query_workspace(
args.workspace, query, timespan=timedelta(days=args.timespan)
)
if response.status != LogsQueryStatus.SUCCESS:
print(f"Query {name} failed: {response.error}")
print(response.text)
$ python sentinel-mvp.py --workspace sentinelrg
Traceback (most recent call last):
File "/home/user/venv/lib64/python3.13/site-packages/azure/monitor/query/_patch.py", line 172, in query_workspace
generated_response = self._execute(workspace_id=workspace_id, body=body, prefer=prefer, **kwargs)
File "/home/user/venv/lib64/python3.13/site-packages/azure/core/tracing/decorator.py", line 119, in wrapper_use_tracer
return func(*args, **kwargs)
File "/home/user/venv/lib64/python3.13/site-packages/azure/monitor/query/_operations/_operations.py", line 227, in _execute
map_error(status_code=response.status_code, response=response, error_map=error_map)
~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/venv/lib64/python3.13/site-packages/azure/core/exceptions.py", line 163, in map_error
raise error
azure.core.exceptions.ResourceNotFoundError: (PathNotFoundError) The requested path does not exist
Code: PathNotFoundError
Message: The requested path does not exist
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/user/sentinel-mvp.py", line 18, in <module>
response = client.query_workspace(
args.workspace, query, timespan=timedelta(days=args.timespan)
)
File "/home/user/venv/lib64/python3.13/site-packages/azure/core/tracing/decorator.py", line 119, in wrapper_use_tracer
return func(*args, **kwargs)
File "/home/user/venv/lib64/python3.13/site-packages/azure/monitor/query/_patch.py", line 174, in query_workspace
process_error(err, LogsQueryError)
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
File "/home/user/venv/lib64/python3.13/site-packages/azure/monitor/query/_helpers.py", line 100, in process_error
raise HttpResponseError(message=error.message, response=error.response, model=model)
azure.core.exceptions.HttpResponseError: (PathNotFoundError) The requested path does not exist
Code: PathNotFoundError
Message: The requested path does not exist
$ python --version
Python 3.13.12
$ pip freeze |grep azure
azure-common==1.1.28
azure-core==1.38.2
azure-identity==1.25.2
azure-keyvault-secrets==4.10.0
azure-kusto-data==5.0.0
azure-mgmt-compute==37.2.0
azure-mgmt-core==1.6.0
azure-mgmt-keyvault==13.0.0
azure-mgmt-monitor==7.0.0
azure-mgmt-network==30.2.0
azure-mgmt-resource==25.0.0
azure-mgmt-resource-subscriptions==1.0.0b1
azure-mgmt-resourcegraph==8.0.1
azure-mgmt-subscription==3.1.1
azure-monitor-query==2.0.0
azure-storage-blob==12.28.0
msrestazure==0.6.4.post1
Expected behavior
Expected KQL query to execute and return results like az monitor log-analytics query -w workspace_id --analytics-query "SecurityEvent | take 1" which is working fine (auth with az login before)
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
MonitorMonitor, Monitor Ingestion, Monitor QueryMonitor, Monitor Ingestion, Monitor Querycustomer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.needs-team-attentionWorkflow: This issue needs attention from Azure service team or SDK teamWorkflow: This issue needs attention from Azure service team or SDK team