Forum Discussion
Torreuh
Aug 14, 2023Copper Contributor
MDI sensors fail to start on new core servers
Core servers with the same settings as our other servers keep having issues with starting the sensor. Main error seems to be a 500 http error. We have checked the connectivity (gives 503 as it sh...
EliOfek
Microsoft
Aug 14, 2023The sensor is failing as it is trying to contact the sensor updater which does not answer.
The key is to understand why, and a good starting point would be to look in the updater's full log to see if it is reporting any issues. (maybe it can't even start?)
Another option is that localhost TCP/444 is blocked for some reason.
The key is to understand why, and a good starting point would be to look in the updater's full log to see if it is reporting any issues. (maybe it can't even start?)
Another option is that localhost TCP/444 is blocked for some reason.
- TorreuhAug 14, 2023Copper ContributorI will request a test on the 444 port.
I had a look at the updater logs. This error keeps popping up there.
2023-08-08 06:54:51.6441 Error PerformanceCounterExtension Exception thrown in WebApi [Method=POST RequestUri=https://127.0.0.1:444/api/json/v1.0]
Microsoft.Tri.Infrastructure.ExtendedException: Failed to create PerformanceCounter [categoryName=Processor Information name=% Processor Utility instanceName=_Total] ---> Microsoft.Tri.Infrastructure.ExtendedException: PerformanceCounter is missing [parameterName=Category categoryName=Processor Information name=% Processor Utility instanceName=_Total]
at PerformanceCounter Microsoft.Tri.Infrastructure.PerformanceCounterExtension.Create(string categoryName, string name, string instanceName)+ThrowPerformanceCounterMissingException(string parameterName)
at PerformanceCounter Microsoft.Tri.Infrastructure.PerformanceCounterExtension.Create(string categoryName, string name, string instanceName)
--- End of inner exception stack trace ---
at PerformanceCounter Microsoft.Tri.Infrastructure.PerformanceCounterExtension.Create(string categoryName, string name, string instanceName)
at async Task Microsoft.Tri.Sensor.Updater.ResourceRestrictor.RestrictCpuAsync(RestrictCpuRequest request)
at void Microsoft.Tri.Common.CommunicationHandler<TCommunicationRequest, TCommunicationResponse>+<>c__DisplayClass8_0<TDerivedCommunicationRequest>+<<Register>b__0>d.MoveNext()
at async Task<HttpResponseMessage> Microsoft.Tri.Sensor.Common.SensorCommunicationHandler<TCommunicationRequest, TCommunicationResponse>.InvokeAsync(Version version, Stream contentStream)
at async Task<HttpResponseMessage> Microsoft.Tri.Sensor.Common.SensorCommunicationController<TCommunicationRequest, TCommunicationResponse>.InvokeAsync(Version version)
at async Task<object> System.Threading.Tasks.TaskHelpersExtensions.CastToObject<T>(Task<T> task)
at async Task<HttpResponseMessage> System.Web.Http.Controllers.ApiControllerActionInvoker.InvokeActionAsyncCore(HttpActionContext actionContext, CancellationToken cancellationToken)
at async Task<HttpResponseMessage> System.Web.Http.Controllers.ActionFilterResult.ExecuteAsync(CancellationToken cancellationToken)
at async Task<HttpResponseMessage> System.Web.Http.Dispatcher.HttpControllerDispatcher.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
2023-08-08 06:54:52.2631 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=AATPSensor status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]- EliOfekAug 14, 2023
Microsoft
Not a port issue.
You are missing a perf counter the updater needs so it crashes.
PerformanceCounter is missing [parameterName=Category categoryName=Processor Information name=% Processor Utility instanceName=_Total]
use perfmon.exe to verify it is indeed missing, the question is why...- TorreuhAug 22, 2023Copper Contributorperfmon.Exe is not on the core server, only perfhost.exe.
Apparently its working on different dc's who also don't have perfmon.Exe, only perfhost.
We tried rebuilding the counters with the lodctr command, did not fix anything.
Do we need to install perfmon.Exe manually? Not very versed on this whole counter issue.
- Aug 14, 2023here is the MDI firewall requirements.
https://learn.microsoft.com/en-us/defender-for-identity/prerequisites#defender-for-identity-firewall-requirements