Azure Site Recovery alert – Replication health changed to Critical without actual uninstallation

Question

Hi,

We received the following Azure Monitor alert:

• Alert name: Replication health changed to Critical

Severity: Sev1

Description: "Site Recovery mobility service has been uninstalled from the virtual machine."

Service: Azure Site Recovery

Signal type: Log

Fired at: April 7, 2025, 10:48 UTC

However, after checking multiple VMs listed in the alert, we confirmed the following:

The Microsoft Azure Site Recovery Mobility Agent is still installed (visible in Programs and Features).

The related installation folders still exist:

C:\Program Files (x86)\Microsoft Azure Site Recovery\agent\

  `C:\ProgramData\Microsoft Azure Site Recovery\`
  
  **Event Viewer** does not show any events indicating an uninstallation.
  
  Installation dates of the program are from several months ago, with no recent changes.
  

Given all this, we are unsure why this alert was triggered. Has anyone encountered a similar situation or can provide insight into what might have caused the false positive?

We appreciate any suggestions or diagnostic steps we could try.

Thanks in advance!

Answer 1

Hi @Fabián Avilés

Microsoft recommend using the built-in monitoring solution for monitoring replicated items in the Recovery Services Vault (RSV). You can refer to the official documentation here: https://docs.azure.cn/en-us/site-recovery/site-recovery-monitor-and-troubleshoot#built-in-azure-monitor-alerts-for-azure-site-recovery

 Regarding the alert, it appears that the alert you received is part of the classic monitoring solution, based on the subject line you've provided. The description in the alert mentions: "Site Recovery mobility service has been uninstalled from the virtual machine," with a timestamp on April 7th. This suggests that either the Mobility Service or other dependent services may not have been running at the OS level at the time of the alert.

We kindly request you to confirm the current replication status:

• Is the replication still critical?
• Has the issue been resolved? If so, it might have been fixed after a reboot that could have restarted the Mobility Service, thereby restoring the replication to a healthy state. To pinpoint the exact reason for the issue, we recommend checking the error page using the error ID provided in the alert.

Please let me know if you face any challenge here, I can help you to resolve this issue further

Please provide your valuable comments

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.