Troubleshooting service startup

Applies to: Advanced Threat Analytics version 1.9

Troubleshooting ATA Center service startup

If your ATA Center does not start, perform the following troubleshooting procedure:

  1. Run the following Windows PowerShell command: Get-Service Pla | Select Status to make sure the Performance counter service is running. If it's not, then it's a platform issue, and you need to make sure you get this service running again.

  2. If it was running, Try to restart it, and see if it resolves the issue: Restart-Service Pla

  3. Try to create a new data collector manually (any will suffice, even just collect machine CPU for example). If it can start, the platform is probably fine. If not, it is still a platform issue.

  4. Try to manually recreate the ATA data collector, using an elevated prompt, running these commands:

    sc stop ATACenter
    logman stop "Microsoft ATA Center"
    logman export "Microsoft ATA Center" -xml c:\center.xml
    logman delete "Microsoft ATA Center"
    logman import "Microsoft ATA Center" -xml c:\center.xml
    logman start "Microsoft ATA Center"
    sc start ATACenter

Troubleshooting ATA Lightweight Gateway startup


Your ATA Gateway does not start and you get this error:
System.Net.Http.HttpRequestException: Response status code does not indicate success: 500 (Internal Server Error)


This happens because as part of the Lightweight Gateway installation process, ATA allocates a CPU threshold that enables the Lightweight Gateway to utilize CPU with a buffer of 15%. If you have independently set a threshold using the registry key: this conflict will prevent the Lightweight Gateway from starting.


  1. Under the registry keys, if there is a DWORD value called Disable Performance Counters make sure it is set to 0: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfOS\Performance\ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance

  2. Then restart the Pla service. The ATA Lightweight Gateway will automatically detect the change and restart the service.

See Also