Skip to content

Commit b0edf56

Browse files
authored
Update investigate-missing-telemetry.md
Edit review per CI 7846
1 parent 91a4529 commit b0edf56

1 file changed

Lines changed: 51 additions & 28 deletions

File tree

support/azure/azure-monitor/app-insights/telemetry/investigate-missing-telemetry.md

Lines changed: 51 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ A sample telemetry record that's correctly saved and displayed means:
6666
- Log Analytics correctly saved the sample record.
6767
- The Azure portal **Logs** tab is able to query the API (`api.applicationinsights.io`) and render the sample record in the Azure portal.
6868

69-
If the generated sample record arrives at your Application Insights instance and you can query for the sample record by using the **Logs resource** menu, [troubleshoot the Application Insights SDK or agent](#troubleshoot-application-insights-sdk-agent). You can then proceed with collecting SDK logs, self-diagnostic logs, or profiler traces, whichever is appropriate for the SDK or agent version.
69+
If the generated sample record arrives at your Application Insights instance, and you can query for the sample record by using the **Logs resource** menu, [troubleshoot the Application Insights SDK or agent](#troubleshoot-application-insights-sdk-agent). You can now collect SDK logs, self-diagnostic logs, or profiler traces, as appropriate for the SDK or agent version.
7070

7171
The following sections provide information about sending a sample telemetry record using PowerShell or curl.
7272

@@ -287,32 +287,32 @@ If tests performed by using PowerShell or curl fail to send telemetry to the ing
287287
288288
## Troubleshoot Microsoft Entra authentication issues
289289
290-
This section provides distinct troubleshooting scenarios and steps to resolve [Microsoft Entra authentication](/azure/azure-monitor/app/azure-ad-authentication) issues before contacting support.
290+
This section provides distinct troubleshooting scenarios and steps to resolve [Microsoft Entra authentication](/azure/azure-monitor/app/azure-ad-authentication) issues before you contact Microsoft support.
291291
292292
### Ingestion HTTP errors
293293
294-
The ingestion service returns specific errors regardless of the SDK language. Network traffic can be collected by using a tool like Fiddler. Be sure to filter traffic to the ingestion endpoint set in the connection string.
294+
The ingestion service returns specific errors regardless of the SDK language. Network traffic can be collected by using a tool such as Fiddler. Make sure that you filter traffic to the ingestion endpoint that's set in the connection string.
295295
296296
### HTTP/1.1 400 Authentication not supported
297297
298-
This error shows the resource is set for Microsoft Entra-only.
298+
This error shows that the resource is set as Microsoft Entra-only.
299299
300-
Review and correctly configure the SDK because it's sending to the wrong API.
300+
Review and configure the SDK correctly because it's sending to the wrong API.
301301
302302
> [!NOTE]
303-
> `v2/track` doesn't support Microsoft Entra ID. When the SDK is correctly configured, telemetry is sent to `v2.1/track`.
303+
> `v2/track` doesn't support Microsoft Entra ID. If the SDK is configured correctly, telemetry is sent to `v2.1/track`.
304304
305305
#### HTTP/1.1 401 Authorization required
306306
307-
This error indicates that the SDK is correctly configured but it's unable to acquire a valid token. This error might indicate an issue with Microsoft Entra ID.
307+
This error indicates that the SDK is configured correctly but can't acquire a valid token. This error might indicate that an issue that affects Microsoft Entra ID exists.
308308
309309
Identify exceptions in the SDK logs or network errors from Azure Identity.
310310
311311
#### HTTP/1.1 403 Unauthorized
312312
313-
This error means the SDK uses credentials without permission for the Application Insights resource or subscription.
313+
This error means that the SDK uses credentials without permission for the Application Insights resource or subscription.
314314
315-
Check the Application Insights resource's access control. You must configure the SDK with credentials that have the Monitoring Metrics Publisher role.
315+
Check the access control for the Application Insights resource. You must configure the SDK by using credentials that have the Monitoring Metrics Publisher role.
316316
317317
### Language-specific troubleshooting
318318
@@ -322,13 +322,13 @@ Check the Application Insights resource's access control. You must configure the
322322
323323
The Application Insights .NET SDK emits error logs by using the event source. To learn more about collecting event source logs, see [Troubleshooting no data - collect logs with PerfView](asp-net-troubleshoot-no-data.md#collect-logs-with-perfview).
324324
325-
If the SDK fails to get a token, the exception message is logged as `Failed to get AAD Token. Error message:`.
325+
If the SDK doesn't get a token, the exception message is logged as "Failed to get AAD Token. Error message:."
326326
327327
### [Java](#tab/java)
328328
329329
#### HTTP traffic
330330
331-
You can inspect network traffic by using a tool like Fiddler. To enable the traffic to tunnel through Fiddler, either add the following proxy settings in the configuration file:
331+
You can inspect network traffic by using a tool such as Fiddler. To enable the traffic to tunnel through Fiddler, add the following proxy settings in the configuration file:
332332
333333
```JSON
334334
"proxy": {
@@ -337,36 +337,59 @@ You can inspect network traffic by using a tool like Fiddler. To enable the traf
337337
}
338338
```
339339

340-
Or add the following Java Virtual Machine (JVM) arguments (args) while running your application: `-Djava.net.useSystemProxies=true -Dhttps.proxyHost=localhost -Dhttps.proxyPort=8888`
340+
Alternatively, add the following Java Virtual Machine (JVM) arguments while running your application:
341341

342-
If Microsoft Entra ID is enabled in the agent, outbound traffic includes the HTTP header `Authorization`.
342+
> `-Djava.net.useSystemProxies=true -Dhttps.proxyHost=localhost -Dhttps.proxyPort=8888`
343+
344+
If Microsoft Entra ID is enabled in the agent, outbound traffic includes the `Authorization` HTTP header.
343345

