OA has no access to the process (Windows)

[YuriiB]

Hello,
Our Kubernetes cluster version 1.26 (Rancher) includes both Windows (Windows Server 2019) and Linux nodes.
We've successfully deployed a dynatrace-operator on the cluster, achieving full stack monitoring on Linux hosts. For Windows, we manually installed OneAgents on the hosts, which monitors the hosts. However, for .Net/IIS processes, we encounter a warning stating: "This process must be restarted. Dynatrace OneAgent has no access to this process. Restart the process with PID(s) 24484 and 11196 to start its monitoring."
Despite multiple attempts to restart these processes and even rebooting the nodes, the issue persists.

Could anyone advise if there are OA logs available that might shed light on the cause of this problem?

[Taylor-Sanchez]

Hi @YuriiB ,
Did this process have the OA installed on it previously? If it did, considering it is Windows, the log files (if OA was installed), should be located based on the documentation here: 
https://docs.dynatrace.com/docs/shortlink/oneagent-disk-requirements-windows#oneagent-directories-an...

[YuriiB]

I found some logs in the C:\ProgramData\dynatrace\oneagent\log folder but didn't notice anything unusual, except for a specific log located in C:\ProgramData\dynatrace\oneagent\log\installer\driver:

2024.07.08 17:01:14 --- Dynatrace OneAgent Monitor Installer version 2.19.1.1 ---
2024.07.08 17:01:14 Command line: C:\Program Files\dynatrace\oneagent\agent\driver\oneagentmon_installer.exe -l C:\ProgramData\dynatrace\oneagent\log\installer\driver.log a -d true 
2024.07.08 17:01:14 Command: Automatic Install
2024.07.08 17:01:14 Options:
    Disable      = true

2024.07.08 17:01:14 Determined windows version function RtlGetVersion from ntdll.dll: 10
2024.07.08 17:01:14 Selected driver: 'C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.inf'
2024.07.08 17:01:14 Looking for device...
2024.07.08 17:01:14 Device not found -> registering...
2024.07.08 17:01:14 Registering device...
2024.07.08 17:01:14 Device registered successfully.
2024.07.08 17:01:14 Copying driver to driver store...
2024.07.08 17:01:14 .inf file was copied to 'C:\Windows\INF\oem3.inf'
2024.07.08 17:01:14 Installing device class/class installer...
2024.07.08 17:01:14 Disabling device before installation...
2024.07.08 17:01:14 Configuring device install parameters...
2024.07.08 17:01:14 Selecting driver...
2024.07.08 17:01:14 Using driver: Provider=Dynatrace LLC, Mfg=Dynatrace LLC, Desc=OneAgentMon Device, Version=2.19.1.1 Date=02/28/2024 00:00:00
2024.07.08 17:01:14 Begin driver installation...
2024.07.08 17:01:14 Calling DIF_INSTALLDEVICEFILES...
2024.07.08 17:01:14 Calling DIF_REGISTER_COINSTALLERS...
2024.07.08 17:01:14 Calling DIF_INSTALLINTERFACES...
2024.07.08 17:01:14 Calling DIF_INSTALLDEVICE...
2024.07.08 17:01:14 Checking device status...
2024.07.08 17:01:14 Device status: DN_ROOT_ENUMERATED + DN_HAS_PROBLEM + DN_DISABLEABLE + DN_NT_ENUMERATOR + DN_NT_DRIVER
2024.07.08 17:01:14 Problem code = 0x00000016 (CM_PROB_DISABLED)
2024.07.08 17:01:14 OK, status looks good (for disabled device).
2024.07.08 17:01:14 Messages from C:\Windows\inf\setupapi.dev.log:


>>>  [SetupCopyOEMInf - C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.inf]

>>>  Section start 2024/07/08 17:01:14.329

      cmd: "C:\Program Files\dynatrace\oneagent\agent\driver\oneagentmon_installer.exe"  -l "C:\ProgramData\dynatrace\oneagent\log\installer\driver.log" a -d true

     inf: Copy style: 0x00002000

     sto: {Setup Import Driver Package: C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.inf} 17:01:14.332

     inf:      Provider: Dynatrace LLC

     inf:      Class GUID: {4fc279dd-b045-47ac-b72a-e01aec70943c}

     inf:      Driver Version: 02/28/2024,2.19.1.1

     inf:      Catalog File: oneagentmon.cat

     pol:      {Driver package policy check} 17:01:14.346

     pol:      {Driver package policy check - exit(0x00000000)} 17:01:14.349

     sto:      {Stage Driver Package: C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.inf} 17:01:14.350

     inf:           {Query Configurability: C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.inf} 17:01:14.357

     inf:                Driver package uses WDF.

     inf:                Driver package 'oneagentmon.inf' is configurable.

     inf:           {Query Configurability: exit(0x00000000)} 17:01:14.359

     flq:           Copying 'C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.cat' to 'C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}\oneagentmon.cat'.

     flq:           Copying 'C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.inf' to 'C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}\oneagentmon.inf'.

     flq:           Copying 'C:\Program Files\dynatrace\oneagent\agent\driver\win10\oneagentmon.sys' to 'C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}\oneagentmon.sys'.

     flq:           Copying 'C:\Program Files\dynatrace\oneagent\agent\driver\win10\WdfCoInstaller01009.dll' to 'C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}\WdfCoInstaller01009.dll'.

