Azure Monitor-Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Make Advisor Limited Preview work with MMA agents (direct Windows attach), not requiring SCOM

    Right now most of Advisor Limited Preview's new features and Intelligence packs do not work with Advisor gateways. The preview features are only supported when in 'attach' with System Center 2012 SP1 (or R2) - Operations Manager.

    At the same time we have heard from many of you that the legacy Advisor gateways were cumbersome to manage and served no real purpose – it was just an extra machine to manage.

    We have work going on to provide APPLICATION-SPECIFIC proxy setting (including auth) for standalone MMA Agents, and the next step is to let them connect to Advisor service directly…

    19 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Standalone MMA agents can now report to OpInsights directly, as an alternative or complement for the Operations Manager attach mode, and to cover Hybrid topologies.

    The Capacity IP has additional pre-requisites in System Center-land (VMM/OM integration) hence still only works with System Center attach.

    The ‘legacy’ Configuration Assessment from the old Advisor service is also not provided for Direct Agent.

  2. Support for Windows Client Operating Systems

    Currently, when I tried to onboard Windows Client computers (Windows 8.1 and Windows 10 Preview) via SCOM, I get this alert:
    "Event Description: The OS version for the selected computer does not support Advisor Attached Service. Advisor requires Windows Server 2008 or higher."
    I think having Windows client computers in OpInsights via existing SCOM management group would have a reasonable market demand (banks, retailers, etc,). OpInsights would be a good solution for archiving various logs on business critical desktops.
    I am not sure what is the reason not to support Windows client OS at the moment, but is this something…

    16 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  3. Support for Windows 2003 and 2008 servers (32-bit agent)

    Hi

    We still have some 32-bit servers (Windows Server 2003, but mostly Windows Server 2008). Currently there is only an agent for 64-bit servers. We would like to monitor our 32-bit servers as well and would like to have an agent for these.

    Thanks
    Toon

    12 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    We do have the 32bit SCOM agent http://technet.microsoft.com/en-us/library/dn281931.aspx

    For Direct Agent, this is now available for download http://blogs.technet.com/b/momteam/archive/2015/06/24/oms-agent-now-supports-w2k8-sp1-os-and-32bit-systems.aspx

    This is for 2008SP1, anyhow, not 2003 – 2003 goes completely out of support in July – http://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/

    Also, some of the solutions might still need to be tweaked to work on downlevel OS with direct agent) or have higher pre-requisites (.net framework, etc).

  4. Add a configurable monitor to alert when pricing tier limits are near saturation.

    If the pricing models that come in are based on an amount of data uploaded per day, then having a monitor that can alert the customer that they are nearing their daily upload limits.

    This monitor should be configurable so the customer can choose at which point they get notified.

    11 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  5. direct agent proxy setting is removed?

    Fighting now since one week on using direct agent connection without SCOM. After installing with proxy server details, server listed in my workplace, I see proxy information removed on all clients after one minute and no data collection more.

    https://support.microsoft.com/en-us/kb/3032946/ Agent hotfix not solving the issue as described.

    Proxy settings are added to the agent setup wizard.
    Users can now provide proxy settings while they complete the agent installation wizard.

    •Account validation steps are added to the wizard.
    After users enter an account and workspace to connect to Operational Insights, the wizard performs a test to verify that the account…

    8 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  6. Failed to uninstall Performance counter when removing MMA

    Uninstalling the Monitoring Agent results in the error attached for some unknown reason.
    Background info: the Agent was connected to an old SCOM Server with Advisor, I was able to change the SCOM Management Group but Advisor wouldn't install/register due to the Agent seeing that Advisor was setup before on the machine

    We need to be able to change the Ops Insight SCOM Management Group or be able to at least uninstall the agent fully to allow movement between old SCOM and new SCOM deployments. My only option left is to reinstall the OS

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Only info we found related to this are to FULLY rebuild perf counters as described here http://support.microsoft.com/kb/2554336
    In some cases we have seen some .Net issue with managed counters, this blog mentions installing .net 3.5 http://pkjayan.wordpress.com/2012/10/15/unable-to-install-system-center-operations-manager-2012-agent-on-windows-server-2012/

    Rather than un-installing the agent, if moving across management group and advisor does not enroll on the new MG, you can clear that advisor registration information from the registry like described here https://social.msdn.microsoft.com/Forums/azure/en-US/8e0ffa61-68a0-4669-a729-ae4cd67cffbc/advisor-connector-enable-status-monitor-failed-to-enable-advisor-connector?forum=opinsights

    If that doesn’t help, this should be standard ‘SCOM’ agents and supported thru CSS.

