您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

使用混合 Runbook 辅助角色使数据中心或云端的资源实现自动化Automate resources in your data center or cloud with Hybrid Runbook Worker

Azure 自动化中的 Runbook 无法访问其他云或本地环境中的资源,因为它们在 Azure 云中运行。Runbooks in Azure Automation cannot access resources in other clouds or in your on-premises environment since they run in the Azure cloud. 利用 Azure 自动化的混合 Runbook 辅助角色功能,既可以直接在托管角色的计算机上运行 Runbook,也可以对环境中的资源运行 Runbook,从而管理这些本地资源。The Hybrid Runbook Worker feature of Azure Automation allows you to run runbooks directly on the computer hosting the role and against resources in the environment to manage those local resources. Runbook 在 Azure 自动化中进行存储和管理,然后发送到一个或多个指定计算机。Runbooks are stored and managed in Azure Automation and then delivered to one or more designated computers.

下图说明了此功能:This functionality is illustrated in the following image:

混合 Runbook 辅助角色概述

有关混合 Runbook 辅助角色的技术概述和部署注意事项,请参阅自动化体系结构概述For a technical overview of the Hybrid Runbook Worker role and deployment considerations, see Automation architecture overview.

混合 Runbook 辅助角色组Hybrid Runbook Worker groups

每个混合 Runbook 辅助角色都是你在安装代理时指定的混合 Runbook 辅助角色组的成员。Each Hybrid Runbook Worker is a member of a Hybrid Runbook Worker group that you specify when you install the agent. 一个组可以包含一个代理,但是可以在一个组中安装多个代理,以实现高可用性。A group can include a single agent, but you can install multiple agents in a group for high availability.

在混合 Runbook 辅助角色中启动 Runbook 时,可以指定该辅助角色会在其中运行的组。When you start a runbook on a Hybrid Runbook Worker, you specify the group that it runs on. 组的成员会决定由哪个辅助角色来处理请求。The members of the group determine which worker services the request. 不能指定特定的辅助角色。You cannot specify a particular worker.

与 Service Management 自动化的关系Relationship to Service Management Automation

使用 Service Management Automation (SMA) 可以运行与本地数据中心内 Azure 自动化支持的 Runbook 相同的 Runbook。Service Management Automation (SMA) allows you to run the same runbooks that are supported by Azure Automation in your local data center. SMA 与 Windows Azure Pack 一起部署,因为 Microsoft Azure Pack 包含用于管理 SMA 的图形界面。SMA is deployed together with Windows Azure Pack, as Windows Azure Pack contains a graphical interface for SMA management. 与 Azure 自动化不同,SMA 需要一个本地安装的程序,其中包括用于托管 API 的 Web 服务器、一个用于包含 Runbook 和 SMA 配置的数据库,以及用于执行 Runbook 作业的 Runbook 辅助角色。Unlike Azure Automation, SMA requires a local installation that includes web servers to host the API, a database to contain runbooks and SMA configuration, and Runbook Workers to execute runbook jobs. Azure 自动化在云中提供这些服务,只要求在本地环境中维护混合 Runbook 辅助角色。Azure Automation provides these services in the cloud and only requires you to maintain the Hybrid Runbook Workers in your local environment.

如果已经是 SMA 用户,则可以将 Runbook 移到 Azure 自动化处与混合 Runbook 辅助角色一起使用,不需要进行任何更改,但前提是这些 Runbook 对在混合 Runbook 辅助角色上运行 Runbook 中所述的资源执行自己的身份验证。If you are an existing SMA user, you can move your runbooks to Azure Automation to be used with Hybrid Runbook Worker with no changes, assuming that they perform their own authentication to resources as described in run runbooks on a Hybrid Runbook Worker. SMA 中的 Runbook 在辅助角色服务器的服务帐户的上下文中运行,此服务器可以为 Runbook 提供该身份验证。Runbooks in SMA run in the context of the service account on the worker server, which may provide that authentication for the runbooks.

