Create Your User Profile Error Icon Your Profile Could Not Be Created Please Try Again Irs

Skip to principal content

Troubleshoot self-hosted integration runtime

• Commodity
• 02/21/2022
• 32 minutes to read

Is this page helpful?

Feedback will exist sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services. Privacy policy.

In this article

APPLIES TO: Azure Data Factory Azure Synapse Analytics

This article explores common troubleshooting methods for self-hosted integration runtime (IR) in Azure Data Factory and Synapse workspaces.

Gather self-hosted IR logs

For failed activities that are running on a self-hosted IR or a shared IR, the service supports viewing and uploading error logs. To get the fault report ID, follow the instructions here, and then enter the report ID to search for related known issues.

1. On the Monitor page for the service UI, select Pipeline runs.

2. Nether Activity runs, in the Fault column, select the highlighted push button to brandish the action logs, as shown in the following screenshot:

   • Azure Data Factory
   • Azure Synapse

   

   The activity logs are displayed for the failed activeness run.

   

3. For further assistance, select Transport logs.

   The Share the self-hosted integration runtime (IR) logs with Microsoft window opens.

   

4. Select which logs yous desire to transport.

   • For a cocky-hosted IR, you can upload logs that are related to the failed activeness or all logs on the self-hosted IR node.
   • For a shared IR, you can upload only logs that are related to the failed activity.

5. When the logs are uploaded, keep a tape of the Written report ID for later use if you demand further assistance to solve the effect.

   

Note

Log viewing and uploading requests are executed on all online cocky-hosted IR instances. If whatever logs are missing, brand certain that all the self-hosted IR instances are online.

Cocky-hosted IR general failure or error

Out of memory effect

• Symptoms

  An OutOfMemoryException (OOM) mistake occurs when you effort to run a lookup activity with a linked IR or a self-hosted IR.

• Cause

  A new activity can throw an OOM error if the IR machine experiences momentary high memory usage. The issue might exist acquired by a large book of concurrent activity, and the error is past design.

• Resolution

  Check the resources usage and concurrent activity execution on the IR node. Accommodate the internal and trigger time of activity runs to avoid too much execution on a single IR node at the aforementioned fourth dimension.

Concurrent jobs limit event

• Symptoms

  When you try to increase the concurrent jobs limit from UI, the process hangs in Updating status.

  Example scenario: The maximum concurrent jobs value is currently gear up to 24, and you want to increment the count so that your jobs can run faster. The minimum value that you can enter is three, and the maximum value is 32. You increase the value from 24 to 32 and and then select the Update button. The process gets stuck in Updating status, equally shown in the following screenshot. You refresh the page, and the value is all the same displayed as 24. It hasn't been updated to 32 equally you lot had expected.

  

• Crusade

  The limit on the number of concurrent jobs depends on the computer's logic core and memory. Try to adjust the value downward to a value such as 24, then view the result.

Self-hosted IR high availability (HA) SSL document upshot

• Symptoms

  The self-hosted IR work node has reported the following error:

  "Failed to pull shared states from master node net.tcp://abc.cloud.corp.Microsoft.com:8060/ExternalService.svc/. Activeness ID: XXXXX The X.509 document CN=abc.deject.corp.Microsoft.com, OU=examination, O=Microsoft chain building failed. The document that was used has a trust concatenation that cannot exist verified. Replace the certificate or change the certificateValidationMode. The revocation function was unable to check revocation because the revocation server was offline."

• Cause

  When yous handle cases that are related to an SSL/TLS handshake, you might see some bug related to document chain verification.

• Resolution

  • Here's a quick, intuitive fashion to troubleshoot an X.509 certificate chain build failure:

    1. Consign the document, which needs to be verified. To do so, practice the post-obit:

       a. In Windows, select Start, outset typing certificates, so select Manage calculator certificates.

       b. In File Explorer, on the left pane, search for the document that you want to bank check, right-click it, and then select All tasks > Consign.

       

    2. Copy the exported certificate to the customer machine.

    3. On the client side, in a Command Prompt window, run the following command. Be sure to supercede <certificate path> and <output txt file path> with the actual paths.

                                 Certutil -verify -urlfetch    <certificate path>   >     <output txt file path>                                                  

       For case:

                                 Certutil -verify -urlfetch c:\users\examination\desktop\servercert02.cer > c:\users\test\desktop\Certinfo.txt                                                  

    4. Check for errors in the output TXT file. You can detect the mistake summary at the end of the TXT file.

       For instance:

       

       If you don't see an fault at the stop of the log file, as shown in the following screenshot, you can consider that the certificate chain has been built successfully on the client automobile.

