Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Installing in SCOM?

    Totally confused by the SCOM installation.. If I click setup it just takes me to a download for SCOM2012 SP1 UR6. I currently have UR5 so I should have Advisor? What is strange though is looking back UR2 seemed to have the 2 MP files required but after that only "internal". Do I need the 2 original files from UR2 as the updated MP directory gets wiped after each UR?
    Basically I am not seeing the Advisor section in SCOM

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    On SP1, you also need to import the Advisor Connector MPs from here http://www.microsoft.com/en-us/download/details.aspx?id=38199

    and then when you patch – we recommend you move on to UR6 or better UR7 as we fixed various bugs and you’ll stumble into issues with proxies otherwise.
    when installing SCOM patches, windows installer infrastructure is not able to auto-import MPs. Hence update MPs (also for Advisor) are provided as part of the update rollup and just copied in a folder on the MS – you then need to import manually. See UR7 instructions http://support.microsoft.com/kb/2965420
    The Update Rollups are ‘rollups’ – so they are cumulative patches – latest is always best.

    We updated the instructions page https://preview.systemcenteradvisor.com/instructions and various TechNet places in this sense.

  2. How does one find out which servers are gateways?

    In the old version, finding out the server gateways and server agents was an easy task. Unsure how to gather this information in the current version. Is there a way to do this.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Check under the ‘Daily Data Usage’ on the overview screen, we talked about this here http://blogs.technet.com/b/momteam/archive/2014/07/25/system-center-advisor-limited-preview-saved-searches-cloud-attach-status-and-usage-and-more.aspx

    and check this other idea http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519184-make-advisor-limited-preview-work-with-mma-agents

    I am closing this – please let me know if you need more info about this. Also answered your other thread with the search queries to look for when data was last sent by each machine http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519275-how-does-one-view-a-list-of-servers-that-are-not-r

  3. SSL error event ID 2129

    Hi

    I have setup advisor with assistance from a PFE, but seem to be having issues in getting it to talk back. I can see this error in the event logs on the SCOM management server. The server is using a proxy to communicate out and ports 80 and 443 are enabled on it. The proxy is configured to allow all traffic through it, so any site can be access via it.

    The health service HTTP module in management group "management group name removed" failed to connect to service. The service can be offline or an incompatible SSL protocol was…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    I would have suggested all the steps you mention. But notice that the module is saying ‘proxy provided .’ – and doesn’t say which one it is…

    Are you running UR3? If not, you should, or you should still use the NETSH WINHTTP PROXY global setting on the MS’s.

    Once on UR3 (see this http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519268-not-all-data-this-is-transfered-to-advisor-uses-th ) there is a rule used to ‘sync’ the ‘global’ proxy setting to a location where the healthservice can access it.

    Check the version of
    Microsoft.IntelligencePacks.Types Microsoft System Center Advisor Types Library

  4. Event ID 55011 Communication Error

    Recently setup the advisor connection and I started getting the event ID 55011:
    Failed to synchronize alerts from Advisor Cloud service to the Management Server because of an communication error. Wait for the next cycle to retry. Reason: Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationSecurityException: Message security was invalid for the connection with web service when performing Get Alert Update ---> System.ServiceModel.Security.MessageSecurityException: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. ---> System.ServiceModel.FaultException: ID3242: The security token could not be authenticated or authorized.

    Not sure what to do to resolve this. Any help…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  5. My Capacity Planner is reporting in progress, System Update Assessment is performing assessment and malware Assessment is connecting data

    My Capacity Planner is reporting in progress, System Update Assessment is performing assessment and Malware Assessment is connecting your data. This has not changed in 3 weeks. The only thing that works is configuration assessment..

    Any ideas...?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    There has been no activity on this thread for over 20 days, I assume some of the steps indicated below addressed the issue.

    There was a service-side bug at the time you posted this that prevented Malware and Update Assessment data indexing, but has been addressed back then in July (this left a 3 days gap in malware and updates data around that time).

    But if nothing helped and you are still in trouble with this, plase let us know and we can set up an online meeting to work thru onboarding with you and troubleshoot this in the next few days. Let us know.


    Suggested resolution steps/things to check:

    Please check this blog post that contains a lot of information on how to troubleshoot onpremises connectivity http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx
    Don’t be mis-led by the title, that is just the most common error, but there are a lot of troubleshooting info in…

  6. The Capacity Planning, System Update and Malware assessment doesnt work

    The Capacity Planning, System Update and Malware assessment doesnt work

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Can you be a bit more specific about what “doesn’t work” – i.e. what do you see, what troubleshooting steps have you already done… ?
    Have you looked at the other trheads in the forum? i.e. ‘capacity’ has a prerequisite of having VMM integrated with OM http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519243-capacity-intelligence-pack-does-not-work-if-scom-v

    Malware also has pre-requisites http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519202-what-antivirus-products-does-the-malware-assessmen

    Also, if it is an issue with connectivity, have you read this blog post with troubleshooting steps http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    I am closing this topic as there has not been any activity in almost 2 months.

  7. Having an issue connecting to Advisor service from SCOM, event 55034

    Advisor has been working perfectly, started getting errors after applying UR2 on SCOM 2012 R2. Get Event 55034, following is head text from the details on it. Have verified no proxy is setup per other threads.

    Failed to synchronize alerts from the Management Server to Advisor because of a communication error with service. Wait for the next cycle to retry. Reason: Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationException: Unable to communicate successfully with web service when performing Post Alert Change. ---> System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://service.systemcenteradvisor.com/IdentityProvider/IdentityProviderService.svc. This could be due to the fact that the server certificate is not…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Check weird SSL settings in IE and in the registry.
    Another user has hit this with the ‘preview’ channel, see his blog http://jacobbenson.com/?p=511

    I believe this was the issue in this case:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA] “Enabled”=dword:00000000

    If your server is in this state, it is likely that also Windows Update agent might be broken for the same reason. This should fix both.