可以使用以下条件来确定是带有混合 Runbook 辅助角色的 Azure 自动化还是 Service Management 自动化更适合要求。You can use the following criteria to determine whether Azure Automation with Hybrid Runbook Worker or Service Management Automation is more appropriate for your requirements.

  • 如果需要图形管理界面,SMA 要求在本地安装与 Windows Azure Pack 连接的基础组件。SMA requires a local installation of its underlying components that are connected to Windows Azure Pack if a graphical management interface is required. SMA 需要其他一些本地资源,这些资源的维护成本高于 Azure 自动化,后者只需在本地 Runbook 辅助角色中安装一个代理。More local resources are needed with higher maintenance costs than Azure Automation, which only needs an agent installed on local runbook workers. 代理由 Azure 管理,这进一步降低了维护成本。The agents are managed by Azure, further decreasing your maintenance costs.
  • Azure 自动化在云中存储其 Runbook,并将这些 Runbook 传送给本地混合 Runbook 辅助角色。Azure Automation stores its runbooks in the cloud and delivers them to on-premises Hybrid Runbook Workers. 如果安全策略不允许此行为,则应使用 SMA。If your security policy does not allow this behavior, then you should use SMA.
  • System Center 随附了 SMA;因此,需要 System Center 2012 R2 的许可证。SMA is included with System Center; and therefore, requires a System Center 2012 R2 license. Azure 自动化基于分层订阅模型。Azure Automation is based on a tiered subscription model.
  • Azure 自动化包含 SMA 所不能提供的一些高级功能,例如图形 Runbook。Azure Automation has advanced features such as graphical runbooks that are not available in SMA.

安装 Windows 混合 Runbook 辅助角色Installing the Windows Hybrid Runbook Worker

若要安装和配置 Windows 混合 Runbook 辅助角色,可以使用两种方法。To install and configure a Windows Hybrid Runbook Worker, there are two methods available. 建议的方法是使用自动化 Runbook 来彻底实现配置 Windows 计算机所需的过程的自动化。The recommended method is using an Automation runbook to completely automate the process required to configure a Windows computer. 第二种方法使用分步过程来手动安装和配置角色。The second method is following a step-by-step procedure to manually install and configure the role.

备注

为了使用所需状态配置 (DSC) 管理支持混合 Runbook 辅助角色的服务器配置,需将其添加为 DSC 节点。To manage the configuration of your servers supporting the Hybrid Runbook Worker role with Desired State Configuration (DSC), you need to add them as DSC nodes. 若要进一步了解如何载入它们以供 DSC 管理,请参阅载入由 Azure 自动化 DSC 管理的计算机For more information about onboarding them for management with DSC, see Onboarding machines for management by Azure Automation DSC.

如果启用更新管理解决方案,任何连接到 Log Analytics 工作区的 Windows 计算机将自动配置为混合 Runbook 辅助角色,以支持此解决方案中包括的 Runbook。If you enable the Update Management solution, any Windows computer connected to your Log Analytics workspace is automatically configured as a Hybrid Runbook Worker to support runbooks included in this solution. 但是,该计算机未注册到任何已在自动化帐户中定义的混合辅助角色组。However, it is not registered with any Hybrid Worker groups already defined in your Automation account. 只要将同一个帐户同时用于解决方案和混合 Runbook 辅助角色组成员身份,即可将该计算机添加到自动化帐户的混合 Runbook 辅助角色组,以支持自动化 Runbook。The computer can be added to a Hybrid Runbook Worker group in your Automation account to support Automation runbooks as long as you are using the same account for both the solution and Hybrid Runbook Worker group membership. 此功能已添加到 7.2.12024.0 版本的混合 Runbook 辅助角色。This functionality has been added to version 7.2.12024.0 of the Hybrid Runbook Worker.

开始部署混合 Runbook 辅助角色之前,请先查看以下信息:硬件和软件要求以及网络准备相关信息Review the following information regarding the hardware and software requirements and information for preparing your network before you begin deploying a Hybrid Runbook Worker. 成功部署 Runbook 辅助角色后,请查看在混合 Runbook 辅助角色上运行 Runbook,了解如何配置 Runbook,使本地数据中心或其他云环境中的过程实现自动化。After you have successfully deployed a runbook worker, review run runbooks on a Hybrid Runbook Worker to learn how to configure your runbooks to automate processes in your on-premises datacenter or other cloud environment.

自动化部署Automated deployment

执行以下步骤,以便自动完成 Windows 混合辅助角色的安装和配置。Perform the following steps to automate the installation and configuration of the Windows Hybrid Worker role.

  1. 直接从运行混合 Runbook 辅助角色的计算机或环境中的其他计算机的 PowerShell 库下载 New-OnPremiseHybridWorker.ps1 脚本,并将其复制到辅助角色。Download the New-OnPremiseHybridWorker.ps1 script from the PowerShell Gallery directly from the computer running the Hybrid Runbook Worker role or from another computer in your environment and copy it to the worker.

    在执行期间,New-OnPremiseHybridWorker.ps1 脚本需要以下参数:The New-OnPremiseHybridWorker.ps1 script requires the following parameters during execution:

    • AutomationAccountName(必需)- 自动化帐户的名称。AutomationAccountName (mandatory) - The name of your Automation account.
    • AAResourceGroupName(必需)- 与自动化帐户关联的资源组的名称。AAResourceGroupName (mandatory) - The name of the resource group associated with your Automation account
    • OMSResourceGroupName(可选)- OMS 工作区的资源组名称。OMSResourceGroupName (optional) - The name of the resource group for the OMS workspace. 如果未指定,将使用 AAResourceGroupName。If not specified, the AAResourceGroupName is used.
    • HybridGroupName(必需)- 混合 Runbook 辅助角色组的名称,可将其指定为支持此方案的 Runbook 的目标。HybridGroupName (mandatory) - The name of a Hybrid Runbook Worker group that you specify as a target for the runbooks supporting this scenario.
    • SubscriptionID(必需)- 包含自动化帐户的 Azure 订阅 ID。SubscriptionID (mandatory) - The Azure Subscription ID that your Automation account is in.
    • WorkspaceName(可选)- Log Analytics 工作区名称。WorkspaceName (optional) - The Log Analytics workspace name. 如果没有 Log Analytics 工作区,该脚本会创建并配置一个。If you do not have a Log Analytics workspace, the script creates and configures one.

      备注

      目前可与 Log Analytics 集成的自动化区域仅限:澳大利亚东南部、美国东部 2、东南亚以及西欧。Currently the only Automation regions supported for integration with Log Analytics are - Australia Southeast, East US 2, Southeast Asia, and West Europe. 如果自动化帐户不在其中的某个区域,脚本会创建 Log Analytics 工作区,但会警告用户:无法将这些区域链接到一起。If your Automation account is not in one of those regions, the script creates a Log Analytics workspace but it warns you that it cannot link them together.

  2. 在计算机的“管理员”模式下,从“开始”屏幕启动 Windows PowerShellOn your computer, start Windows PowerShell from the Start screen in Administrator mode.

  3. 从 PowerShell 命令行 shell 中,导航到已下载脚本所在的文件夹并执行该脚本,请记得更改 -AutomationAccountName、-AAResourceGroupName、-OMSResourceGroupName、-HybridGroupName、-SubscriptionId 和 -WorkspaceName 参数的值。From the PowerShell command-line shell, navigate to the folder, which contains the script you downloaded and execute it changing the values for parameters -AutomationAccountName, -AAResourceGroupName, -OMSResourceGroupName, -HybridGroupName, -SubscriptionId, and -WorkspaceName.

    备注

    执行脚本后,系统会提示在 Azure 上进行身份验证。You are prompted to authenticate with Azure after you execute the script. 必须以订阅管理员角色成员和订阅共同管理员的帐户登录。You must sign in with an account that is a member of the Subscription Admins role and co-administrator of the subscription.

