Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Traffic Monitor error 503

    In the last 2 days, I have this message into one of my MS:

    The health service HTTP module in management group "Inside Technologies" failed to POST data to/from url (https://ods.systemcenteradvisor.com/PerformanceDataService.svc/PostDataItems) with HTTP status code (503) and error message (The service is unavailable.). The module will retry again.

    Could be a bug of the platform?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  2. My Capacity Planner is reporting in progress, System Update Assessment is performing assessment and malware Assessment is connecting data

    My Capacity Planner is reporting in progress, System Update Assessment is performing assessment and Malware Assessment is connecting your data. This has not changed in 3 weeks. The only thing that works is configuration assessment..

    Any ideas...?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    There has been no activity on this thread for over 20 days, I assume some of the steps indicated below addressed the issue.

    There was a service-side bug at the time you posted this that prevented Malware and Update Assessment data indexing, but has been addressed back then in July (this left a 3 days gap in malware and updates data around that time).

    But if nothing helped and you are still in trouble with this, plase let us know and we can set up an online meeting to work thru onboarding with you and troubleshoot this in the next few days. Let us know.


    Suggested resolution steps/things to check:

    Please check this blog post that contains a lot of information on how to troubleshoot onpremises connectivity http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx
    Don’t be mis-led by the title, that is just the most common error, but there are a lot of troubleshooting info in…

  3. Windows Server 2003 'grey' due to missing Powershell system rule Microsoft.IntelligencePacks.Types.HealthServiceProxyConfiguration

    Hi

    I think there is a bug in the latest version of the Microsoft System Center Advisor Monitoring management packs.

    We still have a number of Windows 2003 Servers, most of them don't have powershell, but the rule "Advisor Proxy Setting Rule" seem to assume the presence of said PowerShell.

    I'm trying to override this, but I'm not sure how to do the in the most effective way.

    /Per

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  4. IE11 won't download the Operational Insights agent, flags it as a virus and deletes it

    When attempting the download the agent, IE downloads to 100% then flags the agent as a virus and deletes it. Error attached. Windows 8.1, IE 11.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Either a false positive with a specific version of the AV’s signatures or your DNS cache was under attack and you were being redirected elsewhere…

    We are not able to reproduce – the file we host in the cloud is valid, signed and not infected – and also in the reported case it was only happening on one machine of yours (not other ones).

  5. CollectGenericEventDataToCloud error

    There is this event log entry on the SCOM server:

    Log Name: Operations Manager
    Source: HealthService
    Date: 11/13/2014 9:44:25 PM
    Event ID: 8000
    Task Category: Data Publisher Manager
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer:
    Description:
    A subscriber data source in management group
    has posted items to the workflow, but has not received a response in 2 minutes. Data will be queued to disk until a response has been received. This indicates a performance or functional problem with the workflow.
    Workflow Id : Microsoft.SystemCenter.CollectGenericEventDataToCloud
    Instance : ***
    Instance Id : {EFF677EF-CA77-8B7B-7FAD-8550C268DB5A}

    I have seen this Feedback, however in this scenario…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  6. Advisor Rules Causing Events 1103 and 1206 for Sever 2003 R2

    I recently connected to Insights and the above rule causing Events 1103 and 1206 on just Server 2003 R2 servers.

    Rules:
    - Microsoft.IntelligencePacks.Types.HealthServiceProxyConfiguration
    - CollectAgentOptInFailures
    - Microsoft.SystemCenter.Advisor.Monitoring.ServerOptInOutRule
    - Microsoft.SystemCenter.Advisor.AgentHealth.ComputerOptInCompatibleMonitor

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Microsoft.IntelligencePacks.Types version 7.0.9793.0 has been released today, which fixes the first rule which made your agents go gray.

    Please note the comments about the other three rules, might be missing .Net dependency for Advisor Configuration Assessment ‘opt in’ rules.

  7. Need help with Azure ops insights oboarding

    Azure op insights is not showing the events data from our systems (CFIT-HRIT) .Operation manager is able to send IIS log, SQL data to Azure ops Insights but not event data.

    I am seeing some alerts related to operations manager with connectivity failure. Need help.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Did any of these steps below in the blog post help? I am closing this, but let us know if you need and we can ping you in mail.
    -

    Check that you have the Latest Update Rollup for SCOM, otherwise a lot of those scenarios won’t have the right modules to send the data.

    A pretty exhaustive list of things to troubleshoot is in this article (don’t be misled by the title) http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

  8. No Servers Connected, yet I have SQL data

    I installed the agent on a single server 24hours ago and I am still waiting for it to show in the Connected Servers area. However, i do have data/recommendations for the SQL Server Assessment pack.

