Azure Monitor-Log Analytics
Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS
- For general discussion/question and answers (not ideas and bug reports) use the MSDN Forum
- Onboarding issues? Read this troubleshooting guide
- How do I do XYZ? Try our documentation
- Customers with Premier support can log support cases via Premier
- Customers with Azure support agreements can log support cases in the Azure portal
-
OMS agent for macOS
I'd like to be able to push syslog and other data data from macOS to Log Analytics, however there is not OMS agent for macOS.
114 votes -
Fix Bug in Agent
We started seeing this error after installing the OMS agent on our servers.
An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425} was rejected.
A quick search on the internet shows other people have the same error after installing the OMS agent also.
109 votes8 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →We’re aware of an issue that can cause this error to be logged when the Update Assessment solution is installed.
You can check if this is what you’re seeing my temporarily removing the Update Assessment solution and confirming the errors stop.The Update Assessment solution functionality is not affected and you can safely ignore this error.
-
Request to add BMC Remedy partner type in ITSM Connection
Hi Team,
Could you please add BMC Remedy partner type in ITSM connection in LogicApps as this connection is not available which is commonly used tool in most of the software companies.
Adding this connector will help us to automatically creates remedy tickets whenever there is a failure in ADF or if any component reaches threshold limits93 votes4 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →Thanks for the valid suggestion. Your feedback is now open for the user community to upvote & comment on. This allows us to effectively prioritize your request against our existing feature backlog and also gives us insight into the potential impact of implementing the suggested feature.
-
Multihome agents
It would be fantastic if we could multihome agents to various workspaces.
Right now we use the SCOM agent to connect to OMS, which means one OMS workspace. But we would like to have multiple workspaces depending on type of server (eg Production servers, Dev servers, application servers etc).
I understand we can multihome OMS to different workspaces by multihoming the SCOM agent to different SCOM management groups, but having an entire management group set up just so agents can talk to different OMS workspaces is like swatting a fly with a sledgehammer.
Even if we can manually configure each…74 votes5 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →We support multi-homing for Windows agents:
https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/We are working on multihoming for Linux agents.
We are also working on support for multihoming with the Azure VM extension
-
Allow me to remove managed systems (Management Groups and Directly Connected Servers/Agents) from Usage page
Implements a feature to remove managed （ Management Groups and to Directly Connected Servers ） Overview Usage from want? I think even if servers Connected Directly, the agent is uninstalled, cannot be removed from Operational Insights Usage. Cannot disconnect in the SCOM Management Groups are for the Operational Insights on want to remove.
44 votes7 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →In the current implementation, Management groups CAN already be removed, but only once they are ‘stale’ == have not reported ANY data for >14days, the link to remove will appear.
The number of Directly reporting agents in ‘settings’ page is the actual number of servers registered, but the drill down will take you to search (where servers presence is inferred from the data).
We will be working on options to de-register directly connected servers, similarly to we offer for SCOM management groups.
-
Disable Agent Data Collection from OMS Portal
Allow to enable/disable/schedule data collection of specific agents. This allows keeping data volume down during tests (e.g. pen or security testing) that might generate lots of events that could you go over the licensed data collection threshold. Maybe combinable with OMS Alert supression.
31 votes -
Surface hub cannot connect to OMS using a proxy
we documented at https://technet.microsoft.com/en-us/itpro/surface-hub/monitor-surface-hub?f=255&MSPPError=-2147217396:
Note
Surface Hub does not currently support the use of a proxy server to communicate with the OMS service.However, in most customer environment a proxy cannot be bypassed. This limitiation must be changed to allow the SurfaceHub OMS Agent to communicate with the OMS Workspace over a Proxy.
25 votes -
Display of supported service tags
The below docment is the network requirements for using the Log Analytics agent. However, there is no description of service tags to use Log Analytics agent.
On the other hand, the service tag is described below, but it is inaccurate and difficult to understand.
https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags
Currently, I think we can communicate between Agent and Log Analytics workspace with the following service tags.
However, especially, "GuestAndHybridManagement" is not listed on the service tag or network requirements docments.
-AzureMonitor
-Storage
-GuestAndHybridManagementI would like to check the service tag as official information. Please descrive the service tag for using the Log…
23 votes -
Push\Install of Microsoft Monitoring Agent from OMS
If you really want this to be used for stand alone clients, which I think is a great idea for the hybrid cloud, there needs to be an easier way to get the agent installed on those devices.
19 votes3 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →Do you have a tool today that you use for deploying software? What are the drawbacks to using it to deploy the MMA?
-
Allow to deploy agent using GPO
I know there is way to deploy agent with workspace details but this requires to use the setup.exe file
Can you please provide a way to deploy with GPO?
thanks14 votes2 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →You have a few options today:
- startup scripts from GPO’s would be the most generic way to install and configure the agent. Command line to silent install as well as script snippets on how to enable/disable/configure thru COM API are documented here https://azure.microsoft.com/en-us/documentation/articles/operational-insights-direct-agent/
- Powershell magazine came up with a DSC module that allows you to install the agent that way http://www.powershellmagazine.com/2014/11/26/dsc-resource-module-for-microsoft-monitoring-agent-install-and-configuration-for-azure-operational-insights/
- if the machines are in Azure, there is a VM extension http://azure.microsoft.com/en-us/updates/easily-enable-operational-insights-for-azure-virtual-machines/
-
Multiple data destinations for Linux agent
The Windows agent can be multihomed to send data to multiple Log Analytics workspaces. The Linux agent can send to only a single destination, either a workspace or management group. It would be a great enhancement if we could configure the Linux agent to report to multiple workspaces.