    .\New-OnPremiseHybridWorker.ps1 -AutomationAccountName <NameofAutomationAccount> -AAResourceGroupName <NameofResourceGroup>`
    -OMSResourceGroupName <NameofOResourceGroup> -HybridGroupName <NameofHRWGroup> `
    -SubscriptionId <AzureSubscriptionId> -WorkspaceName <NameOfLogAnalyticsWorkspace>
    
  4. 系统会提示用户同意安装 NuGet 并使用 Azure 凭据进行身份验证。You are prompted to agree to install NuGet and you are prompted to authenticate with your Azure credentials.

  5. 脚本完成后,“混合辅助角色组”边栏选项卡会显示新组和成员数,或者会将成员数进行递增(如果组已存在)。After the script is complete, the Hybrid Worker Groups blade will show the new group and number of members or if an existing group, the number of members is incremented. 可以从“混合辅助角色组”边栏选项卡上的列表中选择组,并选择“混合辅助角色”磁贴。You can select the group from the list on the Hybrid Worker Groups blade and select the Hybrid Workers tile. 在“混合辅助角色”边栏选项卡上,会列出组的每个成员。On the Hybrid Workers blade, you see each member of the group listed.

手动部署Manual deployment

针对自动化环境执行前两个步骤一次,并对每台辅助角色计算机重复其余步骤。Perform the first two steps once for your Automation environment and then repeat the remaining steps for each worker computer.

1.创建 Log Analytics 工作区1. Create Log Analytics workspace

如果尚无 Log Analytics 工作区,请按照管理工作区中的说明创建工作区。If you do not already have a Log Analytics workspace, then create one using instructions at Manage your workspace. 如果已经有一个工作区,则可以使用现有的。You can use an existing workspace if you already have one.

2.向 Log Analytics 工作区添加自动化解决方案2. Add Automation solution to Log Analytics workspace

解决方案向 Log Analytics 添加功能。Solutions add functionality to Log Analytics. 自动化解决方案增加 Azure 自动化的功能,包括支持混合 Runbook 辅助角色。The Automation solution adds functionality for Azure Automation including support for Hybrid Runbook Worker. 将解决方案添加到工作区时,它会自动将辅助角色组件往下推送到在下一步要安装的代理计算机。When you add the solution to your workspace, it automatically pushes down worker components to the agent computer that you will install in the next step.

请根据使用解决方案库添加解决方案中的说明,将自动化解决方案添加到 Log Analytics 工作区。Follow the instructions at To add a solution using the Solutions Gallery to add the Automation solution to your Log Analytics workspace.

3.安装 Microsoft Monitoring Agent3. Install the Microsoft Monitoring Agent

Microsoft Monitoring Agent 可将计算机连接到 Log Analytics。The Microsoft Monitoring Agent connects computers to Log Analytics. 在计算机本地安装代理并将其连接到工作区时,代理会自动下载混合 Runbook 辅助角色所需的组件。When you install the agent on your on-premises computer and connect it to your workspace, it will automatically download the components required for Hybrid Runbook Worker.

按照将 Windows 计算机连接到 Log Analytics 中的说明在本地计算机上安装代理。Follow the instructions at Connect Windows computers to Log Analytics to install the agent on the on-premises computer. 可以对多台计算机重复此过程,以将多个辅助角色添加到环境。You can repeat this process for multiple computers to add multiple workers to your environment.

当 C:\Program Files\Microsoft Monitoring Agent\Agent 中出现名为 AzureAutomationFiles 的文件夹时,可确认代理已正确下载自动化解决方案。You can verify that the agent has correctly downloaded the Automation solution when it has a folder called AzureAutomationFiles in C:\Program Files\Microsoft Monitoring Agent\Agent. 若要确认混合 Runbook 辅助角色的版本,可以导航到 C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\ 并留意 \version 子文件夹。To confirm the version of the Hybrid Runbook Worker, you can navigate to C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\ and note the \version subfolder.

