Salesforce connector runs out of memory

[amatasci]

Describe the bug
Depending on the amount of events to ingest, the Salesforce Function App can run out of memory and stop ingesting audit events

To Reproduce
Steps to reproduce the behavior:

1. Deploy the Sentinel Salesforce connector
2. Configure it to run daily
3. The function app will run every day and be end in an Error status
4. The error will be something like "Executed 'Functions.SalesforceSentinelConnector' (Failed, Id=4a05cd16-e314-4a2e-ae28-xxxxxxxxx, Duration=84034ms)". After opening a support case (#2412090050003338) it has been confirmed that the issue is related to the function running out of memory

Expected behavior
The function app should ingest all events regardless of the number and without running out of memory

Screenshots

[v-sudkharat]

Hi @amatasci, Thanks for flagging this issue. Could you please let us know what's your current plan for function app? And to address out of memory issue you can update the function app plan to Premium app service plan.
Here is a doc which can help to upgrade the plan - https://learn.microsoft.com/en-us/azure/azure-functions/functions-premium-plan?tabs=portal

[amatasci]

Hello, we have a Dynamic / Y1 plan, this is the default one created during the deployment of the connector.
How can we modify it to a Premium one?

[v-sudkharat]

@amatasci, Do you able to upgrade from below shared one ? -

[v-sudkharat]

@amatasci -
1 :

2:

[amatasci]

This possibility isn't available, all options are grayed out

[v-sudkharat]

@amatasci, Is the raised support case are still open? Actually, this upgradation for existing app service needs to be check by the function app team.

[amatasci]

No, MS support closed it because they said it's not a Function App issue

[v-sudkharat]

@amatasci,
The current existing deployed function app which contains consumption plan does not support the upgrade, so creation of new function app with premium plan helps you to get unblocked from this issue.

You can follow the below shared doc to create a function app manually by selecting the plan according to your requirement:-

• https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-function-app-portal?pivots=programming-language-python

Please go through the below doc for Function App plans with pricing details: -
https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale?WT.mc_id=AZ-MVP-5003203#overview-of-plans

Additionally,
We have updated the below ARM template in which the plan has been upgraded to the PremiumV2 but unable to test it due permission / credentials required.
If you have any Testing Environment (Not production), could you please deploy the below shared ARM template by using custom deployment and check for the connector working status -
ARM template file : - azuredeploy_Connector_Salesforce_Service_Cloud_AzureFunction.json

To custom deploy this template :-
a. Search Custom deployment in azure home page :

b. Select it and past the above ARM template content in custom deployment page :-

c.

Note that, Please do change the function app name while deployment of function in same resource group where old fun app has been already deployed to avoid the existing function override.

Once this function app gets deployed successfully, kindly monitor the logs flow and let us know if you get error.

Many thanks!