Forum Discussion
Linux Virtual Machine Agent Status "Not Ready"
We currently have a CEF server deployed in Azure which is a Linux VM. This morning I had no logs in sentinel and checked on the vm and noticed there was an error stating the Agent Status is "Not Ready".
Having a hard time finding a solution to this problem, has anyone had this issue before?
Thanks.
9 Replies
balamaruthikuppalaMicrosoft
The “Not Ready” status for the Linux VM Agent can occur for several reasons, commonly related to the agent process itself or underlying platform/network issues.
If a reboot resolves the issue, it’s a good idea to check the agent logs at the time the problem occurred. You can find these in:
/var/log/waagent.log
Look for any errors or service restarts during the outage period.It’s important to note that SSH availability is not directly tied to the VM Agent — they are independent components. However, if both the VM Agent status is 'Not Ready' and SSH is failing at the same time, that typically points to a broader network issue, such as:
Loss of connectivity to the Azure WireServer,What is IP address 168.63.129.16? | Microsoft Learn which the agent depends on
Platform maintenance or underlying host networking issues
In such cases, confirm the VM can reach the WireServer at 168.63.129.16, which is critical for Azure management services.
You can check reachability using:
ping 168.63.129.16If the issue recurs, inspect:
waagent.log for agent failures
/var/log/syslog or /var/log/messages for broader system issues
NSG/UDR settings that might block platform traffic
Let me know if you’d like help diagnosing based on logs.
If CPU spikes to 100% usage, certain processes may be preventing SSH access.
limit background processes or optimizing VM resources.
Also try to consider scaling the VM
Unfortunately, I have faced the similar issue.
I was not able to ssh into vm at all until I do hard reset on the VM.
I did not find a proper solution to overcome this. I found comments to restart waagent but how can we do that if we are not able to ssh into vm.
https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/linux-azure-guest-agent did not help
Can you please advise if you find anything ?
- Our issue was system memory filling up (and quick). The VM was deployed with only 30g system memory, for a syslog server you're going to want atleast 256g.
Check Azure Monitor Agent: Ensure that the Azure Monitor Agent (formerly known as the Log Analytics Agent) is installed and running on the Linux VM. You can check its status by running the following command:
sudo systemctl status waagentIf it's not running, you may need to start it:
sudo systemctl start waagentCheck if there are any resource locks on the VM or Log Analytics Workspace that might be preventing the agent from functioning correctly.
I am unable to connect to the machine to run those commands. I am trying to use them in the "Run Command" blade of the VM but not having any luck.
This happened erroneously, there were no changes or updates to the VM. Looking at the serial console I see an error related to a wire server, but because im unable to ssh into the machine I cannot troubleshoot any further.
Is there a permanent solution for this issue? I'd like to understand why it keeps occurring, as rebooting the system each time isn't a sustainable fix.