    Is it likely that there is something wrong, or should I continue to wait?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Hi Dan — if you are getting data for the server from the SQL Server Assessment IP, then this means data is flowing correctly.
    I am currently seeing the “Servers Connected Directly” tile take several seconds to update with data — is your tile also slow to update? You can also run the following query to confirm if data is coming from the agent:

    • | Measure Max(TimeGenerated) as LastData by Computer | Sort Computer


    Closing as there has not been any activity for almost 4 weeks. Let us know if you still need help with this.

  9. Agent Installation on over 100 VM's

    If I would to monitor over 100 VM's in Azure/Onprem do i need to install an OMS agent on each VM for it to be monitored in OMS?

    Or would I be able to install the Log analytics forwarder service on one VM which can then pull information from other VM's?

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  10. Provide on the monitoring agent a test connection function to OI

    Provide on the monitoring agent a test connection function to OI

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  11. How to fully remove Preview component from SCOM?

    At least for now, I am done with preview evaluation and I would to fully and cleanly remove the preview integration on my SCOM platform (I do not want to only stop monitoring servers).

    Is there is any detailed instructions available somewhere ?
    Thanks

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Removing all management packs that contain ‘Advisor’ in their name would do… but that would also completely remove the option to try and sign up again, requiring you to at least re-import the MPs that come in SC 2012 R2 (or downloaded separately for SP1) and update rollups to get those pages in the UI back.

    A first set of those MPs is shipped with R2, and that contains the rules that will pull down the rest.

    This powershell should give you the full list

    Get-SCOMManagementPack | where {$_.DisplayName -match ’Advisor’} | select name,Sealed

    The procedure is not really recommended because you might have additional unsealed MP with overrides and runas accounts referencing and ‘blocking’ those you are trying to remove… see this good old blog post by Kevin for the type of issue you might (or might not) encounter in doing so http://blogs.technet.com/b/kevinholman/archive/2008/11/11/cleaning-up-the-default-mp.aspx

  12. How does one find out which servers are gateways?

    In the old version, finding out the server gateways and server agents was an easy task. Unsure how to gather this information in the current version. Is there a way to do this.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Check under the ‘Daily Data Usage’ on the overview screen, we talked about this here http://blogs.technet.com/b/momteam/archive/2014/07/25/system-center-advisor-limited-preview-saved-searches-cloud-attach-status-and-usage-and-more.aspx

    and check this other idea http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519184-make-advisor-limited-preview-work-with-mma-agents

    I am closing this – please let me know if you need more info about this. Also answered your other thread with the search queries to look for when data was last sent by each machine http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519275-how-does-one-view-a-list-of-servers-that-are-not-r

  13. Monitoring Agent silent / unattended install

    Info on silent or command line install of Microsoft monitoring agent for Azure servers (we have a few :-) )

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  14. Troubleshooting Monitoring Agent

    Troubleshooting Agent on server

    Installed the Monitoring Agent on a server but I am seeing any data come up here I do see this error in the event log

    he health service HTTP module in management group "AOI-197a01c9-8580-46f4-b164-c226142e5b32" failed to POST data to/from url (https://ods.systemcenteradvisor.com/UpdatesRequiredDataService.svc/PostDataItems) with HTTP status code (500) and error message (<Fault xmlns="http://schemas.microsoft.com/ws/2005/05/envelope/none"><Code><Value>Sender</Value></Code><Reason><Text xml:lang="en-US">The remote server returned an error: (404) Not Found.</Text></Reason><Detail><OperationalDataServiceFault xmlns="http://schemas.datacontract.org/2004/07/Microsoft.WorkloadMonitoring.ODS&quot; xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><Messgae>The remote server returned an error: (404) Not Found.</Messgae><Type>System.Net.WebException</Type></OperationalDataServiceFault></Detail></Fault>). The module will retry again.

    0 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    If you only see this at the very beginning, it might simply mean your storage account on our end is not yet provisioned – so the service is saying to the agent it isn’t ready yet, and he should try again in a little while and everything will be fine.

    It takes some time for most scenarios to initially light up – did anything change in the meantime?
    I am closing this idea, please follow a related one here http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6626222-no-data-after-more-than-60-minutes (there are details of what works and what doesn’t with Direct Agent, etc)

    If you keep seeing those errors on a sustained/frequent fashion, anyhow, do let me know and we can investigate with you.

2 Next →
  • Don't see your idea?

Feedback and Knowledge Base