You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/azure/azure-monitor/app-insights/telemetry/investigate-missing-telemetry.md
+51-28Lines changed: 51 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -66,7 +66,7 @@ A sample telemetry record that's correctly saved and displayed means:
66
66
- Log Analytics correctly saved the sample record.
67
67
- The Azure portal **Logs** tab is able to query the API (`api.applicationinsights.io`) and render the sample record in the Azure portal.
68
68
69
-
If the generated sample record arrives at your Application Insights instance and you can query for the sample record by using the **Logs resource** menu, [troubleshoot the Application Insights SDK or agent](#troubleshoot-application-insights-sdk-agent). You can then proceed with collecting SDK logs, self-diagnostic logs, or profiler traces, whichever is appropriate for the SDK or agent version.
69
+
If the generated sample record arrives at your Application Insights instance, and you can query for the sample record by using the **Logs resource** menu, [troubleshoot the Application Insights SDK or agent](#troubleshoot-application-insights-sdk-agent). You can now collect SDK logs, self-diagnostic logs, or profiler traces, as appropriate for the SDK or agent version.
70
70
71
71
The following sections provide information about sending a sample telemetry record using PowerShell or curl.
72
72
@@ -287,32 +287,32 @@ If tests performed by using PowerShell or curl fail to send telemetry to the ing
287
287
288
288
## Troubleshoot Microsoft Entra authentication issues
289
289
290
-
This section provides distinct troubleshooting scenarios and steps to resolve [Microsoft Entra authentication](/azure/azure-monitor/app/azure-ad-authentication) issues before contacting support.
290
+
This section provides distinct troubleshooting scenarios and steps to resolve [Microsoft Entra authentication](/azure/azure-monitor/app/azure-ad-authentication) issues before you contact Microsoft support.
291
291
292
292
### Ingestion HTTP errors
293
293
294
-
The ingestion service returns specific errors regardless of the SDK language. Network traffic can be collected by using a tool like Fiddler. Be sure to filter traffic to the ingestion endpoint set in the connection string.
294
+
The ingestion service returns specific errors regardless of the SDK language. Network traffic can be collected by using a tool such as Fiddler. Make sure that you filter traffic to the ingestion endpoint that's set in the connection string.
295
295
296
296
### HTTP/1.1 400 Authentication not supported
297
297
298
-
This error shows the resource is set for Microsoft Entra-only.
298
+
This error shows that the resource is set as Microsoft Entra-only.
299
299
300
-
Review and correctly configure the SDK because it's sending to the wrong API.
300
+
Review and configure the SDK correctly because it's sending to the wrong API.
301
301
302
302
> [!NOTE]
303
-
> `v2/track` doesn't support Microsoft Entra ID. When the SDK is correctly configured, telemetry is sent to `v2.1/track`.
303
+
> `v2/track` doesn't support Microsoft Entra ID. If the SDK is configured correctly, telemetry is sent to `v2.1/track`.
304
304
305
305
#### HTTP/1.1 401 Authorization required
306
306
307
-
This error indicates that the SDK is correctly configured but it's unable to acquire a valid token. This error might indicate an issue with Microsoft Entra ID.
307
+
This error indicates that the SDK is configured correctly but can't acquire a valid token. This error might indicate that an issue that affects Microsoft Entra ID exists.
308
308
309
309
Identify exceptions in the SDK logs or network errors from Azure Identity.
310
310
311
311
#### HTTP/1.1 403 Unauthorized
312
312
313
-
This error means the SDK uses credentials without permission for the Application Insights resource or subscription.
313
+
This error means that the SDK uses credentials without permission for the Application Insights resource or subscription.
314
314
315
-
Check the Application Insights resource's access control. You must configure the SDK with credentials that have the Monitoring Metrics Publisher role.
315
+
Check the access control for the Application Insights resource. You must configure the SDK by using credentials that have the Monitoring Metrics Publisher role.
316
316
317
317
### Language-specific troubleshooting
318
318
@@ -322,13 +322,13 @@ Check the Application Insights resource's access control. You must configure the
322
322
323
323
The Application Insights .NET SDK emits error logs by using the event source. To learn more about collecting event source logs, see [Troubleshooting no data - collect logs with PerfView](asp-net-troubleshoot-no-data.md#collect-logs-with-perfview).
324
324
325
-
If the SDK fails to get a token, the exception message is logged as `Failed to get AAD Token. Error message:`.
325
+
If the SDK doesn't get a token, the exception message is logged as "Failed to get AAD Token. Error message:."
326
326
327
327
### [Java](#tab/java)
328
328
329
329
#### HTTP traffic
330
330
331
-
You can inspect network traffic by using a tool like Fiddler. To enable the traffic to tunnel through Fiddler, either add the following proxy settings in the configuration file:
331
+
You can inspect network traffic by using a tool such as Fiddler. To enable the traffic to tunnel through Fiddler, add the following proxy settings in the configuration file:
332
332
333
333
```JSON
334
334
"proxy": {
@@ -337,36 +337,59 @@ You can inspect network traffic by using a tool like Fiddler. To enable the traf
337
337
}
338
338
```
339
339
340
-
Or add the following Java Virtual Machine (JVM) arguments (args) while running your application: `-Djava.net.useSystemProxies=true -Dhttps.proxyHost=localhost -Dhttps.proxyPort=8888`
340
+
Alternatively, add the following Java Virtual Machine (JVM) arguments while running your application:
341
341
342
-
If Microsoft Entra ID is enabled in the agent, outbound traffic includes the HTTP header `Authorization`.
If Microsoft Entra ID is enabled in the agent, outbound traffic includes the `Authorization` HTTP header.
343
345
344
346
#### 401 Unauthorized
345
347
346
-
If you see the message `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 401, please check your credentials` in the log, it means the agent couldn't send telemetry. You likely didn't enable Microsoft Entra authentication on the agent while your Application Insights resource has `DisableLocalAuth: true`. Ensure you pass a valid credential with access permission to your Application Insights resource.
348
+
You might see the following entry in the log:
349
+
350
+
> `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 401, please check your credentials`
351
+
352
+
This message means that the agent can't send telemetry. In this situation, you likely didn't enable Microsoft Entra authentication on the agent while your Application Insights resource had `DisableLocalAuth: true`. Make sure that you pass a valid credential that has access permission to your Application Insights resource.
347
353
348
-
If you're using Fiddler, you might see the response header `HTTP/1.1 401 Unauthorized - please provide the valid authorization token`.
354
+
If you use Fiddler, you might see the following response header:
355
+
356
+
> `HTTP/1.1 401 Unauthorized - please provide the valid authorization token`
349
357
350
358
#### CredentialUnavailableException
351
359
352
-
If you see the exception `com.azure.identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. Connection to IMDS endpoint cannot be established` in the log file, it means the agent failed to acquire the access token. The likely cause is an invalid client ID in your User-Assigned Managed Identity configuration.
360
+
You might see the following entry in the log file:
361
+
362
+
> `com.azure.identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. Connection to IMDS endpoint cannot be established`
363
+
364
+
This exception means that the agent didn't acquire the access token. The likely cause is an invalid client ID in your User-Assigned Managed Identity configuration.
353
365
354
366
#### Failed to send telemetry
355
367
356
-
If you see the message `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 403, please check your credentials`in the log, it means the agent couldn't send telemetry. The likely reason is that the credentials used don't allow telemetry ingestion.
368
+
You might see the following message in the log:
357
369
358
-
Using Fiddler, you might notice the response `HTTP/1.1 403 Forbidden - provided credentials do not grant the access to ingest the telemetry into the component`.
370
+
. `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 403, please check your credentials`
359
371
360
-
The issue can be due to:
372
+
This message means that the agent can't send telemetry. The likely reason is that the credentials that are used don't allow telemetry ingestion.
361
373
362
-
- Creating the resource with a system-assigned managed identity or associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it.
363
-
- Using the correct credentials for access tokens but linking them to the wrong Application Insights resource. Ensure your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource.
374
+
If you use Fiddler, you might notice the following response:
375
+
376
+
> "HTTP/1.1 403 Forbidden - provided credentials do not grant the access to ingest the telemetry into the component"
377
+
378
+
This issue can be caused by any of the following actions:
379
+
380
+
- Creating a resource that has a system-assigned managed identity.
381
+
- Associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it.
382
+
- Using the correct credentials for access tokens, but linking them to the wrong Application Insights resource. In this situation, make sure that your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource.
364
383
365
384
#### Invalid Client ID
366
385
367
-
If you see the exception `com.microsoft.aad.msal4j.MsalServiceException: Application with identifier <CLIENT_ID> was not found in the directory` in the log, it means the agent failed to get the access token. This exception likely happens because the client ID in your client secret configuration is invalid or incorrect.
386
+
You might see the following exception in the log:
387
+
388
+
> `com.microsoft.aad.msal4j.MsalServiceException: Application with identifier <CLIENT_ID> was not found in the directory`
389
+
390
+
This means that the agent didn't get the access token. This exception likely occurs because the client ID in your client secret configuration is invalid or incorrect.
368
391
369
-
This issue occurs if the admin doesn't install the application or no tenant user consents to it. It also happens if you send your authentication request to the wrong tenant.
392
+
This issue occurs if the admin doesn't install the application or if no tenant user consents to it. It occurs also if you send your authentication request to the wrong tenant.
370
393
371
394
### [Java native](#tab/java-native)
372
395
@@ -375,7 +398,7 @@ This issue occurs if the admin doesn't install the application or no tenant user
375
398
376
399
### [Node.js](#tab/nodejs)
377
400
378
-
Turn on internal logs by using the following setup. After you enable them, the console shows error logs including any error related to Microsoft Entra integration. Examples include failing to generate the token with the wrong credentials or errors when the ingestion endpoint fails to authenticate using the provided credentials.
401
+
Turn on internal logs by using the following setup. After you enable the logs, the console shows error logs, including any errors that are related to Microsoft Entra integration. Examples include failing to generate the token with the wrong credentials or if the ingestion endpoint doesn't authenticate by using the provided credentials.
379
402
380
403
```javascript
381
404
let appInsights =require("applicationinsights");
@@ -390,13 +413,13 @@ Something is incorrect about the credential you're using and the client isn't ab
390
413
391
414
### Error starts with "authentication error" (with no status code)
392
415
393
-
The client failed to authenticate with the given credential. This error usually occurs when the credential used doesn't have the correct role assignments.
416
+
The client failed to authenticate with the given credential. This error usually occurs if the credential used doesn't have the correct role assignments.
394
417
395
-
### I'm getting a status code 400 in my error logs
418
+
### Status code 400 is logged in the error logs
396
419
397
-
You're probably missing a credential or your credential is set to `None`, but your Application Insights resource is configured with `DisableLocalAuth: true`. Make sure you're passing in a valid credential and that it has permission to access your Application Insights resource.
420
+
You're probably missing a credential or your credential is set to `None`, but your Application Insights resource is configured with `DisableLocalAuth: true`. Make sure that you pass in a valid credential and that it has permission to access your Application Insights resource.
398
421
399
-
### I'm getting a status code 403 in my error logs
422
+
### Status code 403 is logged in error logs
400
423
401
424
This error usually occurs when the provided credentials don't grant access to ingest telemetry for the Application Insights resource. Make sure your Application Insights resource has the correct role assignments.
0 commit comments