Forum Discussion
Spurious health alerts with sensor 2.241.18721.18894
We use delayed update on half of our sensors to help catch possible issues with new sensor versions.
Only on half of our DCs running the latest sensor 2.241.18721.18894, we are receiving alerts "The virtual machine that sensor [hostname.domain] is installed on has a network configuration mismatch. This issue may affect the performance and reliability of the sensor"
Looking at the alert in the portal, MDI alleges that the affected virtual machines virtual NICs have Large Send Offload (LSO) enabled. However, the virtual machines do NOT have LSO enabled.
We are not seeing these alerts from the other half of our sensors that are still running 2.241.18708.7989. The issue is only appearing on VM DCs running sensor 2.241.18721.18894.
Anyone else see this issue?
All the affected DCs are virtual machines. We do have some bare-metal DCs, but they are still running 2.241.18708.7989.
2 Replies
- EliOfek
Microsoft
This is indeed a new health alert added in the last version.
If you feel that it is false, meaning you don't have LSO enabled for sure,
Open a support case.
I advise to attach the output of this powershell command to the case notes:(Get-CimInstance -Namespace root\standardcimv2 -Query "SELECT * FROM MSFT_NetAdapterAdvancedPropertySettingData WHERE InstanceID LIKE '%YOUR_ADAPTER_ID%' AND DisplayName LIKE 'Large Send Offload%'") | Where-Object { $_.DisplayValue -eq 'Enabled' } | ForEach-Object { $true } | Select-Object -First 1
or run this WMI query any other way like wmic:
wmic /namespace:\\root\standardcimv2 path MSFT_NetAdapterAdvancedPropertySettingData where "InstanceID like '%YOUR_ADAPTER_ID%' and DisplayName like 'Large Send Offload%'" get DisplayValue
Make sure to replace your adapter id, you can get it with something like this:Get-CimInstance -Namespace root\standardcimv2 -ClassName MSFT_NetAdapter | Select-Object Name, InstanceID
The sensor logic that reports the health alert uses something very close to that to decide if there is an issue.One more note when checking for LSO, keep in mind to check both ipv4 and ipv6.
Thanks for the reply. I did indeed open a support case, and the support engineer quickly pointed me in the right direction. My confusion arose from looking at the NIC driver GUI option "IPv4 TSO Offload" as shown on the doc page here. I had assumed that setting this option to Disabled was sufficient. This option in the GUI does not correspond to "Large Send Offload v2" as detected by the new sensor and set by the Powershell commands provided on the same doc page. In the NIC driver GUI, these appear as "Large Send Offload V2 (IPv4)" and "Large Send Offload V2 (IPv6)"