       

  • If an AIA (Authority Information Access), CDP (CRL Distribution Signal), or OCSP (Online Certificate Condition Protocol) file name extension is configured in the certificate file, you can check it in a more intuitive manner:

    1. Get this information by checking the certificate details, as shown in the following screenshot:

       

    2. Run the following command. Exist sure to replace <document path> with the bodily path of the certificate.

                                                             Certutil   -URL    <document path>                                                  

       The URL Retrieval tool opens.

    3. To verify certificates with AIA, CDP, and OCSP file proper name extensions, select Retrieve.

       

       You've congenital the document concatenation successfully if the certificate status from AIA is Verified and the certificate status from CDP or OCSP is Verified.

       If you neglect when you effort to retrieve AIA or CDP, piece of work with your network team to go the client machine ready to connect to the target URL. It will exist enough if either the HTTP path or the Lightweight Directory Access Protocol (LDAP) path can be verified.

Self-hosted IR could not load file or assembly

• Symptoms

  Yous get the following error message:

  "Could not load file or assembly 'XXXXXXXXXXXXXXXX, Version=iv.0.2.0, Culture=neutral, PublicKeyToken=XXXXXXXXX' or one of its dependencies. The system cannot notice the file specified. Activity ID: 92693b45-b4bf-4fc8-89da-2d3dc56f27c3"

  Here is a more specific fault message:

  "Could non load file or assembly 'Organisation.ValueTuple, Version=4.0.2.0, Culture=neutral, PublicKeyToken=XXXXXXXXX' or one of its dependencies. The organization cannot find the file specified. Activeness ID: 92693b45-b4bf-4fc8-89da-2d3dc56f27c3"

• Cause

  In Process Monitor, you can view the post-obit result:

  

  Tip

  In Process Monitor, you can set filters equally shown in following screenshot.

  The preceding error bulletin says that the DLL Arrangement.ValueTuple is not located in the related Global Associates Cache (GAC) folder, in the C:\Plan Files\Microsoft Integration Runtime\four.0\Gateway folder, or in the C:\Program Files\Microsoft Integration Runtime\4.0\Shared folder.

  Basically, the process loads the DLL start from the GAC binder, and then from the Shared folder, and finally from the Gateway folder. Therefore, you can load the DLL from any path that's helpful.

  

• Resolution

  Yous'll detect the System.ValueTuple.dll file in the C:\Program Files\Microsoft Integration Runtime\4.0\Gateway\DataScan folder. To resolve the issue, re-create the Organisation.ValueTuple.dll file to the C:\Program Files\Microsoft Integration Runtime\iv.0\Gateway binder.

  You can use the same method to resolve other missing file or assembly issues.

• More than information most this issue

  The reason why you see the Organisation.ValueTuple.dll nether %windir%\Microsoft.Internet\associates and %windir%\assembly is that this is a .Net behavior.

  In the following error, you lot can clearly see that the System.ValueTuple assembly is missing. This issue arises when the application tries to cheque the System.ValueTuple.dll assembly.

  "<LogProperties><ErrorInfo>[{"Code":0,"Bulletin":"The blazon initializer for 'Npgsql.PoolManager' threw an exception.","EventType":0,"Category":5,"Information":{},"MsgId":goose egg,"ExceptionType":"System.TypeInitializationException","Source":"Npgsql","StackTrace":"","InnerEventInfos":[{"Code":0,"Message":"Could non load file or assembly 'Organisation.ValueTuple, Version=4.0.2.0, Civilization=neutral, PublicKeyToken=XXXXXXXXX' or i of its dependencies. The system cannot find the file specified.","EventType":0,"Category":5,"Data":{},"MsgId":null,"ExceptionType":"System.IO.FileNotFoundException","Source":"Npgsql","StackTrace":"","InnerEventInfos":[]}]}]</ErrorInfo></LogProperties>"

  For more than information about GAC, encounter Global Assembly Enshroud.

Self-hosted integration runtime Authentication Central is missing

• Symptoms

  The cocky-hosted integration runtime of a sudden goes offline without an Authentication Key, and the Effect Log displays the following fault message:

  "Hallmark Key is not assigned however"

  

• Cause

  • The self-hosted IR node or logical self-hosted IR in the Azure portal was deleted.
  • A clean uninstall was performed.

