Hi,
I have setup Automation Account Inventory to track wanted file but for some reason it not getting tracked (have now waited 48 hours).
This is how my setup looks like
and same kinda issue when trying to track folder
I know by facts that those files and folders are existing in tracked vms. Then I created one test tracking using * and it worked just to be sure that my automation account configuration is not 'broken'
Any clue what I'am doing wrong with my folder and file tracking?
@bombbe, Thank you for the question here. I am looking into it and will get back to you soon.
Hi @bombbe
Welcome to Microsoft Q&A! Thanks for posting the question.
While investigating this issue related to Azure Automation's Manage Change Tracking and Inventory not tracking the file/folder, here were my observation:
1. For the first path mentioned in the screenshot above (for WaAppAgent), I noticed that the extension of this log file is .log and not .txt. Since the file path is incorrect, it could not be tracked:
2. Similarly, for the folder path mentioned in the second screenshot, I dont see that folder available in my newly created VM. Could you please check that the folder path is correct and that it is available on the tracked VM:
Since the change tracking is working for path with * wildcard, I agree that the configuration seems to be OK. In case you are still facing issue after correcting/verifying the paths, the following troubleshooting guideline should help: Troubleshoot Change Tracking and Inventory issues.
The following logs will be of great help to narrow down the issue:
a. Operations Manager logs available under Application and Services Logs in EventViewer. This would contain information about any data collection/tracking rule failing for any reason. This log would also help investigate issues related to communication between the local "Microsoft Monitoring Agent (Log Analytics Agen)" and the "Log Analytics Workspace"
b. I would also recommend looking in Application and Security logs available under Windows Logs in EventViewer. The Application logs would be particulary helpful to understand if the related process (healthservice.exe or monitoringhost.exe) are crashing. The Security logs would help with audit events - for example the run as account of "Log Analytics Agent (which by default is LocalSystem) not having permission to be able to access/read the tracked files/folders.
c You can also check the "Management Packs" mentioned here, if they are not downloaded. The downloaded Management packs are available in C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Management Packs (Although, based on the symptom that some files are being tracked using the wildcard in path, I dont suspect the missing Management packs to be reason.)
d. In case none of the above works, the VERBOSE logs of the healthService (Log Analytics agent) process can be used. The steps to collect these logs are available here.. If you need help analyzing this log, please feel free to open a Support Ticket for it. These logs might contain sensitive information and are huge in size - not suitable for analysis through public forums. If you need help opening a support ticket, please let me know.
Please let me know if you have any questions.
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.
Hi,
the file were .log and not .txt so that why it were not getting tracked!
I can confirm that the folder exist tracked vm
were you able to track e.g that folder in your picture C:\Packages\Plugins\Microsoft.EnterpriseCloud.Monitoring.MicrosoftMonitoringAgent? If yes, what kinda settings?
@bombbe, apologies for the delay in getting back to you.
Yes, I was able to track changes to the folder and the configuration looks like below. I think the only thing that you are missing is the backslash character () at the end of the path.
The Operations Manager logs available under Application and Services Logs in EventViewer of the VM would help in this case. Especially, the event 4502 gets logged for failure to run change tracking related workflows.
Please let me know if you have any questions.
To benefit the community find the right answers, please do mark the post which was helpful by clicking on ‘Accept Answer’ & ‘Up-Vote’.
@bombbe, Just checking in to see if the above post helped answer your question. Kindly let us know if you have any further questions on this specific topic, we would be more than happy to assist you.
To benefit the community find the right answers, please do mark the post which was helpful by clicking on ‘Accept Answer’ & ‘Up-Vote’.
11 people are following this question.
