failed to create Azure Logs client for subscription %s: %w

Error message

failed to create Azure Logs client for subscription %s: %w

What it means

RunQuery lazily creates an Azure Log Analytics client per subscription via CreateLogsClient and caches it in LogQueryClients. When client creation fails, this error wraps the underlying cause (almost always authentication/credential failure). It is returned while holding the clients mutex, which is unlocked before returning.

Source

Thrown at modules/azurelogs/query.go:61

	// Use read lock first to check if client exists
	clientsMutex.RLock()
	client := LogQueryClients[qf.SubscriptionID]
	clientsMapExists := LogQueryClients != nil
	clientsMutex.RUnlock()

	// If map doesn't exist or client doesn't exist, we need write access
	if !clientsMapExists || client == nil {
		clientsMutex.Lock()
		// Double-check after acquiring write lock (double-checked locking pattern)
		if LogQueryClients == nil {
			LogQueryClients = make(map[string]*azquery.LogsClient)
		}

		if LogQueryClients[qf.SubscriptionID] == nil {
			LogQueryClients[qf.SubscriptionID], err = CreateLogsClient(sess, qf.SubscriptionID)
			if err != nil {
				clientsMutex.Unlock()
				return nil, fmt.Errorf("failed to create Azure Logs client for subscription %s: %w", qf.SubscriptionID, err)
			}
		}
		client = LogQueryClients[qf.SubscriptionID]
		clientsMutex.Unlock()
	}

	res, err := client.QueryWorkspace(
		context.Background(),
		qf.WorkspaceID,
		azquery.Body{
			Query: to.Ptr(qf.Query),
		},
		nil)
	if err != nil {
		return nil, fmt.Errorf("failed to execute query on workspace %s: %w", qf.WorkspaceID, err)
	}

	if res.Error != nil {

View on GitHub (pinned to bb838c1ccb)

Solutions

Re-authenticate: run `az login` or set AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET env vars
Check the wrapped error (%w) for the exact credential failure and fix that source
Verify the subscription ID GUID is correct and the account has Reader (or Log Analytics Reader) access
If hosting in Azure, ensure the managed identity has the Log Analytics Reader role on the workspace

Example fix

// before: running locally with no credentials
// shell: ./azurelogs-runner
// after
// shell: az login && ./azurelogs-runner
// or export AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check credential availability
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
    return fmt.Errorf("no Azure credential available: %w", err)
}

Try / catch

tables, err := RunQuery(sess)
if err != nil {
    var ae *azidentity.AuthenticationFailedError
    if errors.As(err, &ae) {
        return fmt.Errorf("re-authenticate (az login / service principal): %w", err)
    }
    return err
}

Prevention

Run `az login` (or provision a service principal) before starting the app
Ensure the identity has Log Analytics Reader on the workspace
Monitor service-principal secret expiry and rotate proactively

When it happens

Trigger: RunQuery or fetchDataAsync on a subscription with no cached client where CreateLogsClient returns an error: missing/unreadable Azure credentials (az CLI not logged in, missing AZURE_* env vars), wrong tenant, or invalid subscription ID.

Common situations: DefaultAzureCredential finding no credential source (no az login, no managed identity, no AZURE_CLIENT_SECRET), expired az CLI login, or a typo'd subscription GUID.

Related errors

AI-assisted analysis of wtfutil/wtf@bb838c1ccb (2026-09-03). Data as JSON: /api/errors/3e90d1d6a905325f. Report an issue: GitHub.