• Resolution

  If neither of the preceding causes applies, you lot can get to the %programdata%\Microsoft\Data Transfer\DataManagementGateway folder to run across whether the Configurations file has been deleted. If it was deleted, follow the instructions in the Netwrix article Detect who deleted a file from your Windows file servers.

  

Can't use cocky-hosted IR to bridge two on-premises datastores

• Symptoms

  Later on you create self-hosted IRs for both the source and destination datastores, you want to connect the two IRs to end a re-create activity. If the datastores are configured in different virtual networks, or the datastores can't empathise the gateway mechanism, yous receive either of the post-obit errors:

  • "The driver of source cannot be constitute in destination IR"
  • "The source cannot be accessed by the destination IR"

• Cause

  The self-hosted IR is designed as a central node of a copy activity, not a client agent that needs to be installed for each datastore.

  In this case, you lot should create the linked service for each datastore with the same IR, and the IR should exist able to admission both datastore through the network. It doesn't affair whether the IR is installed at the source datastore or the destination datastore, or on a third machine. If two linked services are created with different IRs simply used in the aforementioned copy activity, the destination IR is used, and you need to install the drivers for both datastores on the destination IR machine.

• Resolution

  Install drivers for both the source and destination datastores on the destination IR, and make sure that information technology tin can access the source datastore.

  If the traffic can't pass through the network between two datastores (for instance, they're configured in two virtual networks), you might not end copying in i activity fifty-fifty with the IR installed. If you can't cease copying in a single activity, you can create 2 copy activities with two IRs, each in a VENT:

  • Copy one IR from datastore 1 to Azure Blob Storage
  • Copy some other IR from Azure Blob Storage to datastore 2.

  This solution could simulate the requirement to utilize the IR to create a bridge that connects two disconnected datastores.

Credential sync issue causes credential loss from HA

• Symptoms

  If the data source credential "XXXXXXXXXX" is deleted from the electric current integration runtime node with payload, you receive the following error message:

  "When you delete the link service on Azure portal, or the task has the wrong payload, please create new link service with your credential once again."

• Cause

  Your self-hosted IR is built in HA way with two nodes, but the nodes aren't in a credentials sync land. This means that the credentials stored in the dispatcher node aren't synced to other worker nodes. If any failover happens from the dispatcher node to the worker node, and the credentials exist only in the previous dispatcher node, the task will fail when you're trying to admission credentials, and you'll receive the preceding mistake.

• Resolution

  The only way to avoid this issue is to make sure that the ii nodes are in credentials sync state. If they aren't in sync, you have to reenter the credentials for the new dispatcher.

Tin can't choose the certificate considering the private key is missing

• Symptoms

  • You've imported a PFX file to the certificate store.

  • When you selected the certificate through the IR Configuration Manager UI, you received the following mistake message:

    "Failed to change intranet communication encryption mode. It is likely that certificate '<document name>' may not take a private primal that is capable of key exchange or the procedure may not have access rights for the private key. Please see inner exception for detail."

    

• Cause

  • The user account has a low privilege level and tin't access the private key.
  • The certificate was generated as a signature but not as a fundamental exchange.

• Resolution

  • To operate the UI, use an business relationship with appropriate privileges for accessing the private key.

  • Import the certificate by running the following command:

                          certutil -importpfx FILENAME.pfx AT_KEYEXCHANGE                                          

Cocky-hosted integration runtime nodes out of the sync consequence

• Symptoms

  Self-hosted integration runtime nodes try to sync the credentials beyond nodes merely get stuck in the process and encounter the error bulletin below afterward a while:

  "The Integration Runtime (Self-hosted) node is trying to sync the credentials across nodes. Information technology may take several minutes."

  Notation

  If this error appears for over x minutes, please check the connectivity with the dispatcher node.

• Crusade

  The reason is that the worker nodes practise not have access to the private keys. This can be confirmed from the self-hosted integration runtime logs below:

  [14]0460.3404::05/07/21-00:23:32.2107988 [System] A fatal fault occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030D. The internal error state is 10001.

  You accept no issue with the sync process when you lot utilize the service main hallmark in the linked service. However, when you switch the authentication type to account key, the syncing result started. This is considering the self-hosted integration runtime service runs under a service account (NT SERVICE\DIAHostService) and it need to be added to the private central permissions.

