Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure Advisor analyzes Azure Arc-enabled servers and recommends actions that can improve their reliability. Use this article to understand and resolve recommendations for disconnected or expired servers.
The following Azure Advisor recommendations are available for Azure Arc-enabled servers:
| Recommendation | Severity | Condition |
|---|---|---|
| Restore connectivity for 30+ day disconnected Arc-enabled server | Medium | The server is disconnected for 30 through 44 days. |
| Reconnect Arc-enabled server before the managed identity certificate expires | High | The server is disconnected for at least 45 days and the certificate is still valid. |
| Re-onboard expired Arc-enabled server | High | The server's status is Expired, or its managed identity certificate is expired. |
Restore connectivity for 30+ day disconnected Arc-enabled server
Azure shows this recommendation when a server remains disconnected for 30 through 44 days. Azure didn't receive a heartbeat from the server for an extended period. If you don't restore connectivity, the server's managed identity credential might expire, and Azure management capabilities might stop working.
To restore connectivity:
Sign in to the server.
Run the following command to check the agent status and dependent services:
azcmagent showConfirm that the agent services are running. If a service isn't running, start or restart it, and then run
azcmagent showagain.Run the following command to test connectivity to the required Azure Arc endpoints:
azcmagent checkResolve any failed connectivity checks. Review the network requirements and, if the server uses a proxy, verify the agent proxy configuration.
If the problem continues, run the following command to collect the full agent log bundle:
azcmagent logs --fullUse the logs to investigate the failure. For help with common errors, see Troubleshoot Azure Connected Machine agent connection problems.
In the Azure portal, confirm that the server's status returns to Connected.
To receive an alert when a server becomes disconnected, create a Resource Health alert.
Reconnect Arc-enabled server before the managed identity certificate expires
Azure shows this recommendation when the server is disconnected for at least 45 days but the certificate is still valid.
Restore connectivity immediately so that the agent can renew its managed identity credential and avoid expiration. The certificate is valid for 90 days, and the agent attempts to renew it when 45 or fewer days of validity remain. For more information, see Managed identity security overview.
To reconnect the server before the certificate expires:
Sign in to the server.
Run the following command to check the agent status and dependent services:
azcmagent showConfirm that the agent services are running. If a service isn't running, start or restart it, and then run
azcmagent showagain.Run the following command to test connectivity to the required Azure Arc endpoints:
azcmagent checkResolve any failed connectivity checks. Review the network requirements and, if the server uses a proxy, verify the agent proxy configuration.
If the problem continues, run the following command to collect the full agent log bundle:
azcmagent logs --fullUse the logs to investigate the failure. For help with common errors, see Troubleshoot Azure Connected Machine agent connection problems.
In the Azure portal, confirm that the server's status returns to Connected.
Re-onboard expired Arc-enabled server
Azure shows this recommendation when the server's status is Expired or its managed identity certificate has expired. An expired credential can't renew automatically, and Azure Arc management capabilities are unavailable until you recover the connection.
First, confirm whether the server should remain managed by Azure Arc.
- If the server should remain Arc-enabled and uses agent version 1.70 or later, use
azcmagent reconnect(preview) to recover its connection to the existing resource. - For earlier agent versions, disconnect the agent and reconnect the server by using an onboarding credential. To generate and run a new onboarding script, see Connect hybrid machines to Azure using a deployment script.
- If the server is retired, remove its stale Azure resource. If you still have access to the server, remove VM extensions, disconnect the server, and uninstall the agent.
After re-onboarding a server, confirm in the Azure portal that its status is Connected.