Troubleshooting on-demand assessments (2023)

Download the test debug script

Download and run itRating bug fix scriptto self-assess and troubleshoot on-demand assessments. See the full troubleshooting guide below:

The following steps will guide you from start to finish and let you verify the accuracy of each requirement that must be met when running on-demand assessments:

The most common problems that users encounter are: (You can find instructions on how to solve these problems further down in the article)

1. If you run the assessment but see no data in Log Analytics -> Restart Healthservice when data file collection is pending.

2. Error message: "You do not have access to Azure Log Analytics" in Service Hub -> IT Health -> On-Demand Assessments.

Problems installing Microsoft Monitoring Agent (MMA).

The link to the workspace specified as part of the MMA installation could not be established successfully

Sometimes the MMA agent fails to successfully connect to the workspace during installation when providing the credentials (ID and key) of the Azure Log Analytics (OMS) workspace. A workaround that sometimes works is to remove the WorkspaceId and key and install the MMA without specifying workspaces. Then open the MMA Control Panel by going to Control Panel, Security and Settings, Microsoft Monitoring Agent, Azure Log Analytics (OMS) tab and add the desired workspace by specifying its ID and key. Then click the Apply button and make sure the green check mark appears.

Linking and Permissions

1. Click this link to watch the videoto pre-configure your on-demand assessments.
2. Make sure you have the Azure subscription owner role in the Azure subscriptionwith the same email ID you use to sign in to Services Hub.
3. After successfully linking, you should be able to see the following page in the Services Hub under the Health tab and then Ratings.
4. Confirm that the Log Analytics workspace you have access to is linked to the Services Hub. If not, ask them to relink by clicking the profile in the top right, then click Edit Log Analytics workspace and link the workspace you want.
5. Confirm that you have added the review you want from the gallery.

Some of the most common issues when invoking a command like AddExchangeAssessmentTask are detailed below:

Windows Server 2008 R2 does not recognize Add-*AssessmentTask cmdlets

It's recommended not to run assessments on a computer running Windows Server 2008, but if you absolutely have to, you must do the following:

1. Install the latest version of Powershell and .net 4.6.2 on the Windows 2008 server. Most Windows 2008 servers have Powershell that uses .net 2.0 and does not meet the requirements.
2. Run Powershell in Administrator mode.
3. Before calling an Add-*AssessmentTask cmdlet issue:
   Import-Module $env:ProgramFiles\'Microsoft Monitoring Agent\Agent\PowerShell\Microsoft.PowerShell.Oms.Assessments\Microsoft.PowerShell.Oms.Assessments.dll'

After running this command, you can invoke the Add-*AssessmentTask cmdlets.

On any platform, if the Add-*AssessmentTask cmdlets are not recognized

1. Make sure the OMS Assessments Powershell module has been downloaded. To do this, ensure that $env:ProgramFiles\'Microsoft Monitoring Agent\Agent\PowerShell' has a subdirectory named Microsoft.PowerShell.Oms.Assessments and that there is a file named in that subdirectoryMicrosoft.PowerShell.Oms.Assessments.dll, as shown in the screenshot below:

2. If Microsoft.PowerShell.Oms.Assessments.dll does not exist, ensure that your Log Analytics workspace is linked to the Services Hub. 3. Make sure *$env:PsModulePath* contains $env:ProgramFiles\\'Microsoft Monitoring Agent\Agent\PowerShell'. 4. Make sure your installed PowerShell version is at least 4.0 (just type *$PsVersionTable* in the Powershell window) and Powershell uses CLRVersion equal to or greater than 4.0. ### Troubleshooting assessment installation errors when running an Add-*AssessmentTask cmdlet ###

1. Read the log file.
2. The location of the log file is shown in the Powershell console window. It's just an informational message - blank. Check out this location in the example screenshot below:

3. The -ScheduledTaskUserName and -ScheduledTaskPassword may be invalid - either this user does not exist or the password is invalid or expired.

Requirements to successfully run the scheduled task

Check user account group policy: Logon as batch job permission

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignments

1. Right-click on "Register as a batch job" and select Properties.
2. Click Add User or Group and add the appropriate user.

Do not forcibly unload the user registry when the user logs off

On the data collection computer, change the following setting in the Group Policy Editor (gpedit.msc) from not configured to enabled; Go to Computer Configuration, Administrative Templates, System and User Profiles.

'Do not force user registration on user logout'

Disable FIPS policy

1. In Control Panel, click Administrative Tools and double-click Local Security Policy.
2. Under Security Settings, expand Local Policies and click Security Options.

3. In the right pane, under Policy, double-click System Encryption; Use FIPS-compliant encryption, hashing, and signing algorithms and click Disabled. ### Network access: Don't allow saving passwords and credentials ### 1. This error occurs with the message: “No logon session was specified. It may have already ended.” 2. To fix this, go to SECPOL.MSC, Security Settings, Local Policies and Security Options. 3. Do not allow storage of passwords and credentials for network authentication.