13 votes -
SCOM-OMS prerequisites checker tool
Tool which can be used to do prerequisite check for connection between Agent/MS and OMS.
Based on firewall requirements:
https://technet.microsoft.com/en-us/library/mt484101.aspx
including option for Proxy server and Proxy user account.
It would be a great help for deployment and troubleshooting scenarios.13 votes -
The health service HTTP module exceeded number of attempts to post data
Trying to configure the OMS/SCOM integration.. but the above error comes into the eventlog.. in the PerfMon i see continuous spikes of the system trying to send data..
not sure if the URL is correct.. but unknown where to configure it:
The health service HTTP module exceeded number of attempts to post data URL: https://.ods.opinsights.azure.com/ProtectionStatusDataService.svc/PostDataItems. Dropping data batch.System
- Provider
[ Name] HealthService
- EventID 2136
[ Qualifiers] 32768
Level 2
Task 0
Keywords 0x80000000000000
11 votes -
Control when Advisor MPs are downloaded
We need to control when Advisor MPs are introduced to our environment to prevent possible outages during production business hours. It would be nice to set a maintenance windows to control when changes are introduces. It would also be beneficial to be able to introduce the MPs to pre-Prod prior to Prod environments.
10 votes0 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →Hi, we are discussing this internally.
Today you have a way to do this, by overriding the rules that perform MP/IP download and import – there is an override MP here http://blogs.technet.com/b/momteam/archive/2015/02/06/notice-upcoming-url-change-for-opsmgr-reporting-to-opinsights.aspx
- you could keep them turned off in PROD and leave them enabled in QA/TEST – once you see a new MP has been updated in the test environment, you can remove the override in prod/let the update run/then block it again.We are determining how to make this more polished.
Also see the similar idea http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/7161777-intelligence-pack-updates -
Update required for Amazon Linux to current version
Using OMS with Amazon Linux, last supported version is 2012.09 --> 2015.09 (x86/x64). Newer version of Amazon Linux required for reporting into OMS
9 votes -
Azure Operational Insights Onboarding Issues, Error 4200
I have been have some issues connecting my existing Operations Center install to Operational Insights. I had experimented with the very first version of operational insights and had subsequentially removed it after some initial testing, I have readded the management packs and tried to reconnect to a new workspace I have created but I get the following Error :
Error 4200: Unable to register to Operational Insights Service. Please contact the system administrator.
I do notice that some of the management packs are downloaded, but I also received a lot of error messages in my event logs.
The following messages…
8 votes0 comments · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →Error 4200 is “Unable To Save Settings”.
This means that registration and saving the certificate in the Runas profile in SCOM succeeded, but when we tried to save the other settings like urls and workspace Id – something failed there – these are just calls to SCOM SDK, so the underlying issue could be in the SCOM management system / database (maybe load related).The best first step to take for this investigation is to enable VERBOSE tracing to see what precisely fails – refer to the tracing article https://support.microsoft.com/en-us/kb/942864 (you might need to involve formal support channel to decipher this).
-
MSI-based Windows agent for Intune compatibility
OMS Windows agent as MSI installer rather than a .exe setup. This enables the agent to be directly deployable wo Windows 10 devices through Intune and OMA-DM.
8 votes -
Microsoft.IntelligencePacks.Advisor.Monitoring not importing.
I've just onboarded our SCOM 2012 R2 environment onto OMS and I'm continually receiving the following error. The Management group is UR7.
Failed to import the latest Advisor Management Packs to the Management Server. Reason: System.ArgumentException: The requested management pack is not valid. See inner exception for details.
Parameter name: managementPack ---> Microsoft.EnterpriseManagement.Common.ManagementPackException: Verification failed with 1 errors:
Error 1:
Found error in 2|Microsoft.IntelligencePacks.Advisor.Monitoring/31bf3856ad364e35|7.0.10038.0|Microsoft.IntelligencePacks.Advisor.Monitoring|| with message:
Could not load management pack [ID=Microsoft.IntelligencePacks.Monitoring, KeyToken=31bf3856ad364e35, Version=7.0.10038.0]. The management pack was not found in the store.
: An error occurred while loading management pack 3478205f-b521-8bc4-b69b-67ac2759516d from the database
---> Microsoft.EnterpriseManagement.Common.ManagementPackException: Could not load…
7 votes1 comment · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →Thanks for letting us know. I have created an incident regarding the issue.
-
Add Proxy property to Heartbeat data type
Please add a proxy property to the Heartbeat data type. It doesn't have to be the actual TCP socket, it can be a Y/N. Just something that can be queried to definitively identify if an agent has been configured to use a proxy.
Network changes within firewalled environments can result in agents being quietly cutoff from Log Analytics. When these events occur it may be weeks before someone notices in non-production environments. Hundreds of agents are affected at a time. Proxies are most often required in DMZ's where tcp/443 access to the internet is blocked.
The ability to query for…
7 votes1 comment · Agent Management (OnPrem components) / Connectivity / Setup · Flag idea as inappropriate… · Admin →Thanks for your feedback and its now open for the user community to upvote & comment on. This allows us to effectively prioritize your request against our existing feature backlog and also gives us insight into the potential impact of implementing the suggested feature.
-
OMS files should not be world writable
The agent creates the following world writable files when it runs.
/var/opt/microsoft/omsagent/.../state/contentlocationcache.cache
/var/opt/microsoft/omsagent/.../log/ODSIngestion.statusPer MS support, these 2 files can safely be changed to 664 permissions without impact to the the agent.
Having world writable files is a security vulnerability and this should be changed to use the lower permissions.6 votes
- Don't see your idea?