microsoft / microsoft/sre-agent

[Issue] DGrep connector returns scrubbed/sanitized LogMessage content for EU regions, making log search unusable

Open
#120 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
PowerShell
Stars
160
Forks
97
Avg merge
2d 5h
Merged PRs (30d)
12

Description

Issue Description
When querying DGrep logs via the SRE Agent's 
PerformDgrepSearch
 tool for EU regions (e.g., 
westeurope

northeurope
), the 
LogMessage
 column content is returned as "Scrubbed" due to EUDB data residency sanitization. This makes it impossible to search for or filter on any unique identifiers (resource IDs, trace IDs, correlation IDs, error messages, etc.) within log content, as 
LogMessage contains "..."
 filters match zero rows against the scrubbed text.
All other metadata columns (
PreciseTimeStamp

ContainerName

PodName

Tenant

AzureResourceId
, etc.) are returned intact — only the 
LogMessage
 content is redacted.
This significantly degrades the agent's ability to investigate incidents for EU-hosted resources, as DGrep log trace analysis is a core step in the investigation workflow. Non-EU regions are unaffected.

Thread ID
51fccda2-be32-427b-9c2a-d77b311052db

Steps to Reproduce
1. Use 
PerformDgrepSearch
 with the following parameters:
nameSpace:AzMonMetrics
eventName: ContainerLogV2
filters: Tenant=westeurope
startTime: 2026-04-07T19:09:00Z
endTime: 2026-04-07T19:11:00Z
serverQuery: 
source | project PreciseTimeStamp, LogMessage, ContainerName, PodName | take 5
2. Observe that rows are returned but LogMessage shows "Scrubbed" for every row.
3. Now try filtering: change serverQuery to 
source | where LogMessage contains "cosmos-dti-weu-dev" | project PreciseTimeStamp, LogMessage | take 50
4. Observe 0 rows returned — the filter cannot match against scrubbed content.
5. Repeat the same queries with any non-EU region (e.g., Tenant=westus3) to confirm LogMessage content is returned normally there.

Expected Behavior
The DGrep connector should return unscrubbed 
LogMessage
 content for EU regions, the same as it does for non-EU regions. The Geneva EU portal (
portal-eu.microsoftgeneva.com
) provides access to unscrubbed EU logs — the connector should route EU region queries through the appropriate EU endpoint to return full log content.

Actual Behavior
LogMessage
 content is returned as the literal string "Scrubbed" for all rows in EU regions. All metadata columns are intact. Any 
LogMessage contains "..."
 filter returns 0 results, effectively blocking DGrep-based investigation for all EU-hosted resources.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the PerformDgrepSearch tool and the DGrep connector path that handles EU-region queries. Reproduce the provided westeurope and westus3 searches, then compare routing with the Geneva EU portal endpoint. Done means EU LogMessage content is returned unsrubbed and LogMessage contains filters can match it while metadata remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.