     sto:           {DRIVERSTORE IMPORT VALIDATE} 17:01:14.371

     sig:                {_VERIFY_FILE_SIGNATURE} 17:01:14.385

     sig:                     Key      = oneagentmon.inf

     sig:                     FilePath = C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}\oneagentmon.inf

     sig:                     Catalog  = C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}\oneagentmon.cat

     sig:                     Success: File is signed in catalog.

     sig:                {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 17:01:14.390

     sto:           {DRIVERSTORE IMPORT VALIDATE: exit(0x00000000)} 17:01:14.406

     sig:           Signer Score  = 0x0D000005 (WHQL)

     sig:           Signer Name   = Microsoft Windows Hardware Compatibility Publisher

     sig:           Submission ID = 72601130_14066594820895417_1152921505697433805

     sto:           {DRIVERSTORE IMPORT BEGIN} 17:01:14.408

     sto:           {DRIVERSTORE IMPORT BEGIN: exit(0x00000000)} 17:01:14.408

     cpy:           {Copy Directory: C:\Windows\System32\DriverStore\Temp\{02171e1d-2269-ed43-9e26-5e1d209d7500}} 17:01:14.408

     cpy:                Target Path = C:\Windows\System32\DriverStore\FileRepository\oneagentmon.inf_amd64_f4b8d6de2b7140ff

     cpy:           {Copy Directory: exit(0x00000000)} 17:01:14.411

     idb:           {Register Driver Package: C:\Windows\System32\DriverStore\FileRepository\oneagentmon.inf_amd64_f4b8d6de2b7140ff\oneagentmon.inf} 17:01:14.411

     idb:                Created driver package object 'oneagentmon.inf_amd64_f4b8d6de2b7140ff' in DRIVERS database node.

     idb:                Created driver INF file object 'oem3.inf' in DRIVERS database node.

     idb:                Registered driver package 'oneagentmon.inf_amd64_f4b8d6de2b7140ff' with 'oem3.inf'.

     idb:                {Configure Device Setup Class: {4fc279dd-b045-47ac-b72a-e01aec70943c}}

     idb:                     Class Name = oneagentmon

     idb:                {Configure Device Setup Class: exit(0x00000000)}

     idb:           {Register Driver Package: exit(0x00000000)} 17:01:14.412

     idb:           {Publish Driver Package: C:\Windows\System32\DriverStore\FileRepository\oneagentmon.inf_amd64_f4b8d6de2b7140ff\oneagentmon.inf} 17:01:14.412

     idb:                Activating driver package 'oneagentmon.inf_amd64_f4b8d6de2b7140ff'.

     cpy:                Published 'oneagentmon.inf_amd64_f4b8d6de2b7140ff\oneagentmon.inf' to 'oem3.inf'.

     idb:                Indexed 2 device IDs for 'oneagentmon.inf_amd64_f4b8d6de2b7140ff'.

     sto:                Flushed driver database node 'DRIVERS'. Time = 0 ms

     sto:                Flushed driver database node 'SYSTEM'. Time = 16 ms

     idb:           {Publish Driver Package: exit(0x00000000)} 17:01:14.436

     sto:           {DRIVERSTORE IMPORT END} 17:01:14.438

     dvi:                Flushed all driver package files to disk. Time = 15 ms

     sig:                Installed catalog 'oneagentmon.cat' as 'oem3.cat'.

     sto:           {DRIVERSTORE IMPORT END: exit(0x00000000)} 17:01:14.464

     sto:      {Stage Driver Package: exit(0x00000000)} 17:01:14.464

     sto: {Setup Import Driver Package - exit (0x00000000)} 17:01:14.467

     inf: Driver Store Path: C:\Windows\System32\DriverStore\FileRepository\oneagentmon.inf_amd64_f4b8d6de2b7140ff\oneagentmon.inf

     inf: Published Inf Path: C:\Windows\INF\oem3.inf

<<<  Section end 2024/07/08 17:01:14.472

<<<  [Exit status: SUCCESS]





>>>  [Restart Device - ROOT\ONEAGENTMON\0000]

>>>  Section start 2024/07/08 17:01:14.565

      cmd: "C:\Program Files\dynatrace\oneagent\agent\driver\oneagentmon_installer.exe"  -l "C:\ProgramData\dynatrace\oneagent\log\installer\driver.log" a -d true

     dvi: Device Status: 0x01802401, Problem: 0x16 (0x00000000)

     dvi: {Restarting Devices} 17:01:14.566

     dvi:      Start: ROOT\ONEAGENTMON\0000

!!!  dvi:      Device not started: Device has problem: 0x16 (CM_PROB_DISABLED), problem status: 0x00000000.

     dvi: {Restarting Devices exit} 17:01:14.586

<<<  Section end 2024/07/08 17:01:14.587

<<<  [Exit status: SUCCESS]

This log contains the following message: "!!! dvi: Device not started: Device has problem: 0x16 (CM_PROB_DISABLED), problem status: 0x00000000."
I'm uncertain if this is normal or expected. Upon checking the Device Manager, it appears that oneagentmon is correctly installed and enabled.

[YuriiB]

Another point to consider is that we're utilizing rke2 and containerd. I came across a few discussions indicating that OA might not support containerd on Windows Server:
Containerd runtime support for Windows Server - Dynatrace Community

Windows Container metrics on Kubernetes containerd runtime - Dynatrace Community
It's unclear if this support has been introduced.