Merge pull request #271882 from jmgallart77/patch-4

Update monitor-troubleshoot-ingestion-agent.md

Author: prmerger-automator[bot]

articles/operator-insights/monitor-troubleshoot-ingestion-agent.md

@@ -28,14 +28,13 @@ Metrics are reported in a simple human-friendly form.
 
 - For most of these troubleshooting techniques, you need an SSH connection to the VM running the agent.
 
-## Collect diagnostics
-
-Microsoft Support might request diagnostic packages when investigating an issue.
+## Ingestion agent diagnostics
 
 To collect a diagnostics package, SSH to the Virtual Machine and run the command `/usr/bin/microsoft/az-aoi-ingestion-gather-diags`. This command generates a date-stamped zip file in the current directory that you can copy from the system.
 
 > [!NOTE]
-> Diagnostics packages don't contain any customer data or the value of any credentials.
+> Microsoft Support might request diagnostics packages when investigating an issue. Diagnostics packages don't contain any customer data or the value of any credentials.
+
 
 ## Problems common to all sources
 
@@ -84,16 +83,16 @@ Symptoms: MCC reports alarms about MSFs being unavailable.
 Symptoms: no data appears in Azure Data Explorer.
 
 - Check that the MCC is healthy and ingestion agents are running.
-- Check the logs from the ingestion agent for errors uploading to Azure. If the logs point to an invalid connection string, or connectivity issues, fix the configuration, connection string, or SAS token, and restart the agent.
+- Check the ingestion agent logs in the diagnostics package for errors uploading to Azure. If the logs point to an invalid connection string, or connectivity issues, fix the configuration, connection string, or SAS token, and restart the agent.
 - Check the network connectivity and firewall configuration on the storage account.
 
 ### Data missing or incomplete
 
 Symptoms: Azure Monitor shows a lower incoming EDR rate in ADX than expected.
 
-- Check that the agent is running on all VMs and isn't reporting errors in logs.
+- Check that the agent is running on all VMs and isn't reporting errors in the diagnostics package logs.
 - Verify that the agent VMs aren't being sent more than the rated load.
-- Check agent metrics for dropped bytes/dropped EDRs. If the metrics don't show any dropped data, then MCC isn't sending the data to the agent. Check the "received bytes" metrics to see how much data is being received from MCC.
+- Check agent metrics in the diagnostics package for dropped bytes/dropped EDRs. If the metrics don't show any dropped data, then MCC isn't sending the data to the agent. Check the "received bytes" metrics to see how much data is being received from MCC.
 - Check that the agent VM isn't overloaded – monitor CPU and memory usage. In particular, ensure no other process is taking resources from the VM.
  
 ## Problems with the SFTP pull source
@@ -114,31 +113,32 @@ Symptoms: No files are uploaded to AOI. The agent log file, */var/log/az-aoi-ing
 
 ### No files are uploaded to Azure Operator Insights
 
-Symptoms: No data appears in Azure Data Explorer. The AOI *Data Ingested* metric for the relevant data type is zero. 
+Symptoms: No data appears in Azure Data Explorer. Logs of category `Ingestion` don't appear in [Azure Operator Insights monitoring data](monitor-operator-insights-data-reference.md#resource-logs) or they contain errors. The [Number of ingested rows](concept-data-quality-monitoring.md#metrics) data quality metric for the relevant data type is zero.
 
 - Check that the agent is running on all VMs and isn't reporting errors in logs.
 - Check that files exist in the correct location on the SFTP server, and that they aren't being excluded due to file source config (see [Files are missing](#files-are-missing)).
 - Check the network connectivity and firewall configuration between the ingestion agent VM and the Data Product's input storage account.
 
 ### Files are missing
 
-Symptoms: Data is missing from Azure Data Explorer. The AOI *Data Ingested* and *Processed File Count* metrics for the relevant data type are lower than expected. 
+Symptoms: Data is missing from Azure Data Explorer. Logs of category `Ingestion` in [Azure Operator Insights monitoring data](monitor-operator-insights-data-reference.md#resource-logs) are lower than expected or they contain errors. The [Number of ingested rows](concept-data-quality-monitoring.md#metrics) data quality metric for the relevant data type is lower than expected.
+
 
-- Check that the agent is running on all VMs and isn't reporting errors in logs. Search the logs for the name of the missing file to find errors related to that file.
+- Check that the agent is running on all VMs and isn't reporting errors in logs. Search in the diagnostics package logs for the name of the missing file to find errors related to that file.
 - Check that the files exist on the SFTP server and that they aren't being excluded due to file source config. Check the file source config and confirm that:
   - The files exist on the SFTP server under the path defined in `base_path`. Ensure that there are no symbolic links in the file paths of the files to upload: the ingestion agent ignores symbolic links.
   - The "last modified" time of the files is at least `settling_time` seconds earlier than the time of the most recent upload run for this file source.
   - The "last modified" time of the files is later than `exclude_before_time` (if specified).
   - The file path relative to `base_path` matches the regular expression given by `include_pattern` (if specified).
   - The file path relative to `base_path` *doesn't* match the regular expression given by `exclude_pattern` (if specified).
-- If recent files are missing, check the agent logs to confirm that the ingestion agent performed an upload run for the source at the expected time. The `cron` parameter in the source config gives the expected schedule.
+- If recent files are missing, check the agent logs in the diagnostics package to confirm that the ingestion agent performed an upload run for the source at the expected time. The `cron` parameter in the source config gives the expected schedule.
 - Check that the agent VM isn't overloaded – monitor CPU and memory usage. In particular, ensure no other process is taking resources from the VM.
 
 ### Files are uploaded more than once
 
 Symptoms: Duplicate data appears in Azure Operator Insights.
 
-- Check whether the ingestion agent encountered a retryable error on a previous upload and then retried that upload more than 24 hours after the last successful upload. In that case, the agent might upload duplicate data during the retry attempt. The duplication of data should affect only the retry attempt.
+- Check whether the ingestion agent encountered a retryable error in the diagnostics package log on a previous upload and then retried that upload more than 24 hours after the last successful upload. In that case, the agent might upload duplicate data during the retry attempt. The duplication of data should affect only the retry attempt.
 - Check that the file sources defined in the config file refer to nonoverlapping sets of files. If multiple file sources are configured to pull files from the same location on the SFTP server, use the `include_pattern` and `exclude_pattern` config fields to specify distinct sets of files that each file source should consider.
 - If you're running multiple instances of the SFTP ingestion agent, check that the file sources configured for each agent don't overlap with file sources on any other agent. In particular, look out for file source config that was accidentally copied from another agent's config.
 - If you recently changed the pipeline `id` for a configured file source, use the `exclude_before_time` field to avoid files being reuploaded with the new pipeline `id`. For instructions, see [Change configuration for ingestion agents for Azure Operator Insights](change-ingestion-agent-configuration.md).