Update Management - Domain Controllers are not assessed

%3CLINGO-SUB%20id%3D%22lingo-sub-186805%22%20slang%3D%22en-US%22%3EUpdate%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-186805%22%20slang%3D%22en-US%22%3E%3CP%3Ehi%20guys%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20enabled%20Update%20Management%20on%20Azure%20through%20the%20Automation%20account%2C%20i%20have%20multiple%20VMs%20of%20different%20roles%20all%20of%20them%20are%20working%20fine%20and%20assessed%20but%20only%20the%202%20domain%20controllers%20are%20not%20assessed%26nbsp%3B%20!%20is%20there%20extra%20configuration%20need%20to%20be%20done%20%3F%20has%20anyone%20seen%20this%20before%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%26nbsp%3BUpdate%20Agent%20Readiness%20is%20working%20fine%20for%20all%20machines.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-186805%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESolutions%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188368%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188368%22%20slang%3D%22en-US%22%3E%3CP%3EOk%20Stanislav%20%2C%20thanks%20for%20your%20replies%20%2C%20i%20will%20do%20that%20and%20update%20the%20conversation%20later.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188367%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188367%22%20slang%3D%22en-US%22%3E%3CP%3EMay%20be%20try%20to%20set%20it%20on%20the%20second%20option%20and%20see%20if%20that%20will%20help.%20You%20might%20have%20to%20wait%20up%20to%2012%20hours%20until%20assessment%20is%20done.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188366%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188366%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20687px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F33205iCC52FB95DBEF8AFD%2Fimage-dimensions%2F687x465%3Fv%3D1.0%22%20width%3D%22687%22%20height%3D%22465%22%20alt%3D%22updatemanagement.png%22%20title%3D%22updatemanagement.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3Ehere%20is%20the%20settings%20as%20you%20see%20also%20all%20machines%20are%20assessed%20except%20only%20for%202%20domain%20controllers.%26nbsp%3B%3C%2FP%3E%3CP%3EBUT%20the%26nbsp%3BUPDATE%20AGENT%20READINESS%20is%20green%20and%20ready%20for%20all%20Machines%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188361%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188361%22%20slang%3D%22en-US%22%3E%3CP%3ECan%20you%20go%20to%20the%20Automation%20account%20-%26gt%3B%20Update%20Management%20tab.%20At%20the%20top%20there%20are%20a%20few%20actions.%20Click%20on%20Manage%20Machines%20to%20see%20what%20kind%20of%20setting%20you%20have%20there.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188359%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188359%22%20slang%3D%22en-US%22%3E%3CP%3E-%20They%20were%20onboarded%20by%20deploying%20the%20MMA%20agent%20using%20ARM%20template.%3C%2FP%3E%3CP%3E-%20The%20OS%20of%20the%20machines%20is%20Windows%20Server%202016%20Datacenter.%3C%2FP%3E%3CP%3E-%20.Net%20framework%20installed%20is%26nbsp%3B.NET%20Framework%204.6.2%3C%2FP%3E%3CP%3E-%20yes%20the%20heartbeats%20data%20are%20there%20as%20well%20performance%20data%20and%20Antimalware%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188358%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188358%22%20slang%3D%22en-US%22%3E%3CP%3ECan%20you%20provide%20more%20details%3F%20How%20these%20machines%20were%20onboarded%3F%20What%20is%20the%20OS%20level%20of%20these%3F%20What%20version%20of%20.net%20framework%20they%20have%20installed%3F%20Do%20you%20have%20heartbeat%20data%20for%20those%20machines%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-188357%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-188357%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethe%20operations%20manager%20log%20is%20clear%20%2C%20with%20no%20errors%20regarding%20discovery%20or%20failure%20of%20running%20a%20script%2C%20and%20the%20oms%20agent%20is%20reporting%20to%20the%20oms%20log%20space%20all%20the%20performance%20counters%20and%20antimalware%20status%2C%20it%20is%20working%20fine%20except%20that%20for%20the%20updates%20it%20keep%20on%20a%20state%20of%20not%20assessed.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethere%20are%20only%20warnings%20on%20the%20log%20about%20this%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22HealthService%20(4724)%20Health%20Service%20Store%3A%20A%20request%20to%20write%20to%20the%20file%20%22C%3A%5CProgram%20Files%5CMicrosoft%20Monitoring%20Agent%5CAgent%5CHealth%20Service%20State%5CHealth%20Service%20Store%5Cedbtmp.log%22%20at%20offset%200%20(0x0000000000000000)%20for%204096%20(0x00001000)%20bytes%20succeeded%2C%20but%20took%20an%20abnormally%20long%20time%20(24%20seconds)%20to%20be%20serviced%20by%20the%20OS.%20This%20problem%20is%20likely%20due%20to%20faulty%20hardware.%20Please%20contact%20your%20hardware%20vendor%20for%20further%20assistance%20diagnosing%20the%20problem.%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-187783%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20Management%20-%20Domain%20Controllers%20are%20not%20assessed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-187783%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%0A%3CP%3EPlease%20check%20the%26nbsp%3B%20Operations%20Manager%20log%20on%20the%20machines.%20Seems%20like%20the%20OMS%20agent%20is%20not%20reporting.%20This%20could%20be%20due%20to%20a%20lot%20of%20things%3A%3C%2FP%3E%0A%3CP%3E-%20Some%20firewall%20rules%20blocking%20outgoing%20Internet%20traffic%3C%2FP%3E%0A%3CP%3E-%20Some%20security%20restrictions%20preventing%20the%20normal%20functioning%20of%20the%20agent.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20start%20by%20checking%20the%20status%20of%20the%20oms%20agent%20from%20Control%20panel%20and%20than%20looking%20at%20the%20Operations%20Manager%20event%20log.%20You%20can%20also%20try%20to%20install%20the%20OMS%20agent%20manually%20and%20connecting%20it%20to%20the%20Log%20Analytics%20workspace%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

