0

Recently we had cloned new machines to our system but they are still reporting to Log Analytics with the SourceComputerId property from the source machine (which new ones was cloned from). How to fix it?

We tried to reinstall the agents but it didn't help. This query still returns duplicates.

let duplicates = Heartbeat
| summarize dcount(Computer) by SourceComputerId
| where dcount_Computer > 1
| project SourceComputerId;
Heartbeat
| where SourceComputerId in (duplicates)
| distinct Computer, SourceComputerId
| order by Computer asc

This isn't a big deal for montiroing but we cannot setup update schedule from OMS (Azure Automation) because the new machines are unavailable - Update Solution relies on SourceComputerId (ref link: https://learn.microsoft.com/pl-pl/azure/automation/automation-update-management)

kopieczek.dev
  • 706
  • 8
  • 26

2 Answers2

2

Reinstalling the agent by itself will not solve the problem. This usually happens when the cloned image was not sysprepped correctly. You will need to first sysprep the machine and then reinstall the agent. Detailed steps are documented here:

enter image description here

Femi Sulu
  • 303
  • 1
  • 4
0

This can be resolved easily without sysprepping the client machine. On client machine

  1. Stop the health service
  2. Navigate to C:\Program Files\Microsoft Monitoring Agent\Agent
  3. Rename folder Health Service State to Health Service State.old
  4. Go to cert manager, expand Microsoft Management Agent, expand certificates
  5. Delete ALL certificates in the folder
  6. Restart the health service.

You will get a new entry in log analytics & update management, the old one will remove itself after 24hrs.

This will give the client machine a new, and importantly a different SourceComputerID.

  • Duplicate local machine sids are not a problem!!
Paul lovegrove
  • 1