---
title: Troubleshoot Azure VNet Flow Logs monitoring
source: https://docs.newrelic.com/docs/network-performance-monitoring/troubleshooting/azure-vnet-flow-logs
---

If you've [set up Azure VNet Flow Logs monitoring](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/cloud-flow-logs/azure-vnet-flow-log-monitoring) and are running into problems, use the following sections to diagnose common issues with the VNet Flow Logs Forwarder.

## No flow log data in New Relic [#no-data]

If flow log data isn't appearing in New Relic, check the following:

-   Confirm that `NR_LICENSE_KEY` is correctly configured.
-   Check that VNet Flow Logs are enabled and actively writing PT1H.json blobs to your storage account.
-   Verify the Event Grid subscription is active and routing `BlobCreated` events to the Event Hub.
-   Confirm the `EVENTHUB_CONSUMER_CONNECTION` and `EVENTHUB_NAME` settings match the Event Hub receiving the events.
-   Check the Function App logs in Azure for errors. To see verbose logs, set the `AzureFunctionsJobHost__logging__logLevel__Function` app setting to `Debug`.

## Duplicate flow log records [#duplicate-data]

The cursor mechanism prevents duplicate processing under normal conditions. If you see duplicates, check the following:

-   Check that `CURSOR_STORAGE_CONNECTION` is correctly configured and the table is accessible.
-   Verify there's only one active instance of the consumer processing each Event Hub partition.

## Events being skipped (poison event protection) [#poison-events]

After `MAX_CONSECUTIVE_FAILURES` consecutive failures (default 5) processing the same blob, the forwarder marks it as a poison event and skips it to prevent infinite retries. Check the Function App logs for the root cause of the initial failures, fix the issue, and reset the cursor by deleting the corresponding row from the `nrvnetflowlogscursors` table. The forwarder retries New Relic delivery errors (429, 5xx, and retryable network errors) first. The failure counter only increments after those retries are exhausted or another hard failure occurs.