locked
The Microsoft Advanced Threat Analytics Gateway service terminated unexpectedly RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    We are getting below error on Lightweight Gateway server repeatedly. Can anyone help on this?

    Log Name:      System

    Source:        Service Control Manager

    Date:          7/30/2020 4:38:56 AM

    Event ID:      7031

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Server.domain.net

    Description:

    The Microsoft Advanced Threat Analytics Gateway service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

    Thursday, July 30, 2020 2:31 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    The answer should be in the Gateway logs as described here:

    https://docs.microsoft.com/en-us/advanced-threat-analytics/troubleshooting-ata-using-logs#ata-gateway-logs

    Thursday, July 30, 2020 7:09 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I have checked the logs and getting only below highlighted errors.

    Are these related to this issue?

    Error [EventLogException] System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
    at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
    at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtSubscribe(EventLogHandle session, SafeWaitHandle signalEvent, String path, String query, EventLogHandle bookmark, IntPtr context, IntPtr callback, Int32 flags)
    at System.Diagnostics.Eventing.Reader.EventLogWatcher.StartSubscribing()
    at Microsoft.Tri.Gateway.Collection.Events.EventListeners.WindowsEventLogReader.<UpdateWindowsEventLogReaderBookmarksAsync>b__15_1(KeyValuePair`2 _)
    at MoreLinq.MoreEnumerable.ForEach[T](IEnumerable`1 source, Action`1 action)
    at async Microsoft.Tri.Gateway.Collection.Events.EventListeners.WindowsEventLogReader.UpdateWindowsEventLogReaderBookmarksAsync(?)
    at async Microsoft.Tri.Infrastructure.Framework.Module.<>c__DisplayClass30_0.<RegisterPeriodicTask>b__1(?)
    at async Microsoft.Tri.Infrastructure.Extensions.TaskExtension.<>c__DisplayClass33_0.<RunPeriodic>b__0(?)
    2020-07-30 04:37:35.1051 7112 131 Error [Socket] [NativeErrorCode=10052] System.Net.Sockets.SocketException: The connection has been broken due to keep-alive activity detecting a failure while the operation was in progress

    Tuesday, August 4, 2020 6:55 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    While both issues are a problem,  I think only the second one will crash you, but the error is cut so it's hard to tell.

    Looks like a communication problem to azure.

    Tuesday, August 4, 2020 9:25 AM