BEC and false network timeout fixes

Author: Zacgoose

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1

@@ -20,34 +20,41 @@ function Push-BECRun {
         $startDate = (Get-Date).AddDays(-7).ToUniversalTime()
         $endDate = (Get-Date)
         Write-Information 'Getting audit logs'
-        $auditLog = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AdminAuditLogConfig').UnifiedAuditLogIngestionEnabled
-        $7dayslog = if ($auditLog -eq $false) {
-            $ExtractResult = 'AuditLog is disabled. Cannot perform full analysis'
-        } else {
-            $sessionid = Get-Random -Minimum 10000 -Maximum 99999
-            $operations = @(
-                'Remove-MailboxPermission',
-                'Add-MailboxPermission',
-                'UpdateCalendarDelegation',
-                'AddFolderPermissions',
-                'MailboxLogin',
-                'UserLoggedIn'
-            )
-            $startDate = (Get-Date).AddDays(-7)
-            $endDate = (Get-Date)
-            $SearchParam = @{
-                SessionCommand = 'ReturnLargeSet'
-                Operations     = $operations
-                sessionid      = $sessionid
-                startDate      = $startDate
-                endDate        = $endDate
+        try {
+            $auditLog = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AdminAuditLogConfig').UnifiedAuditLogIngestionEnabled
+            $7dayslog = if ($auditLog -eq $false) {
+                $ExtractResult = 'AuditLog is disabled. Cannot perform full analysis'
+            } else {
+                $sessionid = Get-Random -Minimum 10000 -Maximum 99999
+                $operations = @(
+                    'Remove-MailboxPermission',
+                    'Add-MailboxPermission',
+                    'UpdateCalendarDelegation',
+                    'AddFolderPermissions',
+                    'MailboxLogin',
+                    'UserLoggedIn'
+                )
+                $startDate = (Get-Date).AddDays(-7)
+                $endDate = (Get-Date)
+                $SearchParam = @{
+                    SessionCommand = 'ReturnLargeSet'
+                    Operations     = $operations
+                    sessionid      = $sessionid
+                    startDate      = $startDate
+                    endDate        = $endDate
+                }
+                do {
+                    $logsTenant = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-unifiedAuditLog' -cmdParams $SearchParam -Anchor $Username
+                    Write-Information "Retrieved $($logsTenant.count) logs"
+                    $logsTenant
+                } while ($LogsTenant.count % 5000 -eq 0 -and $LogsTenant.count -ne 0)
+                $ExtractResult = 'Successfully extracted logs from auditlog'
             }
-            do {
-                New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-unifiedAuditLog' -cmdParams $SearchParam -Anchor $Username
-                Write-Information "Retrieved $($logsTenant.count) logs"
-                $logsTenant
-            } while ($LogsTenant.count % 5000 -eq 0 -and $LogsTenant.count -ne 0)
-            $ExtractResult = 'Successfully extracted logs from auditlog'
+        } catch {
+            $7dayslog = @()
+            $CippAuditError = Get-CippException -Exception $_
+            $ExtractResult = "Could not retrieve audit logs: $($CippAuditError.NormalizedError)"
+            Write-LogMessage -API 'BECRun' -message "Failed to retrieve audit logs for $($UserName): $($CippAuditError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippAuditError
         }
         Write-Information 'Getting last sign-in'
         try {

Shared/CIPPSharp/CIPPRestClient.cs

@@ -684,6 +684,27 @@ public static async Task<HttpResult> SendAsync(
             {
                 response = await client.SendAsync(request, token).ConfigureAwait(false);
             }
+            catch (OperationCanceledException) when (cts is not null && cts.IsCancellationRequested)
+            {
+                // Our per-request timeout CTS actually fired — this is a genuine
+                // client-side timeout after timeoutSec. Let it propagate as an
+                // OperationCanceledException so the PowerShell wrapper reports it
+                // as a timeout (and the "timed out after {timeoutSec}s" message is true).
+                TrackTransportError(selection.Pool);
+                throw;
+            }
+            catch (OperationCanceledException ex)
+            {
+                // Cancellation was NOT triggered by our timeout token. The server
+                // reset/closed the request before our timeout elapsed — common for
+                // slow EXO InvokeCommand cmdlets (Search-UnifiedAuditLog,
+                // Get-MessageTraceV2) which the service cuts off well under 100s.
+                // Surface it as a transport error so it is not mislabeled as a
+                // client timeout and is correctly treated as a retryable failure.
+                TrackTransportError(selection.Pool);
+                throw new HttpRequestException(
+                    $"The request to '{uri}' was canceled by the server before completing.", ex);
+            }
             catch
             {
                 TrackTransportError(selection.Pool);