Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Agent Installation on over 100 VM's

    If I would to monitor over 100 VM's in Azure/Onprem do i need to install an OMS agent on each VM for it to be monitored in OMS?

    Or would I be able to install the Log analytics forwarder service on one VM which can then pull information from other VM's?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  2. direct agent proxy setting is removed?

    Fighting now since one week on using direct agent connection without SCOM. After installing with proxy server details, server listed in my workplace, I see proxy information removed on all clients after one minute and no data collection more.

    https://support.microsoft.com/en-us/kb/3032946/ Agent hotfix not solving the issue as described.

    Proxy settings are added to the agent setup wizard.
    Users can now provide proxy settings while they complete the agent installation wizard.

    •Account validation steps are added to the wizard.
    After users enter an account and workspace to connect to Operational Insights, the wizard performs a test to verify that the account…

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  3. IE11 won't download the Operational Insights agent, flags it as a virus and deletes it

    When attempting the download the agent, IE downloads to 100% then flags the agent as a virus and deletes it. Error attached. Windows 8.1, IE 11.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Either a false positive with a specific version of the AV’s signatures or your DNS cache was under attack and you were being redirected elsewhere…

    We are not able to reproduce – the file we host in the cloud is valid, signed and not infected – and also in the reported case it was only happening on one machine of yours (not other ones).

  4. Advisor Rules Causing Events 1103 and 1206 for Sever 2003 R2

    I recently connected to Insights and the above rule causing Events 1103 and 1206 on just Server 2003 R2 servers.

    Rules:
    - Microsoft.IntelligencePacks.Types.HealthServiceProxyConfiguration
    - CollectAgentOptInFailures
    - Microsoft.SystemCenter.Advisor.Monitoring.ServerOptInOutRule
    - Microsoft.SystemCenter.Advisor.AgentHealth.ComputerOptInCompatibleMonitor

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Microsoft.IntelligencePacks.Types version 7.0.9793.0 has been released today, which fixes the first rule which made your agents go gray.

    Please note the comments about the other three rules, might be missing .Net dependency for Advisor Configuration Assessment ‘opt in’ rules.

  5. Windows Server 2003 'grey' due to missing Powershell system rule Microsoft.IntelligencePacks.Types.HealthServiceProxyConfiguration

    Hi

    I think there is a bug in the latest version of the Microsoft System Center Advisor Monitoring management packs.

    We still have a number of Windows 2003 Servers, most of them don't have powershell, but the rule "Advisor Proxy Setting Rule" seem to assume the presence of said PowerShell.

    I'm trying to override this, but I'm not sure how to do the in the most effective way.

    /Per

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  6. Support for Windows Client Operating Systems

    Currently, when I tried to onboard Windows Client computers (Windows 8.1 and Windows 10 Preview) via SCOM, I get this alert:
    "Event Description: The OS version for the selected computer does not support Advisor Attached Service. Advisor requires Windows Server 2008 or higher."
    I think having Windows client computers in OpInsights via existing SCOM management group would have a reasonable market demand (banks, retailers, etc,). OpInsights would be a good solution for archiving various logs on business critical desktops.
    I am not sure what is the reason not to support Windows client OS at the moment, but is this something…

    16 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  7. Error Logs from agents or opinsights

    I have received some informations about intelligent packs working directly with agents and without System Center Operations Manager. This is great for me. I migrated my servers to this formo f connection. But i don’t know why some servers cannot connect or not showed on the “Servers and Usage” in my Operations Insights.
    I would like to know if we have some way to see logs of agents or some place that will show me what’s the problem is occuring.
    Anyone could help me?

    Thanks!

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The following document has troubleshooting steps that you can use:
    http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    The first half of the document covers Operations Manager (which doesn’t apply to you) — you can skip down to the section that starts “Procedure 2: Validate if the right Intelligence Packs get downloaded to your Direct Agent”

    The list of intelligence packs that work without Operations Manager are documented here:
    http://msdn.microsoft.com/en-us/library/azure/dn873979.aspx

    The latest version of the agent also features a ‘connectivity check’ that validates the wokspaceid and key provided during configuration.

  8. Provide on the monitoring agent a test connection function to OI

    Provide on the monitoring agent a test connection function to OI

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  9. No Servers Connected, yet I have SQL data

    I installed the agent on a single server 24hours ago and I am still waiting for it to show in the Connected Servers area. However, i do have data/recommendations for the SQL Server Assessment pack.

    Is it likely that there is something wrong, or should I continue to wait?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Hi Dan — if you are getting data for the server from the SQL Server Assessment IP, then this means data is flowing correctly.
    I am currently seeing the “Servers Connected Directly” tile take several seconds to update with data — is your tile also slow to update? You can also run the following query to confirm if data is coming from the agent:

    • | Measure Max(TimeGenerated) as LastData by Computer | Sort Computer


    Closing as there has not been any activity for almost 4 weeks. Let us know if you still need help with this.

