Azure Windows Monitoring Agent not Syncing

Question

Hello Azure Support Team,

We recently configured a Data Collection Rule (DCR) to collect and ship logs from our Elasticsearch virtual machines to Azure Log Analytics Workspace.

Our environment consists of three virtual machines:

• 2 Windows VMs
• 1 Linux VM

The current status is as follows:

• ✅ The Linux VM is successfully sending logs to the Log Analytics Workspace.
• ✅ One of the Windows VMs is also successfully sending logs.
• ❌ However, the second Windows VM is not sending any logs because the Azure Monitor Agent (AMA) extension remains in the "Transitioning" state and never completes provisioning.

We have already performed the following troubleshooting steps:

• Verified the Data Collection Rule association.
• Confirmed the VM has network connectivity to the required Azure Monitor endpoints.
• Checked the Azure Monitor Agent extension status.
• Removed and reinstalled the Azure Monitor Agent extension.
• Restarted the Azure Monitor Agent service and the virtual machine.
• Verified the VM's managed identity and required permissions.
• Confirmed there are no Azure Policy or NSG restrictions preventing communication.

Despite these troubleshooting efforts, the Azure Monitor Agent continues to remain in the Transitioning state, and no logs are being ingested into the Log Analytics Workspace from this VM.

We would appreciate your assistance in investigating the root cause and providing a resolution to restore the Azure Monitor Agent to a healthy state.

Environment Details:

• Service: Azure Monitor Agent (AMA)
• Operating System: Windows Server
• Resource Type: Azure Virtual Machine
• Issue: AMA extension stuck in "Transitioning" state
• Impact: Logs are not being collected or sent to Log Analytics Workspace from one Windows VM

Please let us know if you require any additional logs, diagnostic information, or if you would like us to enable a support diagnostics collection.

Thank you.

Answer 1

Hello Pransh Parashar,

Thank you for your patience while we reviewed the issue.

I understand that one Windows VM is not sending data to Log Analytics because the Azure Monitor Agent (AMA) extension remains in a "Transitioning" state, while the Linux VM and the second Windows VM are functioning correctly.

Based on the information provided, the issue appears to be related to an incomplete or corrupted AMA installation on the affected VM. This is supported by the fact that the AMA configuration folder is not present and the agent process is not running on the machine. Since the same DCR is working successfully on the other VMs, the Log Analytics Workspace and DCR configuration are unlikely to be the cause.

To resolve the issue, please perform the following actions:

1. Remove the AzureMonitorWindowsAgent extension from the VM.
2. Verify that the Azure Guest Agent services (RdAgent and WindowsAzureGuestAgent) are running.
3. Delete any remaining AMA installation artifacts, including the AMADataStore folder if present.
4. Restart the VM.
5. Reinstall the Azure Monitor Agent by reassociating the VM with the existing Data Collection Rule.
6. Confirm that the following are created after installation:
   • C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent
   • MonAgentCore.exe process

Once the agent starts successfully, a new heartbeat entry should appear in the Log Analytics Workspace and log ingestion should resume.

For reference:

• Azure Monitor Agent Troubleshooter: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/troubleshooter-ama-windows?tabs=WindowsPowerShell
• Azure Monitor Agent Troubleshooting Guidance: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-windows-vm

Based on the symptoms provided, the above actions are expected to restore the AMA extension to a healthy state and resume log collection from the affected VM.