  7. Not be dependent on .Net 2/3

    2012R2 servers work well with just .Net4.5 so shame to impose extra install (esp given the multitude and size of .Net2 updates/patches) on a clean server.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  8. Advisorsetup.exe crashes

    I have a SC2012 R2 environment running on Server 2012 (Virtual) when I want to run the advisorsetup.exe, as an admin, from local disk, I consistently am getting the following;
    Problem Event Name: APPCRASH
    Application Name: AdvisorSetup.exe
    Application Version: 1.1.2917.0
    Application Timestamp: 52280198
    Fault Module Name: KERNELBASE.dll
    Fault Module Version: 6.2.9200.16384
    Fault Module Timestamp: 5010ab2d
    Exception Code: e0434f4d
    Exception Offset: 00000000000189cc
    OS Version: 6.2.9200.2.0.0.400.8
    Locale ID: 1033

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The new features in System Center Advisor – Limited Preview require to have System Center Operations Manager (SCOM) product to be installed in your environment.
    OpsMgr is a on premise product and part of System Center R2 suite, and System Center Advisor is an attached service to OpsMgr at this point.

    There is an other idea that you can vote on, about supporting ‘standalone’ agents without OpsMgr http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519184-make-advisor-limited-preview-work-with-mma-agents

  9. Not all data this is transfered to Advisor uses the proxy that is enter in the Operations Manager Console

    When you are using proxy server to send data to Advisor proxy server has to be set in the Operations Manager console and also on the Management server trough command (netsh winhttp set proxy myproxy:80) in order to Advisor to be able to send all data. Data to Intelligence packs is send only if you execute netsh winhttp set proxy myproxy:80 on the management server. After entering the command restart of the health service on the management server is required.
    Please Advisor consistent to use the proxy that is entered in the Operations console for all features.

    3 votes
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    This is a two-parts fix: one was in the module that is embedded in one of the ‘core’ intelligence pack libraries. This one has been fixed in June.

    The second fix is in on of the modules that ship with Operations Manager, and is included in SC2012SP1 UR7 and SC2012R2 UR3.

    This should work automatically now that we have re-published one of the ‘core’ intelligent packs.

    If on older patch levels, the workaround you explained would work to unblock the data flow.

    We are also creating some SCOM monitors that will self-monitor the connection and alert you with actionable KB associated to resolve this type of connectivity issues.

  10. HealthService 2129 - https://ods.systemcenteradvisor.com/DiagnosticsDataService.svc/PostDataItems

    To access Internet, my SCOM Management Servers need to go through a proxy. Each different URL must be explicitly declare one by one. I used the above blog article to declare the whole list.
    But I still get many errors like the HealthService 2129:
    The health service HTTP module in management group "***" failed to connect to service. The service can be offline or an incompatible SSL protocol was encountered.
    Provided configuration:
    Service Url https://ods.systemcenteradvisor.com/DiagnosticsDataService.svc/PostDataItems.

    When I try to browse this URL in IE, I do not get anything but at least I am able to confirm it is…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Closing this as there has been no activity for 2 months. Please let us know if you still need additional help. I am leaving the info below for additional people might find them useful when troubleshooting the same.


    Do you only see this for DiagnosticsDataService.svc ? or also for other service endpoints?

    Is you are on 2012SP1UR7 or 2012R2UR3 or above you only need to set the ‘global’ proxy for Advisor – it will be copied to a location for the MS to use in all workflows. Before that patch level you had to set it manually on each machine.
    Anyhow, Event ID 2129 is quite specific about SSL negotiation, so I don’t think the proxy settings are the issue here.

    Have you seen this announcement? http://redmondmag.com/articles/2014/10/29/disable-ssl-3-support.aspx
    I have not confirmed, but it’s likely that our roles in Azure are automatically updated as part of the OS patching and support…

  11. Timeout connecting to preview

    Receiving this error every few minutes:

    The health service HTTP module in management group timed out connecting to url (https://ods.systemcenteradvisor.com/GenericEventDataService.svc/PostDataItems).

