Beyond Impact Blog

← Back to All Posts

Azure OMS Workspace Settings Disappearing

Posted on September 15, 2017 by Cole McDonald

We've seen some interesting behaviors in Azure with the Healthservice Agent which provides the connection to SCOM in our hosted environment and OMS in Azure.  The management groups registered with the service (Healthservice - Microsoft Management Agent - MMA for short) seem to disappear every once in a while.  We suspect it happens during updates to the agent (extension if you're deploying from the Azure portal).

As part of our automated SCOM deployment, we already had a framework for pushing out the SCOM settings, so when this happened in our Azure clients, we were able to add the Azure Workspace configuration distribution as well.  We've been attempting to track down the source of the changes and want to share some of the pertinent events we've found.

Digging through the event logs of the VMs that have shown the issues, I've found events 1210 and 3000 in the Operations Manager log to be the events that show working state.  3000 is the addition of a management group/workspace and 1210 is the push of a new configuration for a registered management group/workspace.  These can get us a time line of events to track down when the groups are working and gaps when they're not as the configuration pushes are regular occurences.

Here's some quick Powershell to check in on them.  I'm running this from our SCOM Gateway:

# As always, preload a variable with the log so we don't have to take the

# time to query over and over while examining the log

$events = Get-EventLog 'Operations Manager' -ComputerName <insert FQDN here>


# The workspace ID is preceeded by AOI in the event log message fields

$events | Where-Object eventid -eq 1210 | Where-Object message -like "*AOI*" | Out-GridView -PassThru

$events | Where-Object eventid -eq 3000 | Out-GridView -PassThru

We can pull this all together into a nice little package that shows you the full timeline for a specific server (mind the backticks for line continuation):

$computer = "<Target FQDN goes here>"
$events = Get-EventLog 'Operations Manager' -ComputerName $computer
$events `
| Where-Object {
    $_.EventID -eq 3000 -or (
        $_.eventid -eq 1210 -and
        $_.message -like "*AOI*"
} `
| Select-Object timegenerated,eventid,message `
| Sort-Object timegenerated `
| Out-GridView -PassThru

Hopefully, this will save you a little bit of headache tracking down this sort of information.  We still haven't found the event that will show when a group was removed.  Most likely this is due to our suspicion that this connectivity loss occurs during an update of the agent. 


Did you find this article useful?  Let me know at

If you want to be kept informed, follow our RSS feed:

Learn more about PowerShell in Azure

Beyond Impact is a Cloud Hosting and Managed Services provider based in Minneapolis, Minnesota. 
You can learn more about our Cloud Services at

Subscribe to Email Updates