Forum Discussion
All our Surface Hubs stopped communicating with Azure Log Analytics
We tried to connect our Surface Hubs since October 2020 and I already opened a case at Microsoft in November.
As we never had it working before, we were not sure if there could be a mistake on our side.
We tried different networks (company, private, 4G) to make sure this is no proxy/firewall issue.
On a regular Windows 10 the monitoring agent ist working fine, but on none of our surface hubs.
BTW: Nobody at Microsoft told us that this is a known issue - we just periodically get some updates that they are still investigating and that there is nothing new.
When I opened the case I attached some findings from the event log but they didn't really seem to care.
The case has been sent to the OMS-Team and back and for what I see they have absolutely no clue, what is going wrong.
MarcVDH
Maybe you could check, if you see the same entries in the logs of your Surface Hubs?
If you collect the support logs from a Surface Hub you get a zip file which contains a folder "WindowsEventLog" with a file "Operations Manager.evtx".
Open this file on Windows 10 and you may see some warnings, each followed by an error.
Example (partially translated from German):
Failed to create process due to error '0x800711c7 : Your Organization used Device Guard to block this app - contact your support person for more info.
', this workflow will be unloaded.
Command executed: "C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"
Working Directory: C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 1\16\
One or more workflows were affected by this.
Workflow name: Microsoft.SystemCenter.Advisor.AgentHealth.KnowledgeDiscoveryMonitor
We only see this error if OMS is enabled on the Surface Hub.
hello baeumeto
Welcome to the club, if I may say so 😕
We dit everything like you (wired, wireless network, different internet provider etc... etc...)
We had something from MS telling us that the 2020 Update wos solving the problem, and it turns it is not true.
It is even worse now because the 2020 update has apparently introduced new problems (you are not able to make phone call from the SH, it is ringing on the SH but on the other side nothing and after a few seconds you get 'sorry we couldn't connect you'). That was working perfectly before the update.
As for the eventlog, I have checked on one machine, we don't have the same error as you.
We have this one :
AOI-a52dc355-8d13-43ed-b036-70060aaef750
Microsoft.SystemCenter.Advisor.AgentHealth.KnowledgeDiscoveryMonitor
{BFB936BE-6E53-12FA-5ECE-7D059F073B36}
12:45:52 AM
"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"
C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 1794\365\
System.PropertyBagData
60
0x80070241 : Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.10
5The message resource is present but the message was not found in the message table
but this error was already present before the Log Analytics problem started.
The error we got when the problem started appeared every hour for approximately a day and then stopped :
Event ID 4007
xxxxxxxx-wwww-yyyy-zzzz-pppppppp.oms.opinsights.azure.com
https://xxxxxxxx-wwww-yyyy-zzzz-pppppppp.oms.opinsights.azure.com/ConfigurationService.Svc/GetCurrentConfigurationCookie
3448b17f-9a23-4970-c163-bdd85a2e8cdaThe message resource is present but the message was not found in the message table
At the moment we are still deploying the config of the Log Analytics workspace on the SH.
Marc
We had the same eventlog message (about the digital signature) in october.
I didn't see it again after we updated to 20H2, but I will have a closer look.
We don't use WUfB and also have different software versions, altough I visited all of the surface hubs shown below last friday and started the search for update process manually.
We see another strange behaviour if I deploy a configuration profile to a Surface Hub.
On devices with manually entered OMS config we get an error for deploying any kind of configuration profile.
If I assign multiple configuration profiles, one gets the error above and the other ones are in failed state.
Every single configuration sets the configurated parameters successfully but failes on the Workspace Key.
We don't have the problem on devices where OMS is not configured.
I don't know if those problems are related, but at least it is all about a "Workspace Key" and only happens if OMS is enabled.
As Intune is already collecting some information about the devices, I thought it would be worth a try, to enable this feature: https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor
I enabled all logs including "Devices", but that only led to a new configuration file that failed on all devices.