My managed instance's Extended Event stopped logging new events - what am I missing?

Question

I have an extended event running on a GP managed instance. This is the same one I'm using on-prem - it captures error_reported with severity > 10, keeps 10mb of history. Been using it for a year+ without problems on prem. In Azure, this week it stopped logging new events - I see 144 from yesterday ("Cannot insert duplicate key"), but nothing since then, even if I try select 1/0 (which will trigger it).

Am I missing something on my create? Or is this something specific to ring buffer on a managed instance? Or did I just hit a bug or something?

The event create:

CREATE EVENT SESSION
severity_10plus_errors_XE_memory
ON server
ADD EVENT sqlserver.error_reported
(
ACTION(package0.event_sequence,sqlserver.client_app_name,sqlserver.client_hostname,
sqlserver.database_id,sqlserver.sql_text,sqlserver.tsql_stack,sqlserver.username,
sqlserver.client_pid)
WHERE ([severity]> 10) 
)
    ADD TARGET
        package0.ring_buffer
            (SET
                max_memory = 10000  ) -- Units of KB.
WITH (MAX_DISPATCH_LATENCY = 60SECONDS,STARTUP_STATE = on)
GO

The DMVs:

"SELECT *
    FROM sys.dm_xe_session_targets        AS st  --For Azure SQL DB, use dm_xe_database_session_targets
    INNER JOIN sys.dm_xe_sessions       AS se --For Azure SQL DB, use dm_xe_database_sessions
         ON CAST(se.address AS BINARY(8)) = CAST(st.event_session_address AS BINARY(8))
WHERE
se.name = 'severity_10plus_errors_XE_memory' AND st.target_name = 'ring_buffer'"

Results in

bytes_written              : 0
address                    : {0, 0, 1, 160...}
name                       : severity_10plus_errors_XE_memory
pending_buffers            : 0
total_regular_buffers      : 3
regular_buffer_size        : 1441587
total_large_buffers        : 0
large_buffer_size          : 0
total_buffer_size          : 4324761
buffer_policy_flags        : 0
buffer_policy_desc         : drop_event
flags                      : 2049
flag_desc                  : flush_on_close
dropped_event_count        : 0
dropped_buffer_count       : 0
blocked_event_fire_time    : 0
create_time                : 4/28/2023 9:37:41 PM
largest_event_dropped_size : 0
session_source             : server
buffer_processed_count     : 2249
buffer_full_count          : 0
total_bytes_generated      : 290056170
total_target_memory        : 10240000

Answer 1

I suspect that output is being truncated. sys.dm_xe_session_targets has a hard limit of 4MB of formatted output while the ring buffer limit of 10MB you provided is the binary data. Therefore, you should never, under any circumstances, set that limit for the ring buffer to be more than 4MB and it should ideally be much smaller than that (maybe 1MB as an upper bound).

If you need more storage, you can use the event_file target or use a live target via QueryableXEventData or the XELite library. In the latter case, you can omit adding any target at all since the live event watching does not require it.