Cribl Stream Ingestion Issues with Azure Event Hubs After Cribl Cloud Upgrade

Symptom

Ingestion from Azure Event Hubs in Cribl Stream stops after a Cribl Cloud upgrade or other worker rollout. You may see errors similar to:

• SASL PLAIN authentication failed

• Not authorized to access topics: [Topic authorization failed]

Connection strings and secrets in Cribl still appear correct.

Environment

• Cribl Stream on Cribl Cloud (managed workers)
• Source: Azure Event Hubs
• Network: Outbound access to Azure Event Hubs is restricted (for example, firewall or network rules that allow-list source IP addresses)
• Observed on Cribl Stream 4.17.1 (symptom may occur on other versions when worker egress IPs change)

Resolution

1. In the Cribl Cloud UI, open Workspace (or Organization) settings and locate the egress IP addresses published for your workspace or worker group (the exact location depends on your UI version).
2. Record the current egress IPv4 addresses for the worker group that runs the Azure Event Hubs source.
3. On the Azure side (or your corporate firewall in front of Azure), open the rule set that restricts access to Azure Event Hubs (for example, network security group rules, firewall allow lists, or Event Hubs namespace/network restrictions).
4. Compare the allow-listed IPs to the current Cribl egress list from step 2.
5. If the lists differ, add any new egress IPs introduced by the upgrade or redeploy. Remove obsolete entries only when you are sure they are no longer in use.
6. Save the Azure or firewall changes and wait for propagation per your platform’s guidance.
7. In Cribl Stream, open Sources, select the Azure Event Hubs source, and use Test or Live Capture to confirm events flow again.
8. If your organization requires stable egress IPs long term (for example, change windows are costly), create a case with Cribl Support for assistance.

Cause

Cribl Cloud managed workers do not guarantee fixed egress IP addresses. IPs can change during upgrades, scaling events, or cloud maintenance.

When Azure (or an intermediate firewall) allows only a fixed set of source IPs, new worker IPs are blocked. The client may surface errors that resemble authentication or authorization failures (for example, SASL PLAIN or topic authorization), even when the underlying connection string and credentials are valid—because the connection never completes correctly through the restricted path.

Last Validated

• Cribl Stream 4.17.1 on Cribl Cloud

Additional Information

• Product documentation for the Azure Event Hubs source: see Azure Event Hubs in Cribl Stream Sources (use the current Docs URL for your Stream version).
• If symptoms persist after IP alignment, collect a diag bundle during the failure window and verify namespace policies, consumer groups, and RBAC on the Event Hubs resource in Azure—those are separate failure modes from egress IP drift.