4. Set the policy to Disabled.

The assessment has not been added to your workspace

If calling start-XXXAssessment results in this error: "There is no XXXAssessment.execPkg file associated with the current Log Analytics workspace..." as in the screenshot below, the reason is that the specific assessment type needs to be added to the Log Analytics workspace that the Microsoft Monitoring Agent is currently connected to. Add the assessment on the ServicesHub page. (dropdown box on the Health tab, then click the Assessments tab, then click Assessments, then wait at least 10 minutes before attempting to start the assessment.The delay is necessary for the MMA Agent to contact Log Analytics and download the management pack using XXXAssessment.execPkg.

Problems running the assessment task

Inactive/no data found in Azure Log Analytics

Check the Log Analytics agent connectivity

To ensure the agent can communicate with Azure Log Analytics, go to Control Panel, Security and Settings, Microsoft Monitoring Agent. On the Azure Log Analytics (OMS) tab, look for a green check mark.

A green tick confirms that the agent can communicate with the Azure service.

A yellow warning icon means the agent is having trouble communicating with Log Analytics.

View heartbeat messages from the AgentHealthAssessment solution

When you add the AgentHealthAssessment solution to your Log Analytics workspace through the Azure portal, you'll see useful information, including a list of machines with unresponsive agents and the last successful heartbeat time for each of those unresponsive machines.

If your computer is listed there, a common reason is that the Microsoft Monitoring Agent service (HealthService) has stopped. Use the Service Control Manager to restart the service.

If you have set up a firewall restriction, make sure the following ports are open:

• mms.microsoft.com, Portal Log Analytics
• workspaceId.ods.opinsights.azure.com,Data Collector API
• *.ods.opinsights.azure.com, Agent Communication - Configurationfirewall settings
• *.oms.opinsights.azure.com, Agent Communication - Configurationfirewall settings
• *.blob.core.windows.net, agent communication - configurefirewall settings

This can be easily checked by invoking the TestCloudConnection.exe tool located in the Microsoft Monitoring Agent\Agent\ folder as in this screenshot:

OnDemand Score data is no longer displayed in Log Analytics, but was displayed in the past

Find the scheduled task in Task Scheduler and run it manually in Task Scheduler. Make sure an OmsAssessment.exe process is running. If no processes are running, it may be because the password specified for this assessment at the time Add-XXXAssessmentTask was run is no longer valid (eg, has expired or has been changed). to see the error in bothStoryTask Scheduler tab and also on the Task Scheduler tabTaskplanerEvent log - withEvent ID101 (and 104) anderror value: 2147943726 - as shown in the next two screenshots:

Restart healthservice when data files are pending ingestion

Close all active PowerShell windows on the computer. Now if you check the assessment working directory and find the files with names like new.recommendations.*** (see screenshot below):

Open Command Prompt in Administrator mode and type: net stop healthservicenet start healthservice

After running the following command, the files will be processed as shown below, which means the files have been successfully ingested and the data should be visible in Log Analytics in about 30 minutes.

Check for conflicting omsassessment.exe processes running

Open Task Manager and look for a process called omsassessment.exe. If found, it indicates that the assessment is still in progress.

If it took a long time (e.g. you find that this process has been running longer than a day), the assessment agent may not have processed the data. So, continue with the next troubleshooting steps below.

Review any errors in the prerequisite file

Change to the evaluation working directory and examine the prerequisite files (processed.prerequisites) to find any errors mentioned for evaluation purposes.

If errors are found, such as WMI connectivity issues, the target names and the error are mentioned in this file. Please fix the problem and trigger the verification. In the Task Scheduler, expand Microsoft, Operations Management Suite, AOI***** and then Assessments to right-click the desired assessment scheduled task and click Run.

Traversed detection log file errors

Switch to the working directory of the evaluation and enter the 6 to 8-digit numbered folder within the directory. Look for a folder called Logs where you will find a file called DiscoveryTrace***.

Check for any errors or exceptions in this file and fix them as they are related to credential/permissions issues, WMI errors, network issues, etc.

Recording large files

If the following "processed.recommendations.***" files are larger than 250 MB in size, the Log Analytics agent may have difficulty processing the files. If you encounter this scenario and cannot see the data in Log Analytics, please contact serviceshubteam@ppas.uservoice.com and let us know your issue.

Try to reduce the number of targets per assessment schedule

If you are running Windows Server, Windows Client or SQL Assessment and have added more than 5 targets in a single scheduled task, it is sometimes possible that the assessment agent cannot process that many targets at the same time. If this scenario occurs, use the following cmdlet to remove all existing settings:

Remove-WindowsClientAssessmentTaskRemove-WindowsServerAssessmentTaskRemove-SQLAssessmentTask

Now run Add-AssessmentTasks again with fewer targets. You can add multiple of these tasks and create batches of tasks with 3-5 objectives per task, which would result in faster assessment of the whole environment.

Review the planned task distribution and uploader log files

In the Assessments working directory is a \Logs\ folder that contains the following*Command*.log e*Module*.Recording. the*Command*The .log file contains data about the scheduled task that starts the powershell cmdlet and can be used to find out why the scheduled task didn't start. If this file is not created when the ODA scheduled task starts, it usually indicates a password error.

Ö*Module*The .log file contains data about the health service and its attempts to upload data to the Azure Log Analytics cloud.

The Applications and Services Logs\Operations Manager event log also contains information that can be used to troubleshoot various issues.

For general comments about the Resource Center or the content, please send your comments to your Microsoft representative. For specific inquiries and content updates related to the Services Hub, please contact our support team atsubmit a case.