Pages

Wednesday, March 16, 2022

Unable to remove Azure Virtual Machine from deleted Log Analytics Workspace

Problem

You’ve recently cleaned up Log Analytics Workspaces that had Virtual Machines connected to it and wanted to re-add those VMs to new workspaces but notice that you see the message:

Cannot enable – Workspace not found (Why?)

Clicking on the link provides the following explanation:

The workspace (e5a604e7-8908-4a30-9d15-5bc4aa81ca48) associated with this virtual machine could not be found. This usually happens if you do not have access to this workspace or the workspace is deleted. Please verify the existence of the workspace with your administrator. If you need to connect to a different workspace, please remove the monitoring agent extension from this virtual machine and try again.

image

You proceed to remove the monitoring agents from the Windows VM:

image

Then restart the OS but the previous message still persists.

Attempt to enabling Insights on the VM also fails with the following message:

The workspace (e5a604e7-8908-4a30-9d15-5bc4aa81ca48) associated with this virtual machine could not be found. This usually happens if you do not have access to this workspace or the workspace is deleted. Please verify the existence of the workspace with your administrator. If you need to connect to a different workspace, please remove the monitoring agent extension from this virtual machine and try again.

image

Solution

I’m not sure if the Azure portal requires more time to refresh but the error message was still present after 2 hours of uninstalling and restarting the VMs I worked on and what I found was to navigate into any Log Analytics Workspace, navigate to Virtual Machines and click into the VM in question:

image

Then click on the disconnect button:

imageimage

The process took about a minute and eventually displayed the VM from being Disconnecting to Not Connected:

image

Navigating back into Azure Monitor > Virtual Machines > Not monitored will now allow you to enable the VM:

image

No comments: