I have a VMSS in Azure with the IaaSDiagnostics
VM Extension installed. I've configured it to use a sink of type applicationInsights
. On the individual VMs, I'm seeing the following two messages emitted to the Application Event Logs.
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
<System>
<Provider Name='AzureDiagnostics'/>
<EventID Qualifiers='0'>0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime='2017-07-27T14:53:58.302617300Z'/>
<EventRecordID>9515</EventRecordID>
<Channel>Application</Channel>
<Computer>BackEnd000000</Computer>
<Security/>
</System>
<EventData>
<Data>System.IO.IOException: The process cannot access the file 'C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Diagnostics.IaaSDiagnostics\1.10.0.1\WAD0107\Configuration\ServiceFabricReliableServiceEventTable.lts' because it is being used by another process. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.StreamWriter.CreateFile(String path, Boolean append, Boolean checkHost) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize, Boolean checkHost) at System.IO.File.InternalWriteAllText(String path, String contents, Encoding encoding, Boolean checkHost) at ApplicationInsightsExtension.LogPublisherBase.set_LastQueryCutOffTimeStamp(DateTime value) in X:\bt\813792\repo\src\agent\extensions\AppInsightsExtension\Publishers\LogPublisherBase.cs:line 87</Data>
</EventData>
</Event>
and
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
<System>
<Provider Name='AzureDiagnostics'/>
<EventID Qualifiers='0'>0</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime='2017-07-27T14:53:58.302617300Z'/>
<EventRecordID>9514</EventRecordID>
<Channel>Application</Channel>
<Computer>BackEnd000000</Computer>
<Security/>
</System>
<EventData>
<Data>Failed to persist last read log's timestamp. This may cause duplicate data being sent out in future.</Data>
</EventData>
</Event>
I don't understand why I'm getting this message, after following the configuration documentation. The file that is locked is C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Diagnostics.IaaSDiagnostics\1.10.0.1\WAD0107\Configuration\ServiceFabricReliableServiceEventTable.lts
which is from ETW tracing for Service Fabric. Also, I AM seeing duplicate log messages make their way into Application Insights, as the warning message indicates might happen.
My ARM template is configured as such
{
"name": "[concat('VMDiagnosticsVmExt','_vmNodeType0Name')]",
"properties": {
"type": "IaaSDiagnostics",
"autoUpgradeMinorVersion": true,
"protectedSettings": {
"storageAccountName": "[parameters('applicationDiagnosticsStorageAccountName')]",
"storageAccountKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('applicationDiagnosticsStorageAccountName')),'2016-01-01').keys[0].value]"
},
"publisher": "Microsoft.Azure.Diagnostics",
"settings": {
"WadCfg": {
"DiagnosticMonitorConfiguration": {
"sinks": "applicationInsights",
"Metrics": {
"resourceId": "[concat(resourceGroup().id, '/providers/Microsoft.Compute/virtualMachineScaleSets/', parameters('vmNodeType0Name'))]",
"MetricAggregation": [
{
"scheduledTransferPeriod": "PT1H"
},
{
"scheduledTransferPeriod": "PT1M"
}
]
},
"DiagnosticInfrastructureLogs": {
"scheduledTransferLogLevelFilter": "Error",
"scheduledTransferPeriod": "PT1M"
},
"WindowsEventLog": {
"scheduledTransferPeriod": "PT1M",
"DataSource": [
{
"name": "Application!*[System[(Level=1 or Level=2 or Level=3)]]"
}
]
},
"EtwProviders": {
"EtwEventSourceProviderConfiguration": [
{
"provider": "Microsoft-ServiceFabric-Actors",
"scheduledTransferKeywordFilter": "1",
"scheduledTransferPeriod": "PT5M",
"DefaultEvents": {
"eventDestination": "ServiceFabricReliableActorEventTable"
}
},
{
"provider": "Microsoft-ServiceFabric-Services",
"scheduledTransferPeriod": "PT5M",
"DefaultEvents": {
"eventDestination": "ServiceFabricReliableServiceEventTable"
}
},
{
"provider": "MyCompany-MyApp-MyService",
"scheduledTransferPeriod": "PT5M",
"DefaultEvents": {
"eventDestination": "ServiceFabricReliableServiceEventTable"
}
}
],
"EtwManifestProviderConfiguration": [
{
"provider": "cbd93bc2-71e5-4566-b3a7-595d8eeca6e8",
"scheduledTransferLogLevelFilter": "Information",
"scheduledTransferKeywordFilter": "4611686018427387904",
"scheduledTransferPeriod": "PT5M",
"DefaultEvents": {
"eventDestination": "ServiceFabricSystemEventTable"
}
}
]
}
},
"SinksConfig": {
"Sink": [
{
"name": "applicationInsights",
"ApplicationInsights": "[parameters('applicationInsightsKey')]"
}
]
}
},
"StorageAccount": "[parameters('applicationDiagnosticsStorageAccountName')]"
},
"typeHandlerVersion": "1.10"
}
}