Microsoft ATA Lightweight Gateway - StartDataCollectorSetRequest problem

Kamil Pniak 21 Reputation points
2022-05-09T22:33:54.087+00:00

Hi,

I got this kind of problem after Microsoft ATA Lightweight Gateway has been installed on WS 2019 Standard.

Installation has been finished correctly but after that Microsoft Advanced Threat Analytics Gateway service is in the starting state all the time.

This is what I got under Microsoft.Tri.Gateway-Errors:

2022-05-09 22:24:43.7559 2604 5 Error [WebClient+<InvokeAsync>d__8`1] System.Net.Http.HttpRequestException: PostAsync failed [requestTypeName=StartDataCollectorSetRequest] ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 500 (Internal Server Error).

and this is what is under Microsoft.Tri.Gateway.Updater-Errors

2022-05-09 22:26:02.0918 4292 11 Error [IDataCollectorSet] System.IO.DirectoryNotFoundException: The path could not be found. (Exception from HRESULT: 0x80030003 (STG_E_PATHNOTFOUND))
at PlaLibrary.IDataCollectorSet.Query(String name, String Server)
at Microsoft.Tri.Infrastructure.Utils.DataCollectorSet.IsExists(String name)
at async Microsoft.Tri.Infrastructure.Framework.PerformanceCounterCategoryManager.StartDataCollectorSetAsync(?)
at async Microsoft.Tri.Gateway.Updater.Service.GatewayUpdaterWebApplication.<>c__DisplayClass3_0.<OnInitializeAsync>b__5(?)
at async Microsoft.Tri.Common.Communication.CommunicationHandler`2.InvokeAsync

DataCollectorSets folder didnt create in this path C:\Program Files\Microsoft Advanced Threat Analytics\Gateway\Logs

I alerady checked --> HKLM\System\CurrentControlSet\Services\PerfProc\Performance
DisablePerformanceCounters is set = 0

and after called lodctr /R from an elevated prompt under the system32 folder
result:
Info: Successfully rebuilt performance counter setting from system backup store

....but still no luck, service in starting mode with the same errors.

Microsoft Configuration Manager
0 comments No comments
{count} votes

Accepted answer
  1. Eli Ofek (MSFT) 911 Reputation points Microsoft Employee
    2022-05-12T09:24:53.263+00:00

    Backup the "Microsoft ATA Gateway" entry in the registry under PLA, then delete it.
    Let's see if the Gateway can start after that.
    It's in a limbo state, it has the registry key, but not the corresponding file, which explains the error we got.

    0 comments No comments

13 additional answers

Sort by: Most helpful
  1. Eli Ofek (MSFT) 911 Reputation points Microsoft Employee
    2022-05-10T06:19:56.903+00:00

    Is there a 3rd AV software running that might be blocking us ? I had a similar case once.
    Make sure the PLA service is running.
    Also make sure Local service and Local system have access to the Logs folder.

    Is there any output when running "logman "Microsoft ATA Gateway" ?
    what if you run this command as local system ?

    0 comments No comments

  2. Kamil Pniak 21 Reputation points
    2022-05-10T11:50:35.757+00:00

    Hi Eli,

    thanks for fast response

    There is Sentinel One installed but this one is also installed on other two DC's where it works fine.
    PLA is running.
    Local service and Local system have access to the Logs folder - it has

    C:\Windows\system32>logman "Microsoft ATA Gateway"

    Error:
    The path %1 could not be found.

    This is how it looks.

    0 comments No comments

  3. Eli Ofek (MSFT) 911 Reputation points Microsoft Employee
    2022-05-10T13:35:37.527+00:00

    OK, so we have a repro of the same error using logman...
    what is the output if you run logman without any parameters ?

    0 comments No comments

  4. Kamil Pniak 21 Reputation points
    2022-05-10T20:20:10.393+00:00

    This is what I got:

    C:\Windows\system32>logman

    Data Collector Set Type Status


    The command completed successfully.

    0 comments No comments