    Also receiving workflow errors:

    A subscriber data source in management group has posted items to the workflow, but has not received a response in 52 minutes. Data will be queued to disk until a response has been received. This indicates a performance or functional problem with the workflow.
    Workflow Id : Microsoft.SystemCenter.CollectGenericEventDataToCloud

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Most common reason is you have to pass thru a proxy – see this other thread about it http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519268-not-all-data-this-is-transfered-to-advisor-uses-th

    We have also just shipped one new library tat comes down with intelligence packs core – ‘Microsoft.IntelligencePacks.Advisor.Monitoring’ which contains SCOM monitors to watch for those error conditions and alert you with actionable KB associated to resolve this type of connectivity issues.

  12. SSL error event ID 2129

    Hi

    I have setup advisor with assistance from a PFE, but seem to be having issues in getting it to talk back. I can see this error in the event logs on the SCOM management server. The server is using a proxy to communicate out and ports 80 and 443 are enabled on it. The proxy is configured to allow all traffic through it, so any site can be access via it.

    The health service HTTP module in management group "management group name removed" failed to connect to service. The service can be offline or an incompatible SSL protocol was…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    I would have suggested all the steps you mention. But notice that the module is saying ‘proxy provided .’ – and doesn’t say which one it is…

    Are you running UR3? If not, you should, or you should still use the NETSH WINHTTP PROXY global setting on the MS’s.

    Once on UR3 (see this http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519268-not-all-data-this-is-transfered-to-advisor-uses-th ) there is a rule used to ‘sync’ the ‘global’ proxy setting to a location where the healthservice can access it.

    Check the version of
    Microsoft.IntelligencePacks.Types Microsoft System Center Advisor Types Library

  13. Cannot register with Advisor SC2012R2 UR2

    I have OpsMgr2012R2 and just updated to UR2. Advisor was never configured prior to this. When I attempt to Register, I continuously receive the "Error 3000: Unable to register to Advisor Service, Please contact the system administrator". Connectivity is fine because I'm able to log into the portal through the wizard, and if I choose a new Advisor account name, it gets created but just won't complete the check in. Advisor portal shows the two Accounts I've created, but no Management Group connected with them yet.

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  14. Having an issue connecting to Advisor service from SCOM, event 55034

    Advisor has been working perfectly, started getting errors after applying UR2 on SCOM 2012 R2. Get Event 55034, following is head text from the details on it. Have verified no proxy is setup per other threads.

    Failed to synchronize alerts from the Management Server to Advisor because of a communication error with service. Wait for the next cycle to retry. Reason: Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationException: Unable to communicate successfully with web service when performing Post Alert Change. ---> System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://service.systemcenteradvisor.com/IdentityProvider/IdentityProviderService.svc. This could be due to the fact that the server certificate is not…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Check weird SSL settings in IE and in the registry.
    Another user has hit this with the ‘preview’ channel, see his blog http://jacobbenson.com/?p=511

    I believe this was the issue in this case:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA] “Enabled”=dword:00000000

    If your server is in this state, it is likely that also Windows Update agent might be broken for the same reason. This should fix both.

  15. Event ID 55011 Communication Error

    Recently setup the advisor connection and I started getting the event ID 55011:
    Failed to synchronize alerts from Advisor Cloud service to the Management Server because of an communication error. Wait for the next cycle to retry. Reason: Microsoft.SystemCenter.Advisor.Common.WebService.GatewayCommunicationSecurityException: Message security was invalid for the connection with web service when performing Get Alert Update ---> System.ServiceModel.Security.MessageSecurityException: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. ---> System.ServiceModel.FaultException: ID3242: The security token could not be authenticated or authorized.

    Not sure what to do to resolve this. Any help…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  16. Error Logs from agents or opinsights

    I have received some informations about intelligent packs working directly with agents and without System Center Operations Manager. This is great for me. I migrated my servers to this formo f connection. But i don’t know why some servers cannot connect or not showed on the “Servers and Usage” in my Operations Insights.
    I would like to know if we have some way to see logs of agents or some place that will show me what’s the problem is occuring.
    Anyone could help me?

    Thanks!

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    The following document has troubleshooting steps that you can use:
    http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    The first half of the document covers Operations Manager (which doesn’t apply to you) — you can skip down to the section that starts “Procedure 2: Validate if the right Intelligence Packs get downloaded to your Direct Agent”

    The list of intelligence packs that work without Operations Manager are documented here:
    http://msdn.microsoft.com/en-us/library/azure/dn873979.aspx

    The latest version of the agent also features a ‘connectivity check’ that validates the wokspaceid and key provided during configuration.