344346
#### 401 Unauthorized
345347

346-
If you see the message `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 401, please check your credentials` in the log, it means the agent couldn't send telemetry. You likely didn't enable Microsoft Entra authentication on the agent while your Application Insights resource has `DisableLocalAuth: true`. Ensure you pass a valid credential with access permission to your Application Insights resource.
348+
You might see the following entry in the log:
349+
350+
> `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 401, please check your credentials`
351+
352+
This message means that the agent can't send telemetry. In this situation, you likely didn't enable Microsoft Entra authentication on the agent while your Application Insights resource had `DisableLocalAuth: true`. Make sure that you pass a valid credential that has access permission to your Application Insights resource.
347353

348-
If you're using Fiddler, you might see the response header `HTTP/1.1 401 Unauthorized - please provide the valid authorization token`.
354+
If you use Fiddler, you might see the following response header:
355+
356+
> `HTTP/1.1 401 Unauthorized - please provide the valid authorization token`
349357
350358
#### CredentialUnavailableException
351359

352-
If you see the exception `com.azure.identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. Connection to IMDS endpoint cannot be established` in the log file, it means the agent failed to acquire the access token. The likely cause is an invalid client ID in your User-Assigned Managed Identity configuration.
360+
You might see the following entry in the log file:
361+
362+
> `com.azure.identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. Connection to IMDS endpoint cannot be established`
363+
364+
This exception means that the agent didn't acquire the access token. The likely cause is an invalid client ID in your User-Assigned Managed Identity configuration.
353365

354366
#### Failed to send telemetry
355367

356-
If you see the message `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 403, please check your credentials` in the log, it means the agent couldn't send telemetry. The likely reason is that the credentials used don't allow telemetry ingestion.
368+
You might see the following message in the log:
357369

358-
Using Fiddler, you might notice the response `HTTP/1.1 403 Forbidden - provided credentials do not grant the access to ingest the telemetry into the component`.
370+
. `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 403, please check your credentials`
359371

360-
The issue can be due to:
372+
This message means that the agent can't send telemetry. The likely reason is that the credentials that are used don't allow telemetry ingestion.
361373

362-
- Creating the resource with a system-assigned managed identity or associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it.
363-
- Using the correct credentials for access tokens but linking them to the wrong Application Insights resource. Ensure your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource.
374+
If you use Fiddler, you might notice the following response:
375+
376+
> "HTTP/1.1 403 Forbidden - provided credentials do not grant the access to ingest the telemetry into the component"
377+
378+
This issue can be caused by any of the following actions:
379+
380+
- Creating a resource that has a system-assigned managed identity.
381+
- Associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it.
382+
- Using the correct credentials for access tokens, but linking them to the wrong Application Insights resource. In this situation, make sure that your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource.
364383

365384
#### Invalid Client ID
366385

367-
If you see the exception `com.microsoft.aad.msal4j.MsalServiceException: Application with identifier <CLIENT_ID> was not found in the directory` in the log, it means the agent failed to get the access token. This exception likely happens because the client ID in your client secret configuration is invalid or incorrect.
386+
You might see the following exception in the log:
387+
388+
> `com.microsoft.aad.msal4j.MsalServiceException: Application with identifier <CLIENT_ID> was not found in the directory`
389+
390+
This means that the agent didn't get the access token. This exception likely occurs because the client ID in your client secret configuration is invalid or incorrect.
368391

369-
This issue occurs if the admin doesn't install the application or no tenant user consents to it. It also happens if you send your authentication request to the wrong tenant.
392+
This issue occurs if the admin doesn't install the application or if no tenant user consents to it. It occurs also if you send your authentication request to the wrong tenant.
370393

371394
### [Java native](#tab/java-native)
372395

@@ -375,7 +398,7 @@ This issue occurs if the admin doesn't install the application or no tenant user
375398
376399
### [Node.js](#tab/nodejs)
377400

378-
Turn on internal logs by using the following setup. After you enable them, the console shows error logs including any error related to Microsoft Entra integration. Examples include failing to generate the token with the wrong credentials or errors when the ingestion endpoint fails to authenticate using the provided credentials.
401+
Turn on internal logs by using the following setup. After you enable the logs, the console shows error logs, including any errors that are related to Microsoft Entra integration. Examples include failing to generate the token with the wrong credentials or if the ingestion endpoint doesn't authenticate by using the provided credentials.
379402

380403
```javascript
381404
let appInsights = require("applicationinsights");
@@ -390,13 +413,13 @@ Something is incorrect about the credential you're using and the client isn't ab
390413

391414
### Error starts with "authentication error" (with no status code)
392415

393-
The client failed to authenticate with the given credential. This error usually occurs when the credential used doesn't have the correct role assignments.
416+
The client failed to authenticate with the given credential. This error usually occurs if the credential used doesn't have the correct role assignments.
394417

395-
### I'm getting a status code 400 in my error logs
418+
### Status code 400 is logged in the error logs
396419

397-
You're probably missing a credential or your credential is set to `None`, but your Application Insights resource is configured with `DisableLocalAuth: true`. Make sure you're passing in a valid credential and that it has permission to access your Application Insights resource.
420+
You're probably missing a credential or your credential is set to `None`, but your Application Insights resource is configured with `DisableLocalAuth: true`. Make sure that you pass in a valid credential and that it has permission to access your Application Insights resource.
398421

399-
### I'm getting a status code 403 in my error logs
422+
### Status code 403 is logged in error logs
400423

401424
This error usually occurs when the provided credentials don't grant access to ingest telemetry for the Application Insights resource. Make sure your Application Insights resource has the correct role assignments.
402425

0 commit comments

Comments
 (0)