4.安装 Runbook 环境并连接到 Azure 自动化4. Install the runbook environment and connect to Azure Automation

将代理添加到 Log Analytics 时,自动化解决方案会向下推送 HybridRegistration PowerShell 模块,其中包含 Add-HybridRunbookWorker cmdlet。When you add an agent to Log Analytics, the Automation solution pushes down the HybridRegistration PowerShell module, which contains the Add-HybridRunbookWorker cmdlet. 使用此 cmdlet 将 Runbook 环境安装到计算机上,并将其注册到 Azure 自动化。You use this cmdlet to install the runbook environment on the computer and register it with Azure Automation.

若要导入模块,请在管理员模式下打开 PowerShell 会话,并运行以下命令:To import the module, open a PowerShell session in Administrator mode and run the following commands:

cd "C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\<version>\HybridRegistration"
Import-Module HybridRegistration.psd1

然后,请使用以下语法运行 Add-HybridRunbookWorker cmdlet:Then run the Add-HybridRunbookWorker cmdlet using the following syntax:

Add-HybridRunbookWorker –GroupName <String> -EndPoint <Url> -Token <String>

可以通过在自动化帐户中单击“帐户设置”下的“密钥”选项获取此 cmdlet 所需的信息。You can get the information required for this cmdlet by clicking Keys option under Account Settings in your Automation account.

  • GroupName 是混合 Runbook 辅助角色组的名称。GroupName is the name of the Hybrid Runbook Worker Group. 如果该组已经存在于自动化帐户中,则会将当前计算机添加到其中。If this group already exists in the automation account, then the current computer is added to it. 如果该组不存在,则会创建它。If it does not already exist, then it is added.
  • “终结点”是“密钥”页中的“URL”字段。EndPoint is the URL field in the Keys page.
  • “令牌”是指“密钥”页中的“主访问密钥”。Token is the Primary Access Key in the Keys page.

使用包含 Add-HybridRunbookWorker-Verbose 开关可接收有关安装的详细信息。Use the -Verbose switch with Add-HybridRunbookWorker to receive detailed information about the installation.

5.安装 PowerShell 模块5. Install PowerShell modules

Runbook 可以使用在 Azure 自动化环境中安装的模块中定义的任何活动和 cmdlet。Runbooks can use any of the activities and cmdlets defined in the modules installed in your Azure Automation environment. 不过,这些模块不会自动部署到本地计算机,因此必须手动安装。These modules are not automatically deployed to on-premises computers though, so you must install them manually. 例外情况是 Azure 模块,该模块是默认安装的,可以用于访问所有 Azure 服务的 cmdlet 以及 Azure 自动化的活动。The exception is the Azure module, which is installed by default providing access to cmdlets for all Azure services and activities for Azure Automation.

由于混合 Runbook 辅助角色功能的主要用途是管理本地资源,很可能需要安装支持这些资源的模块。Since the primary purpose of the Hybrid Runbook Worker feature is to manage local resources, you most likely need to install the modules that support these resources. 可以参考 Installing Modules(安装模块),获取有关安装 Windows PowerShell 模块的信息。You can refer to Installing Modules for information on installing Windows PowerShell modules. 安装的模块必须位于 PSModulePath 环境变量所引用的位置,以便混合辅助角色自动将其导入。Modules that are installed must be in a location referenced by PSModulePath environment variable so that they are automatically imported by the Hybrid worker. 有关详细信息,请参阅 Modifying the PSModulePath Installation Path(修改 PSModulePath 安装路径)。For more information, see Modifying the PSModulePath Installation Path.