  10. Failed to uninstall Performance counter when removing MMA

    Uninstalling the Monitoring Agent results in the error attached for some unknown reason.
    Background info: the Agent was connected to an old SCOM Server with Advisor, I was able to change the SCOM Management Group but Advisor wouldn't install/register due to the Agent seeing that Advisor was setup before on the machine

    We need to be able to change the Ops Insight SCOM Management Group or be able to at least uninstall the agent fully to allow movement between old SCOM and new SCOM deployments. My only option left is to reinstall the OS

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Only info we found related to this are to FULLY rebuild perf counters as described here http://support.microsoft.com/kb/2554336
    In some cases we have seen some .Net issue with managed counters, this blog mentions installing .net 3.5 http://pkjayan.wordpress.com/2012/10/15/unable-to-install-system-center-operations-manager-2012-agent-on-windows-server-2012/

    Rather than un-installing the agent, if moving across management group and advisor does not enroll on the new MG, you can clear that advisor registration information from the registry like described here https://social.msdn.microsoft.com/Forums/azure/en-US/8e0ffa61-68a0-4669-a729-ae4cd67cffbc/advisor-connector-enable-status-monitor-failed-to-enable-advisor-connector?forum=opinsights

    If that doesn’t help, this should be standard ‘SCOM’ agents and supported thru CSS.

  11. HealthService 2129 - https://ods.systemcenteradvisor.com/DiagnosticsDataService.svc/PostDataItems

    To access Internet, my SCOM Management Servers need to go through a proxy. Each different URL must be explicitly declare one by one. I used the above blog article to declare the whole list.
    But I still get many errors like the HealthService 2129:
    The health service HTTP module in management group "***" failed to connect to service. The service can be offline or an incompatible SSL protocol was encountered.
    Provided configuration:

    Service Url https://ods.systemcenteradvisor.com/DiagnosticsDataService.svc/PostDataItems.

    When I try to browse this URL in IE, I do not get anything but at least I am able to confirm it is…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Closing this as there has been no activity for 2 months. Please let us know if you still need additional help. I am leaving the info below for additional people might find them useful when troubleshooting the same.


    Do you only see this for DiagnosticsDataService.svc ? or also for other service endpoints?

    Is you are on 2012SP1UR7 or 2012R2UR3 or above you only need to set the ‘global’ proxy for Advisor – it will be copied to a location for the MS to use in all workflows. Before that patch level you had to set it manually on each machine.
    Anyhow, Event ID 2129 is quite specific about SSL negotiation, so I don’t think the proxy settings are the issue here.

    Have you seen this announcement? http://redmondmag.com/articles/2014/10/29/disable-ssl-3-support.aspx
    I have not confirmed, but it’s likely that our roles in Azure are automatically updated as part of the OS patching and support…

  12. Support for Windows 2003 and 2008 servers (32-bit agent)

    Hi

    We still have some 32-bit servers (Windows Server 2003, but mostly Windows Server 2008). Currently there is only an agent for 64-bit servers. We would like to monitor our 32-bit servers as well and would like to have an agent for these.

    Thanks
    Toon

    12 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    We do have the 32bit SCOM agent http://technet.microsoft.com/en-us/library/dn281931.aspx

    For Direct Agent, this is now available for download http://blogs.technet.com/b/momteam/archive/2015/06/24/oms-agent-now-supports-w2k8-sp1-os-and-32bit-systems.aspx

    This is for 2008SP1, anyhow, not 2003 – 2003 goes completely out of support in July – http://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/

    Also, some of the solutions might still need to be tweaked to work on downlevel OS with direct agent) or have higher pre-requisites (.net framework, etc).

  13. Monitoring Agent silent / unattended install

    Info on silent or command line install of Microsoft monitoring agent for Azure servers (we have a few :-) )

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  14. CollectGenericEventDataToCloud error

    There is this event log entry on the SCOM server:

    Log Name: Operations Manager
    Source: HealthService
    Date: 11/13/2014 9:44:25 PM
    Event ID: 8000
    Task Category: Data Publisher Manager
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer:
    Description:
    A subscriber data source in management group
    has posted items to the workflow, but has not received a response in 2 minutes. Data will be queued to disk until a response has been received. This indicates a performance or functional problem with the workflow.
    Workflow Id : Microsoft.SystemCenter.CollectGenericEventDataToCloud
    Instance : ***
    Instance Id : {EFF677EF-CA77-8B7B-7FAD-8550C268DB5A}

    I have seen this Feedback, however in this scenario…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  15. Troubleshooting Monitoring Agent