• Resolution

  To solve this issue, you need to add the self-hosted integration runtime service business relationship (NT SERVICE\DIAHostService) to the private key permissions. You can employ the following steps:

  1. Open your Microsoft Management Console (MMC) Run Command.

     

  2. In the MMC pane, apply the following steps:

     

     1. Select File.
     2. Choose Add together/Remove Snap-in in thursday drop-downward carte du jour.
     3. Select Certificates in the "Available snap-ins" pane.
     4. Select Add.
     5. In the pop-upwardly "Certificates snap-in" pane, choose Reckoner account.
     6. Select Next.
     7. In the "Select Computer" pane, choose Local calculator: the computer this console is running on.
     8. Select Finish.
     9. Select OK in the "Add or Remove Snap-ins" pane.

  3. In the pane of MMC, motion on with the following steps:

     

     1. From the left binder list, select Console Root -> Certificates (Local Estimator) -> Personal -> Certificates.
     2. Right-click the Microsoft Intune Beta MDM.
     3. Select All Tasks in the drop-down list.
     4. Select Manage Individual Keys.
     5. Select Add under "Group or user names".
     6. Select NT SERVICE\DIAHostService to grant it full command admission to this certificate, apply and safe.
     7. Select Check Names and then select OK.
     8. In the "Permissions" pane, select Utilise and so select OK.

UserErrorJreNotFound mistake message when yous run a copy activeness to Azure

• Symptoms

  When you try to copy content to Microsoft Azure by using a Java-based tool or program (for instance, copying ORC or Parquet format files), you receive an error message that resembles the following:

  ErrorCode=UserErrorJreNotFound,'Type=Microsoft.DataTransfer.Mutual.Shared.HybridDeliveryException,Message=Java Runtime Surroundings is non found. Go to http://go.microsoft.com/fwlink/?LinkId=808605 to download and install on your Integration Runtime (Self-hosted) node auto. Note 64-bit Integration Runtime requires 64-flake JRE and 32-bit Integration Runtime requires 32-scrap JRE.,Source=Microsoft.DataTransfer.Mutual,''Type=System.DllNotFoundException,Message=Unable to load DLL 'jvm.dll': The specified module could not be institute. (Exception from HRESULT: 0x8007007E),Source=Microsoft.DataTransfer.Richfile.HiveOrcBridge

• Cause

  This consequence occurs for either of the following reasons:

  • Java Runtime Environment (JRE) isn't installed correctly on your Integration Runtime server.

  • Your Integration Runtime server lacks the required dependency for JRE.

  By default, Integration Runtime resolves the JRE path by using registry entries. Those entries should be automatically set during JRE installation.

• Resolution

  Follow the steps in this department carefully. Serious problems might occur if you modify the registry incorrectly. Earlier you alter it, support the registry for restoration in case problems occur.

  To prepare this result, follow these steps to verify the status of the JRE installation:

  1. Brand sure that Integration Runtime (Diahost.exe) and JRE are installed on the same platform. Cheque the following conditions:

     • 64-bit JRE for 64-bit ADF Integration Runtime should be installed in the folder: C:\Program Files\Java\

       Notation

       The folder is not C:\Programme Files (x86)\Java\

     • JRE 7 and JRE viii are both compatible for this copy activity. JRE half-dozen and versions that are earlier than JRE 6 have not been validated for this utilise.

  2. Check the registry for the advisable settings. To exercise this, follow these steps:

     1. In the Run carte du jour, type Regedit, and so press Enter.

     2. In the navigation pane, locate the following subkey:

        HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.

        In the Details pane, there should be a Electric current Version entry that shows the JRE version (for instance, 1.8).

        

     3. In the navigation pane, locate a subkey that is an verbal match for the version (for example 1.eight) under the JRE folder. In the details pane, there should exist a JavaHome entry. The value of this entry is the JRE installation path.

        

  3. Locate the bin\server folder in the following path:

     C:\Program Files\Coffee\jre1.8.0_74

     

  4. Check whether this folder contains a jvm.dll file. If information technology does not, check for the file in the bin\customer binder.

     

  Notation

  • If whatsoever of these configurations are not as described in these steps, use the JRE windows installer to fix the problems.
  • If all the configurations in these steps are correct as described, in that location may be a VC++ runtime library missing in the system. You can prepare this trouble by installing the VC++ 2010 Redistributable Package.

Self-hosted IR setup

Integration runtime registration fault

• Symptoms

  You might occasionally desire to run a self-hosted IR in a different account for either of the following reasons:

  • Company policy disallows the service account.
  • Some authentication is required.