  8. Failed to download the latest Advisor management Packs from Advisor Cloud

    Proxy has been configured and URLs are allowed but getting the following error:
    Failed to download the latest Advisor Management Packs from Advisor Cloud service. Reason: System.Net.WebException: The remote server returned an error: (403) Forbidden. at System.Net.WebClient.DownloadFile(Uri address, String fileName) at Microsoft.SystemCenter.Advisor.ImportMPWriteAction.DownloadManagementPackFromCloud(Uri uri) at Microsoft.SystemCenter.Advisor.ImportMPWriteAction.OnNewDataItems(MPUpdateInfo[] dataItems, Boolean logicalSet, DataItemAcknowledgementCallback acknowledgedCallback, Object acknowledgedState, DataItemProcessingCompleteCallback completionCallback, Object completionState)

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  9. Not be dependent on .Net 2/3

    2012R2 servers work well with just .Net4.5 so shame to impose extra install (esp given the multitude and size of .Net2 updates/patches) on a clean server.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  10. Cannot register with Advisor SC2012R2 UR2

    I have OpsMgr2012R2 and just updated to UR2. Advisor was never configured prior to this. When I attempt to Register, I continuously receive the "Error 3000: Unable to register to Advisor Service, Please contact the system administrator". Connectivity is fine because I'm able to log into the portal through the wizard, and if I choose a new Advisor account name, it gets created but just won't complete the check in. Advisor portal shows the two Accounts I've created, but no Management Group connected with them yet.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  11. Timeout connecting to preview

    Receiving this error every few minutes:

    The health service HTTP module in management group timed out connecting to url (https://ods.systemcenteradvisor.com/GenericEventDataService.svc/PostDataItems).

    Also receiving workflow errors:

    A subscriber data source in management group has posted items to the workflow, but has not received a response in 52 minutes. Data will be queued to disk until a response has been received. This indicates a performance or functional problem with the workflow.
    Workflow Id : Microsoft.SystemCenter.CollectGenericEventDataToCloud

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Most common reason is you have to pass thru a proxy – see this other thread about it http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519268-not-all-data-this-is-transfered-to-advisor-uses-th

    We have also just shipped one new library tat comes down with intelligence packs core – ‘Microsoft.IntelligencePacks.Advisor.Monitoring’ which contains SCOM monitors to watch for those error conditions and alert you with actionable KB associated to resolve this type of connectivity issues.

  12. Advisorsetup.exe crashes

    I have a SC2012 R2 environment running on Server 2012 (Virtual) when I want to run the advisorsetup.exe, as an admin, from local disk, I consistently am getting the following;
    Problem Event Name: APPCRASH
    Application Name: AdvisorSetup.exe
    Application Version: 1.1.2917.0
    Application Timestamp: 52280198
    Fault Module Name: KERNELBASE.dll
    Fault Module Version: 6.2.9200.16384
    Fault Module Timestamp: 5010ab2d
    Exception Code: e0434f4d
    Exception Offset: 00000000000189cc
    OS Version: 6.2.9200.2.0.0.400.8
    Locale ID: 1033

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The new features in System Center Advisor – Limited Preview require to have System Center Operations Manager (SCOM) product to be installed in your environment.
    OpsMgr is a on premise product and part of System Center R2 suite, and System Center Advisor is an attached service to OpsMgr at this point.

    There is an other idea that you can vote on, about supporting ‘standalone’ agents without OpsMgr http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519184-make-advisor-limited-preview-work-with-mma-agents

  13. Not all data this is transfered to Advisor uses the proxy that is enter in the Operations Manager Console

    When you are using proxy server to send data to Advisor proxy server has to be set in the Operations Manager console and also on the Management server trough command (netsh winhttp set proxy myproxy:80) in order to Advisor to be able to send all data. Data to Intelligence packs is send only if you execute netsh winhttp set proxy myproxy:80 on the management server. After entering the command restart of the health service on the management server is required.
    Please Advisor consistent to use the proxy that is entered in the Operations console for all features.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    This is a two-parts fix: one was in the module that is embedded in one of the ‘core’ intelligence pack libraries. This one has been fixed in June.

    The second fix is in on of the modules that ship with Operations Manager, and is included in SC2012SP1 UR7 and SC2012R2 UR3.

    This should work automatically now that we have re-published one of the ‘core’ intelligent packs.

    If on older patch levels, the workaround you explained would work to unblock the data flow.

    We are also creating some SCOM monitors that will self-monitor the connection and alert you with actionable KB associated to resolve this type of connectivity issues.

  14. Make Advisor Limited Preview work with MMA agents (direct Windows attach), not requiring SCOM

    Right now most of Advisor Limited Preview's new features and Intelligence packs do not work with Advisor gateways. The preview features are only supported when in 'attach' with System Center 2012 SP1 (or R2) - Operations Manager.

    At the same time we have heard from many of you that the legacy Advisor gateways were cumbersome to manage and served no real purpose – it was just an extra machine to manage.

    We have work going on to provide APPLICATION-SPECIFIC proxy setting (including auth) for standalone MMA Agents, and the next step is to let them connect to Advisor service directly…

    19 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Standalone MMA agents can now report to OpInsights directly, as an alternative or complement for the Operations Manager attach mode, and to cover Hybrid topologies.

    The Capacity IP has additional pre-requisites in System Center-land (VMM/OM integration) hence still only works with System Center attach.

    The ‘legacy’ Configuration Assessment from the old Advisor service is also not provided for Direct Agent.

2 Next →
  • Don't see your idea?

Feedback and Knowledge Base