删除混合 Runbook 辅助角色Removing Hybrid Runbook Worker

可以从组中删除一个或多个混合 Runbook 辅助角色,或者根据要求删除该组。You can remove one or more Hybrid Runbook Workers from a group or you can remove the group, depending on your requirements. 若要从本地计算机中删除混合 Runbook 辅助角色,请执行以下步骤:To remove a Hybrid Runbook Worker from an on-premises computer, perform the following steps:

  1. 在 Azure 门户中,导航到自动化帐户。In the Azure portal, navigate to your Automation account.
  2. 在“设置”边栏选项卡中,选择“密钥”并记下“URL”和“主访问密钥”字段的值。From the Settings blade, select Keys and note the values for field URL and Primary Access Key. 下一步需要用到此信息。You need this information for the next step.
  3. 在管理员模式下打开 PowerShell 会话,并运行以下命令 - Remove-HybridRunbookWorker -url <URL> -key <PrimaryAccessKey>Open a PowerShell session in Administrator mode and run the following command - Remove-HybridRunbookWorker -url <URL> -key <PrimaryAccessKey>. 可使用 -Verbose 开关获取删除过程的详细日志。Use the -Verbose switch for a detailed log of the removal process.

备注

这不会从计算机中删除 Microsoft 监视代理,而只会删除混合 Runbook 辅助角色的功能和配置。This does not remove the Microsoft Monitoring Agent from the computer, only the functionality and configuration of the Hybrid Runbook Worker role.

删除混合辅助角色组Remove Hybrid Worker groups

要删除某个组,首先需要使用前面所示的过程,从每台计算机中删除属于该组的混合 Runbook 辅助角色,然后执行以下步骤删除该组。To remove a group, you first need to remove the Hybrid Runbook Worker from every computer that is a member of the group using the procedure shown earlier, and then you perform the following steps to remove the group.

  1. 在 Azure 门户中打开自动化帐户。Open the Automation account in the Azure portal.
  2. 在“流程自动化”下选择“混合辅助角色组”。Under Process Automation, select Hybrid worker groups. 选择要删除的组。Select the group you wish to delete. 在选择特定的组之后,会显示“混合辅助角色组”属性边栏选项卡。After selecting the specific group, the Hybrid worker group properties blade is displayed.

    混合 Runbook 辅助角色组边栏选项卡

  3. 在所选组的属性边栏选项卡中,单击“删除”。On the properties blade for the selected group, click Delete. 此时会显示一条消息请求确认此操作,如果确定要继续,请选择“是”。A message appears asking you to confirm this action, select Yes if you are sure you want to proceed.

    确认删除组对话框

    此过程需要几秒钟才能完成,可以在菜单中的“通知”下面跟踪进度。This process can take several seconds to complete and you can track its progress under Notifications from the menu.

故障排除Troubleshooting

混合 Runbook 辅助角色依靠 Microsoft Monitoring Agent 与自动化帐户通信,以注册辅助角色、接收 Runbook 作业和报告状态。The Hybrid Runbook Worker depends on the Microsoft Monitoring Agent to communicate with your Automation account to register the worker, receive runbook jobs, and report status. 如果辅助角色注册失败,以下是一些可能导致此错误的原因:If registration of the worker fails, here are some possible causes for the error:

  1. 混合辅助角色在代理或防火墙后面。The hybrid worker is behind a proxy or firewall.

    确保计算机在端口 443 上对 *.azure-automation.net 有出站访问权限。Verify the computer has outbound access to *.azure-automation.net on port 443.

  2. 运行混合辅助角色的计算机不满足最低硬件要求The computer the hybrid worker is running on has less than the minimum hardware requirements.

    运行混合 Runbook 辅助角色的计算机应满足最低硬件要求,才能指定它托管此功能。Computers running the Hybrid Runbook Worker should meet the minimum hardware requirements before designating it to host this feature. 否则,在执行过程中,根据其他后台进程的资源使用率和 runbook 所导致的争用,该计算机将变为过度使用,从而导致 runbook 作业延迟或超时。Otherwise, depending on the resource utilization of other background processes and contention caused by runbooks during execution, the computer becomes over utilized and cause runbook job delays or timeouts.

