Unable to create packet capture in Azure

akissick 1 Reputation point
2022-06-02T16:15:10.9+00:00

When I attempt to create a packet capture in Azure under the Network Watcher I am getting the following error:

NetwatcherRequestStorageAccountInaccessible\",\"message\":\"Storage Account /subscriptions/<redacted>/resourceGroups/RG-AZE-UmbrellaVA/providers/Microsoft.Storage/storageAccounts/umbrellava01diag is not accessible for writing from the target VM.

I created a service identity for the VM in question, and added it as an Owner role to the 'umbrellava01diag' storage account but it still won't let me create a Packet Capture there.

Any ideas?

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,718 questions
Azure Network Watcher
Azure Network Watcher
An Azure service that is used to monitor, diagnose, and gain insights into network performance and health.
159 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 23,031 Reputation points Microsoft Employee
    2022-06-06T22:56:26.07+00:00

    Hello @akissick , Welcome to the Microsoft Q&A forum.

    As per my understanding from the question above you have enabled packet capture in you Azure Network watcher but you are getting an error <storage account> is not accessible for writing from the target VM. This issue might be due to multiple reasons, you can try bellow mentioned steps and see if they help resolve the issue.

    • Can you please confirm if there is no firewall enabled on your storage account? if it is enabled can you please confirm if the IP space required is allowed. Premium storage accounts are currently not supported for storing packet captures
    • You can try and store the packet capture in your local VM and see if that is successful. If this works the issue is related to storage account access.
    • This might be a DNS or connectivity issue you can try and see if the Storage account FQDN (https://umbrellava01diag.blob.core.windows.net/ ) is resolvable from your VM. You can also perform a TCP ping to test this connectivity.

    Hope this helps! Please let me know if you have any additional questions. Thank you!

    0 comments