  17. Failed to download the latest Advisor management Packs from Advisor Cloud

    Proxy has been configured and URLs are allowed but getting the following error:
    Failed to download the latest Advisor Management Packs from Advisor Cloud service. Reason: System.Net.WebException: The remote server returned an error: (403) Forbidden. at System.Net.WebClient.DownloadFile(Uri address, String fileName) at Microsoft.SystemCenter.Advisor.ImportMPWriteAction.DownloadManagementPackFromCloud(Uri uri) at Microsoft.SystemCenter.Advisor.ImportMPWriteAction.OnNewDataItems(MPUpdateInfo[] dataItems, Boolean logicalSet, DataItemAcknowledgementCallback acknowledgedCallback, Object acknowledgedState, DataItemProcessingCompleteCallback completionCallback, Object completionState)

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)
  18. Installing in SCOM?

    Totally confused by the SCOM installation.. If I click setup it just takes me to a download for SCOM2012 SP1 UR6. I currently have UR5 so I should have Advisor? What is strange though is looking back UR2 seemed to have the 2 MP files required but after that only "internal". Do I need the 2 original files from UR2 as the updated MP directory gets wiped after each UR?
    Basically I am not seeing the Advisor section in SCOM

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    On SP1, you also need to import the Advisor Connector MPs from here http://www.microsoft.com/en-us/download/details.aspx?id=38199

    and then when you patch – we recommend you move on to UR6 or better UR7 as we fixed various bugs and you’ll stumble into issues with proxies otherwise.
    when installing SCOM patches, windows installer infrastructure is not able to auto-import MPs. Hence update MPs (also for Advisor) are provided as part of the update rollup and just copied in a folder on the MS – you then need to import manually. See UR7 instructions http://support.microsoft.com/kb/2965420
    The Update Rollups are ‘rollups’ – so they are cumulative patches – latest is always best.

    We updated the instructions page https://preview.systemcenteradvisor.com/instructions and various TechNet places in this sense.

  19. cannot register

    Cannot Register with Advisor SC2012R2 UR4

    I have OpsMgr2012R2 and just updated to UR4. Advisor was never configured prior to this. When I attempt to Register, I continuously receive the "Error 3000: Unable to register to Advisor Service, Please contact the system administrator". Connectivity is fine because I'm able to log into the portal through the wizard, and if I choose a new Advisor account name, it gets created but just won't complete the check in. Advisor portal shows the two Accounts I've created, but no Management Group connected with them yet. I have tried all the articles, timesync is…

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    After our initial exchange of emails I have not heard from you anymore. I am closing this, but let us know if you still have issues and need more help. In your case we saw the proxy asking authentication (407) in the trace logs.

    There is only 5 minutes of time allowed for registration – hence the time sync. It might be the clock on your end (or on our Azure service) is slightly skewed.

    OpsMgr tracing would probably show what’s happening – use this article http://support.microsoft.com/kb/942864 and use VERBOSE i.e.
    StartTracing.cmd VER
    - reproduce the issue –
    StopTracing.cmd
    FormatTracing.cmd

  20. The Capacity Planning, System Update and Malware assessment doesnt work

    The Capacity Planning, System Update and Malware assessment doesnt work

    1 vote
    Vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)
    You have left! (?) (thinking…)

    Can you be a bit more specific about what “doesn’t work” – i.e. what do you see, what troubleshooting steps have you already done… ?
    Have you looked at the other trheads in the forum? i.e. ‘capacity’ has a prerequisite of having VMM integrated with OM http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519243-capacity-intelligence-pack-does-not-work-if-scom-v

    Malware also has pre-requisites http://feedback.azure.com/forums/267889-azure-operations-insights/suggestions/6519202-what-antivirus-products-does-the-malware-assessmen

    Also, if it is an issue with connectivity, have you read this blog post with troubleshooting steps http://blogs.technet.com/b/momteam/archive/2014/05/29/advisor-error-3000-unable-to-register-to-the-advisor-service-amp-onboarding-troubleshooting-steps.aspx

    I am closing this topic as there has not been any activity in almost 2 months.

← Previous 1
  • Don't see your idea?

Feedback and Knowledge Base