    Troubleshooting Agent on server

    Installed the Monitoring Agent on a server but I am seeing any data come up here I do see this error in the event log

    he health service HTTP module in management group "AOI-197a01c9-8580-46f4-b164-c226142e5b32" failed to POST data to/from url (https://ods.systemcenteradvisor.com/UpdatesRequiredDataService.svc/PostDataItems) with HTTP status code (500) and error message (<Fault xmlns="http://schemas.microsoft.com/ws/2005/05/envelope/none"><Code><Value>Sender</Value></Code><Reason><Text xml:lang="en-US">The remote server returned an error: (404) Not Found.</Text></Reason><Detail><OperationalDataServiceFault xmlns="http://schemas.datacontract.org/2004/07/Microsoft.WorkloadMonitoring.ODS&quot; xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><Messgae>The remote server returned an error: (404) Not Found.</Messgae><Type>System.Net.WebException</Type></OperationalDataServiceFault></Detail></Fault>). The module will retry again.

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    If you only see this at the very beginning, it might simply mean your storage account on our end is not yet provisioned – so the service is saying to the agent it isn’t ready yet, and he should try again in a little while and everything will be fine.

    It takes some time for most scenarios to initially light up – did anything change in the meantime?
    I am closing this idea, please follow a related one here http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6626222-no-data-after-more-than-60-minutes (there are details of what works and what doesn’t with Direct Agent, etc)

    If you keep seeing those errors on a sustained/frequent fashion, anyhow, do let me know and we can investigate with you.

  16. Add a configurable monitor to alert when pricing tier limits are near saturation.

    If the pricing models that come in are based on an amount of data uploaded per day, then having a monitor that can alert the customer that they are nearing their daily upload limits.

    This monitor should be configurable so the customer can choose at which point they get notified.

    11 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  17. Need help with Azure ops insights oboarding

    Azure op insights is not showing the events data from our systems (CFIT-HRIT) .Operation manager is able to send IIS log, SQL data to Azure ops Insights but not event data.

    I am seeing some alerts related to operations manager with connectivity failure. Need help.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Did any of these steps below in the blog post help? I am closing this, but let us know if you need and we can ping you in mail.
    -

    Check that you have the Latest Update Rollup for SCOM, otherwise a lot of those scenarios won’t have the right modules to send the data.

    A pretty exhaustive list of things to troubleshoot is in this article (don’t be misled by the title) http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

  18. cannot register

    Cannot Register with Advisor SC2012R2 UR4

    I have OpsMgr2012R2 and just updated to UR4. Advisor was never configured prior to this. When I attempt to Register, I continuously receive the "Error 3000: Unable to register to Advisor Service, Please contact the system administrator". Connectivity is fine because I'm able to log into the portal through the wizard, and if I choose a new Advisor account name, it gets created but just won't complete the check in. Advisor portal shows the two Accounts I've created, but no Management Group connected with them yet. I have tried all the articles, timesync is…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    After our initial exchange of emails I have not heard from you anymore. I am closing this, but let us know if you still have issues and need more help. In your case we saw the proxy asking authentication (407) in the trace logs.

    There is only 5 minutes of time allowed for registration – hence the time sync. It might be the clock on your end (or on our Azure service) is slightly skewed.

    OpsMgr tracing would probably show what’s happening – use this article http://support.microsoft.com/kb/942864 and use VERBOSE i.e.
    StartTracing.cmd VER
    - reproduce the issue –
    StopTracing.cmd
    FormatTracing.cmd

  19. Traffic Monitor error 503

    In the last 2 days, I have this message into one of my MS:

    The health service HTTP module in management group "Inside Technologies" failed to POST data to/from url (https://ods.systemcenteradvisor.com/PerformanceDataService.svc/PostDataItems) with HTTP status code (503) and error message (The service is unavailable.). The module will retry again.

    Could be a bug of the platform?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  20. How to fully remove Preview component from SCOM?

    At least for now, I am done with preview evaluation and I would to fully and cleanly remove the preview integration on my SCOM platform (I do not want to only stop monitoring servers).

    Is there is any detailed instructions available somewhere ?
    Thanks

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Removing all management packs that contain ‘Advisor’ in their name would do… but that would also completely remove the option to try and sign up again, requiring you to at least re-import the MPs that come in SC 2012 R2 (or downloaded separately for SP1) and update rollups to get those pages in the UI back.

    A first set of those MPs is shipped with R2, and that contains the rules that will pull down the rest.

    This powershell should give you the full list

    Get-SCOMManagementPack | where {$_.DisplayName -match ’Advisor’} | select name,Sealed

    The procedure is not really recommended because you might have additional unsealed MP with overrides and runas accounts referencing and ‘blocking’ those you are trying to remove… see this good old blog post by Kevin for the type of issue you might (or might not) encounter in doing so http://blogs.technet.com/b/kevinholman/archive/2008/11/11/cleaning-up-the-default-mp.aspx

← Previous 1
  • Don't see your idea?

Feedback and Knowledge Base