hi guys,

 

I enabled Update Management on Azure through the Automation account, i have multiple VMs of different roles all of them are working fine and assessed but only the 2 domain controllers are not assessed  ! is there extra configuration need to be done ? has anyone seen this before? 

 

The Update Agent Readiness is working fine for all machines. 

 

 

8 Replies
Highlighted

Hi

Please check the  Operations Manager log on the machines. Seems like the OMS agent is not reporting. This could be due to a lot of things:

- Some firewall rules blocking outgoing Internet traffic

- Some security restrictions preventing the normal functioning of the agent.

 

You can start by checking the status of the oms agent from Control panel and than looking at the Operations Manager event log. You can also try to install the OMS agent manually and connecting it to the Log Analytics workspace

Highlighted

Hi,

 

the operations manager log is clear , with no errors regarding discovery or failure of running a script, and the oms agent is reporting to the oms log space all the performance counters and antimalware status, it is working fine except that for the updates it keep on a state of not assessed. 

 

there are only warnings on the log about this: 

 

"HealthService (4724) Health Service Store: A request to write to the file "C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Health Service Store\edbtmp.log" at offset 0 (0x0000000000000000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (24 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

 

Highlighted

Can you provide more details? How these machines were onboarded? What is the OS level of these? What version of .net framework they have installed? Do you have heartbeat data for those machines?

Highlighted

- They were onboarded by deploying the MMA agent using ARM template.

- The OS of the machines is Windows Server 2016 Datacenter.

- .Net framework installed is .NET Framework 4.6.2

- yes the heartbeats data are there as well performance data and Antimalware

 

Highlighted

Can you go to the Automation account -> Update Management tab. At the top there are a few actions. Click on Manage Machines to see what kind of setting you have there.

Highlighted

updatemanagement.png

here is the settings as you see also all machines are assessed except only for 2 domain controllers. 

BUT the UPDATE AGENT READINESS is green and ready for all Machines

Highlighted

May be try to set it on the second option and see if that will help. You might have to wait up to 12 hours until assessment is done. 

Highlighted

Ok Stanislav , thanks for your replies , i will do that and update the conversation later.