Data collection rule error in Azure Arc

Question

Hello, I am adding on premise and vm servers to Azure ARC to use monitoring insights, to enable them it asks for selecting or creating new DCR to assign.
I can pick or create a new rule to connect for monitoring upon Azure Monitor agent but can't change or configure performance counters from data sources-data collection rule. Here is the error i received :

Update Error - 'Streams' stream 'Microsoft-InsightsMetricsMicrosoft-ServiceMap' must be a custom stream or one of: Microsoft-AACAudit,Microsoft-AACHttpRequest,Microsoft-AADDomainServicesAccountLogon,Microsoft-AADDomainServicesAccountManagement,Microsoft-AADDomainServicesDirectoryServiceAccess,Microsoft-AADDomainServicesLogonLogoff,Microsoft-AADDomainServicesPolicyChange,Microsoft-AADDomainServicesPrivilegeUse,Microsoft-AADManagedIdentitySignInLogs,Microsoft-AADNonInteractiveUserSignInLogs,Microsoft-AADProvisioningLogs,Microsoft-AADServicePrincipalSignInLogs,Microsoft-ABSBotRequests,Microsoft-ACSAuthIncomingOperations,Microsoft-ACSBillingUsage,Microsoft-ACSChatIncomingOperations,Microsoft-ACSSMSIncomingOperations,Microsoft-ADAssessmentRecommendation,Microsoft-ADFActivityRun,Microsoft-ADFPipelineRun,Microsoft-ADFSSignInLogs,Microsoft-ADFTriggerRun,Microsoft-ADPAudit,Microsoft-ADPDiagnostics,Microsoft-ADPRequests,Microsoft-ADReplicationResult,Microsoft-ADSecurityAssessmentRecommendation,Microsoft-ADTDigitalTwinsOperation,Microsoft-ADTModelsOperation,Microsoft-ADTQueryOperation,Microsoft-ADXCommand,Microsoft-ADXQuery,Microsoft-AegDeliveryFailureLogs,Microsoft-AegPublishFailureLogs,Microsoft-Alert-Nagios,Microsoft-Alert-Oms,Microsoft-AmlOnlineEndpointConsoleLog,Microsoft-AntiMalwareStatus,Microsoft-ApiManagementGatewayLogs,Microsoft-AppAvailabilityResults,Microsoft-AppBrowserTimings,Microsoft-AppCenterError,Microsoft-AppDependencies,Microsoft-AppEvents,Microsoft-AppExceptions,Microsoft-AppMetrics,Microsoft-AppPageViews,Microsoft-AppPerformanceCounters,Microsoft-AppPlatformSystemLogs,Microsoft-AppRequests,Microsoft-AppServiceAppLogs,Microsoft-AppServiceAuditLogs,Microsoft-AppServiceConsoleLogs,Microsoft-AppServiceFileAuditLogs,Microsoft-AppServiceHTTPLogs,Microsoft-AppServicePlatformLogs,Microsoft-AppSystemEvents,Microsoft-AppTraces,Microsoft-ASimDnsActivityLogs,Microsoft-ASimNetworkSessionLogs,Microsoft-ASimNetworkSessionLogs-WindowsFirewall,Microsoft-Auditd,Microsoft-AuditLogs,Microsoft-AutoscaleEvaluationsLog,Microsoft-AutoscaleScaleActionsLog,Microsoft-AWSCloudTrail,Microsoft-AWSVPCFlow,Microsoft-AzureActivityV2,Microsoft-AzureAssessmentRecommendation,Microsoft-AzureDevOpsAuditing,Microsoft-BehaviorAnalytics,Microsoft-BlockchainApplicationLog,Microsoft-BlockchainProxyLog,Microsoft-CDBCassandraRequests,Microsoft-CDBControlPlaneRequests,Microsoft-CDBDataPlaneRequests,Microsoft-CDBGremlinRequests,Microsoft-CDBMongoRequests,Microsoft-CDBPartitionKeyRUConsumption,Microsoft-CDBPartitionKeyStatistics,Microsoft-CDBQueryRuntimeStatistics,Microsoft-CiscoAsa,Microsoft-CloudTrailEventData,Microsoft-CommonSecurityLog,Microsoft-ComputerGroup,Microsoft-ConfigurationChange,Microsoft-ConfigurationChangeV2,Microsoft-ConfigurationData,Microsoft-ContainerImageInventory,Microsoft-ContainerInventory,Microsoft-ContainerLog,Microsoft-ContainerLogV2,Microsoft-ContainerNodeInventory,Microsoft-ContainerServiceLog,Microsoft-CoreAzureBackup,Microsoft-DatabricksAccounts,Microsoft-DatabricksClusters,Microsoft-DatabricksDBFS,Microsoft-DatabricksInstancePools,Microsoft-DatabricksJobs,Microsoft-DatabricksNotebook,Microsoft-DatabricksSecrets,Microsoft-DatabricksSQLPermissions,Microsoft-DatabricksSSH,Microsoft-DatabricksWorkspace,Microsoft-DefenderForSqlAlerts,Microsoft-DefenderForSqlLogins,Microsoft-DefenderForSqlScanEvents,Microsoft-DefenderForSqlScanResults,Microsoft-DefenderForSqlTelemetry,Microsoft-DeviceNetworkInfo,Microsoft-DnsEvents,Microsoft-DnsEvents-Audit,Microsoft-DnsEvents-Dynamic,Microsoft-DnsInventory,Microsoft-DummyHydrationFact,Microsoft-Dynamics365Activity,Microsoft-EmailAttachmentInfo,Microsoft-EmailEvents,Microsoft-EmailPostDeliveryEvents,Microsoft-EmailUrlInfo,Microsoft-Event,Microsoft-ExchangeAssessmentRecommendation,Microsoft-FailedIngestion,Microsoft-FirewallLog,Microsoft-FunctionAppLogs,Microsoft-GCPAuditLogs,Microsoft-HDInsightAmbariClusterAlerts,Microsoft-HDInsightAmbariSystemMetrics,Microsoft-HDInsightHadoopAndYarnLogs,Microsoft-HDInsightHadoopAndYarnMetrics,Microsoft-HDInsightHBaseLogs,Microsoft-HDInsightHBaseMetrics,Microsoft-HDInsightHiveAndLLAPLogs,Microsoft-HDInsightHiveAndLLAPMetrics,Microsoft-HDInsightHiveTezAppStats,Microsoft-HDInsightKafkaMetrics,Microsoft-HDInsightOozieLogs,Microsoft-HDInsightSecurityLogs,Microsoft-HDInsightSparkApplicationEvents,Microsoft-HDInsightSparkBlockManagerEvents,Microsoft-HDInsightSparkEnvironmentEvents,Microsoft-HDInsightSparkExecutorEvents,Microsoft-HDInsightSparkJobEvents,Microsoft-HDInsightSparkLogs,Microsoft-HDInsightSparkSQLExecutionEvents,Microsoft-HDInsightSparkStageEvents,Microsoft-HDInsightSparkStageTaskAccumulables,Microsoft-HDInsightSparkTaskEvents,Microsoft-HealthStateChange,Microsoft-Heartbeat,Microsoft-HuntingBookmark,Microsoft-InsightsMetrics,Microsoft-IntuneAuditLogs,Microsoft-IntuneDevices,Microsoft-IntuneOperationalLogs,Microsoft-KubeEvents,Microsoft-KubeHealth,Microsoft-KubeMonAgentEvents,Microsoft-KubeNodeInventory,Microsoft-KubePodInventory,Microsoft-KubePVInventory,Microsoft-KubeServices,Microsoft-LAQueryLogs,Microsoft-McasShadowItReporting,Microsoft-MCCEventLogs,Microsoft-MicrosoftAzureBastionAuditLogs,Microsoft-MicrosoftDataShareReceivedSnapshotLog,Microsoft-MicrosoftDataShareSentSnapshotLog,Microsoft-MicrosoftHealthcareApisAuditLogs,Microsoft-NetworkMonitoring,Microsoft-NWConnectionMonitorPathResult,Microsoft-NWConnectionMonitorTestResult,Microsoft-OfficeActivity,Microsoft-Operation,Microsoft-OperationJson,Microsoft-OperationLog,Microsoft-Perf,Microsoft-PowerBIDatasetsWorkspace,Microsoft-ProcessInvestigator,Microsoft-ProtectionStatus,Microsoft-PurviewScanStatusLogs,Microsoft-RomeDetectionEvent,Microsoft-SCCMAssessmentRecommendation,Microsoft-SCOMAssessmentRecommendation,Microsoft-SecurityAlert,Microsoft-SecurityBaseline,Microsoft-SecurityBaselineSummary,Microsoft-SecurityDetection,MicrosoftSecurityDetection-ATA,Microsoft-SecurityEvent,Microsoft-SecurityIncident,Microsoft-SecurityIoTRawEvent,Microsoft-SecurityNestedRecommendation,Microsoft-SecurityRecommendation,Microsoft-SentinelHealth,Microsoft-ServiceMap,Microsoft-SfBOnlineAssessmentRecommendation,Microsoft-SharePointOnlineAssessmentRecommendation,Microsoft-SignalRServiceDiagnosticLogs,Microsoft-SigninLogs,Microsoft-SPAssessmentRecommendation,Microsoft-SQLAssessmentRecommendation,Microsoft-SqlAtpStatus-DefenderForSql,Microsoft-SQLSecurityAuditEvents,Microsoft-SucceededIngestion,Microsoft-SynapseBigDataPoolApplicationsEnded,Microsoft-SynapseBuiltinSqlPoolRequestsEnded,Microsoft-SynapseGatewayApiRequests,Microsoft-SynapseIntegrationActivityRuns,Microsoft-SynapseIntegrationPipelineRuns,Microsoft-SynapseIntegrationTriggerRuns,Microsoft-SynapseRbacOperations,Microsoft-SynapseSqlPoolDmsWorkers,Microsoft-SynapseSqlPoolExecRequests,Microsoft-SynapseSqlPoolRequestSteps,Microsoft-SynapseSqlPoolSqlRequests,Microsoft-SynapseSqlPoolWaits,Microsoft-Syslog,Microsoft-ThreatIntelligenceIndicator,Microsoft-Update,Microsoft-UpdateRunProgress,Microsoft-UpdateSummary,Microsoft-Usage,Microsoft-W3CIISLog,Microsoft-Watchlist,Microsoft-WindowsEvent,Microsoft-WindowsEvent-OBO,Microsoft-WindowsFirewall,Microsoft-WireData,Microsoft-WorkloadDiagnosticLogs,Microsoft-WVDAgentHealthStatus,Microsoft-WVDCheckpoints,Microsoft-WVDConnections,Microsoft-WVDErrors,Microsoft-WVDFeeds,Microsoft-WVDManagement,Microsoft-PrometheusMetrics,Microsoft-CommonSecurityLog-Raw,Microsoft-ContainerInsights-Group-Default.

Can anyone help me please :)
Thanks

Answer 1

Hi there,

Is seems a UI bug, can you create a support ticket on this?
Actually, you can configure your own DCRs via powershell\ARM purely.

Answer 2

Hello,

I am receiving the same error for Performance counters. I deleted and tried to recreate and same issues. With event logs its good. With performance counters having issues. Could you kindly explain if you were able to resolve the issue?

Thanks

Answer 3

Hi all,

As far as I know, there was a known issue with UI while creating the DCR. Our Product group has deployed the fix on (4th NOV,2022).
Let me double checking with the product group about that error and will get back to you.

Please find below the workaround for now.

The recommendation for currently modifying VMI DCRs is to use non-Portal methods which includes CLI/Powershell/Rest APIs. The CLI related docs for modifying a DCR can be found here for reference - https://learn.microsoft.com/en-us/cli/azure/monitor/data-collection/rule?view=azure-cli-latest

Answer 4

Hello,

Thanks for your updates. A new issue has occurred. When checking from the Main Page of Data Collection rule we can see performance counters are added. But when going inside the rule and select data sources it only shows Windows Event Logs. No performance counters shown. Not Performance counter is ingested to LAW.