add support for blob container user delegation key sas for when keys on storage account are disabled

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change log
 
+## 09/05/2025
+
+- add support for container-scoped user delegation SAS (skip account-level container enumeration to prevent 403 AuthorizationFailure)
+- parse and expose user delegation key parameters (skt, ske, sktid, skoid) in `SasParameters`
+- adjust `BlobManager.Connect` / `EnumerateContainers` logic to validate single container when using user delegation SAS
+
 ## 08/20/2025
 
 - fix deprecated GitHub Actions: upgrade upload-artifact from v1 to v4 and checkout from v1 to v4

kusto/functions/sflogs/base/ExtendTableRetentionByDays.csl

@@ -0,0 +1,12 @@
+.create-or-alter function with (docstring = "[tableName:string] - Name of the table to modify retention for, [daysToExtend:int] - Number of days to extend retention from current date. Usage: sflogs.base.ExtendTableRetentionByDays('MyTable', 30)", folder = "sflogs/base")
+    ExtendTableRetentionByDays(tableName:string, daysToExtend:int) {
+    let currentTime = now();
+    let retentionDate = currentTime + (daysToExtend * 1d);
+    // Generate the management command
+    print strcat(
+        ".alter table ['", tableName, "'] policy retention ",
+        "```{\"SoftDeletePeriod\": \"", 
+        format_timespan(retentionDate - currentTime, "d.hh:mm:ss"),
+        "\", \"Recoverability\": \"Enabled\"}```"
+    )
+}

kusto/functions/sflogs/base/ExtendTableRetentionToDate.csl

@@ -0,0 +1,11 @@
+.create-or-alter function with (docstring = "[tableName:string] - Name of the table to modify retention for, [extensionDate:datetime] - Specific date until which to retain data. Usage: sflogs.base.ExtendTableRetentionToDate('MyTable', datetime('2025-12-31'))", folder = "sflogs/base")
+    ExtendTableRetentionToDate(tableName:string, extensionDate:datetime) {
+    let currentTime = now();    
+    // Generate the management command
+    print strcat(
+        ".alter table ['", tableName, "'] policy retention ",
+        "```{\"SoftDeletePeriod\": \"", 
+        format_timespan(extensionDate - currentTime, "d.hh:mm:ss"),
+        "\", \"Recoverability\": \"Enabled\"}```"
+    )
+}

kusto/functions/sflogs/base/GetTableRetentionCommand.csl

@@ -0,0 +1,8 @@
+.create-or-alter function with (docstring = "[tableName:string] - Name of the table to query retention policy for. Returns JSON with key retention fields. Usage: sflogs.base.GetTableRetentionCommand('MyTable')", folder = "sflogs/base")
+    GetTableRetentionCommand(tableName:string) {
+    // Generate KQL query that returns JSON with essential retention info
+    print KQLQuery = strcat(
+        ".show table ['", tableName, "'] details | project MinExtentsCreationTime, RetentionPolicy;\n"
+    ),
+    Note = "Copy and run the KQLQuery to get response with Creation and Expiration Days. Use ExtendTableRetentionToDate or ExtendTableRetentionByDays to modify"
+}

kusto/functions/sflogs/errors/TraceFalsePositiveTabular.csl

@@ -107,6 +107,7 @@
         // add false positive signatures here using one of the provided functions in format issue description, string pattern, string pattern
         // use *Matches (regex) only when needed as it is remarkably slower
             | invoke TextContains("normal ctrl-c process exit", "terminated with exit code 3221225786")
+            | invoke TextContains("error should be ignored", "ignoring error")
             | invoke TypeAndTextIMatches("normal application / process exit by service fabric abort", "Hosting", "exitcode\\s?=?\\s?7148")
             | invoke TypeAndTextIMatches("normal application / process exit by service fabric deactivate", "Hosting", "ExitCode\\s?=?\\s?7147")
             | invoke TextContains("normal connection close", "FABRIC_E_CONNECTION_CLOSED_BY_REMOTE_END")
@@ -139,4 +140,5 @@
             | invoke TypeAndTextContains("only issue if using docker.","Hosting.DockerProcessManager","StopDockerNtService: ShutdownDockerService() returned with ErrorCode=FABRIC_E_SERVICE_DOES_NOT_EXIST.")
             | invoke TypeAndTextContains("only issue if using docker.","Hosting.ContainerHelper","Container Log Root not found at:")
             | invoke TypeAndTextContains("only issue if using docker.","Hosting.ContainerActivator","OnContainerServiceStarted: ErrorCode=FABRIC_E_SERVICE_DOES_NOT_EXIST")
+            | invoke TypeAndTextContains("common warning that usually is noise","ASYNC_REQUEST","An Async request was failed")
     }

kusto/functions/sflogs/errors/TraceKnownIssue.csl

@@ -243,5 +243,6 @@
         TypeContains(T, "possible FM deadlock issue. queue full.","FM.QueueFull_Failure"),
         TypeAndTextContains(T, "customer application code issue.", "Api.Finish", "Error = 2148734227"),
         TypeAndTextContains(T, "certificate revoked", "Transport.SecurityContext", "FABRIC_E_CONNECTION_DENIED: 0x80092010"),
-        TypeAndTextContains(T, "possible issue if file:StartStopNode.txt is present on node. file will cause node to be in a Status == Down and HealthState == Error", "TestabilityComponent.NodeTestabilitySubsystem", "Killing node on command RestartNode")
+        TypeAndTextContains(T, "possible issue if file:StartStopNode.txt is present on node. file will cause node to be in a Status == Down and HealthState == Error", "TestabilityComponent.NodeTestabilitySubsystem", "Killing node on command RestartNode"),
+        TypeAndTextContains(T, "client application initiated an abort", "Transport.Connection", "0x80072745")
     }