    确认指定为运行混合 Runbook 辅助角色功能的计算机满足最低硬件要求。Confirm the computer designated to run the Hybrid Runbook Worker feature meets the minimum hardware requirements. 如果满足,请监视 CPU 和内存利用率,以确定混合 Runbook 辅助角色进程的性能和 Windows 之间的任何关联。If it does, monitor CPU and memory utilization to determine any correlation between the performance of Hybrid Runbook Worker processes and Windows. 如果存在内存或 CPU 压力,这可能指示需要升级或添加额外的处理器或增加内存来解决资源瓶颈问题,从而解决此错误。If there is memory or CPU pressure, this may indicate the need to upgrade or add additional processors, or increase memory to address the resource bottleneck and resolve the error. 或者,选择其他可支持最低要求的计算资源,并在工作负荷需求指示需要增加时进行扩展。Alternatively, select a different compute resource that can support the minimum requirements and scale when workload demands indicate an increase is necessary.

  3. Microsoft Monitoring Agent 服务未运行。The Microsoft Monitoring Agent service is not running.

    如果 Microsoft Monitoring Agent Windows 服务未运行,会导致混合 Runbook 辅助角色无法与 Azure 自动化通信。If the Microsoft Monitoring Agent Windows service is not running, this prevents the Hybrid Runbook Worker from communicating with Azure Automation. 在 PowerShell 中输入以下命令,验证代理是否正在运行:get-service healthserviceVerify the agent is running by entering the following command in PowerShell: get-service healthservice. 如果该服务已停止,请在 PowerShell 中输入以下命令启动该服务:start-service healthserviceIf the service is stopped, enter the following command in PowerShell to start the service: start-service healthservice.

  4. 在 Application and Services Logs\Operations Manager 事件日志中,可看到事件 4502、包含 Microsoft.EnterpriseManagement.HealthService.AzureAutomation.HybridAgent 的 EventMessage 以及下列描述:服务 <wsid>.oms.opinsights.azure.com 提供的证书不是由 Microsoft 服务使用的证书颁发机构颁发的。请联系网络管理员以查看其是否正在运行截获 TLS/SSL 通信的代理。KB3126513 一文还介绍了关于连接问题的其他故障排除信息。In the Application and Services Logs\Operations Manager event log, you see event 4502 and EventMessage containing Microsoft.EnterpriseManagement.HealthService.AzureAutomation.HybridAgent with the following description: The certificate presented by the service <wsid>.oms.opinsights.azure.com was not issued by a certificate authority used for Microsoft services. Please contact your network administrator to see if they are running a proxy that intercepts TLS/SSL communication. The article KB3126513 has additional troubleshooting information for connectivity issues. 这可能是因为代理或网络防火墙阻止与 Microsoft Azure 通信。This can be caused by your proxy or network firewall blocking communication to Microsoft Azure. 确保计算机在端口 443 上对 *.azure-automation.net 有出站访问权限。Verify the computer has outbound access to *.azure-automation.net on ports 443.

日志存储在每个混合辅助角色本地的 C:\ProgramData\Microsoft\System Center\Orchestrator\7.2\SMA\Sandboxes 中。Logs are stored locally on each hybrid worker at C:\ProgramData\Microsoft\System Center\Orchestrator\7.2\SMA\Sandboxes. 可以检查 Application and Services Logs\Microsoft-SMA\OperationsApplication and Services Logs\Operations Manager 事件日志中是否写入了任何警告或错误事件,指示出现了影响角色载入 Azure 自动化的连接问题或其他问题,或者在执行正常操作时出现问题。You can check if there are any warning or error events written to the Application and Services Logs\Microsoft-SMA\Operations and Application and Services Logs\Operations Manager event log that would indicate a connectivity or other issue affecting onboarding of the role to Azure Automation or issue while performing normal operations.

后续步骤Next steps

查看在混合 Runbook 辅助角色上运行 Runbook,了解如何配置 Runbook,使本地数据中心或其他云环境中的过程实现自动化。Review run runbooks on a Hybrid Runbook Worker to learn how to configure your runbooks to automate processes in your on-premises datacenter or other cloud environment.