  After you lot modify the service business relationship on the service pane, you lot might find that the integration runtime stops working, and you get the following fault bulletin:

  "The Integration Runtime (Self-hosted) node has encountered an error during registration. Cannot connect to the Integration Runtime (Self-hosted) Host Service."

  

• Cause

  Many resources are granted only to the service account. When you change the service account to another account, the permissions of all dependent resources remain unchanged.

• Resolution

  Go to the integration runtime event log to bank check the error.

  

  • If the error in the consequence log is "UnauthorizedAccessException," exercise the following:

    1. Check the DIAHostService logon service business relationship in the Windows service panel.

       

    2. Bank check to see whether the logon service business relationship has read/write permissions for the %programdata%\Microsoft\DataTransfer\DataManagementGateway binder.

       • By default, if the service logon account hasn't been inverse, it should have read/write permissions.

         

       • If you've changed the service logon business relationship, mitigate the effect by doing the following:

         a. Perform a clean uninstallation of the current self-hosted IR.
         b. Install the self-hosted IR bits.
         c. Change the service business relationship by doing the following:

         i. Go to the self-hosted IR installation folder, and then switch to the Microsoft Integration Runtime\iv.0\Shared folder.
         2. Open up a Command Prompt window by using elevated privileges. Replace <user> and <password> with your ain username and password, and and so run the following command:
         dmgcmd.exe -SwitchServiceAccount "<user>" "<password>"
         iii. If you lot want to alter to the LocalSystem account, be sure to use the correct format for this account: dmgcmd.exe -SwitchServiceAccount "NT Authority\Organisation" ""
         Do not use this format: dmgcmd.exe -SwitchServiceAccount "LocalSystem" ""
         iv. Optionally, because Local System has college privileges than Administrator, you lot tin can also directly alter it in "Services".
         v. You can employ a local/domain user for the IR service logon business relationship.

         d. Register the integration runtime.

  • If the mistake is "Service 'Integration Runtime Service' (DIAHostService) failed to start. Verify that you lot have sufficient privileges to start system services," do the following:

    1. Check the DIAHostService logon service account in the Windows service panel.

       

    2. Check to see whether the logon service account has Log on as a service permission to kickoff the Windows service:

       

• More than data

  If neither of the preceding two resolution patterns applies in your example, effort to collect the following Windows event logs:

  • Applications and Services Logs > Integration Runtime
  • Windows Logs > Application

Can't find the Register push button to register a self-hosted IR

• Symptoms

  When you register a cocky-hosted IR, the Register push button isn't displayed on the Configuration Director pane.

  

• Crusade

  As of the release of Integration Runtime 3.0, the Register button on existing integration runtime nodes has been removed to enable a cleaner and more than secure surround. If a node has been registered to an integration runtime, whether it's online or not, re-annals it to another integration runtime by uninstalling the previous node, and then install and register the node.

• Resolution

  1. In Control Panel, uninstall the existing integration runtime.

     Important

     In the following procedure, select Yes. Do not keep data during the uninstallation procedure.

     

  2. If you don't take the integration runtime installer MSI file, go to download eye to download the latest integration runtime.

  3. Install the MSI file, and annals the integration runtime.

Unable to annals the self-hosted IR because of localhost

• Symptoms

  You lot're unable to annals the self-hosted IR on a new machine when y'all use get_LoopbackIpOrName.

  Debug: A runtime error has occurred. The blazon initializer for 'Microsoft.DataTransfer.DIAgentHost.DataSourceCache' threw an exception. A non-recoverable error occurred during a database lookup.

  Exception detail: Arrangement.TypeInitializationException: The type initializer for 'Microsoft.DataTransfer.DIAgentHost.DataSourceCache' threw an exception. ---> System.Net.Sockets.SocketException: A non-recoverable error occurred during a database lookup at System.Cyberspace.Dns.GetAddrInfo(String name).

• Crusade

  The result unremarkably occurs when the localhost is beingness resolved.

• Resolution

  Use localhost IP accost 127.0.0.1 to host the file and resolve the issue.

Cocky-hosted setup failed

• Symptoms

  You're unable to uninstall an existing IR, install a new IR, or upgrade an existing IR to a new IR.

• Cause

  The integration runtime installation depends on the Windows Installer service. Yous might feel installation problems for the post-obit reasons:

  • Insufficient bachelor disk space.
  • Lack of permissions.
  • The Windows NT service is locked.
  • CPU utilization is besides loftier.
  • The MSI file is hosted in a slow network location.
  • Some system files or registries were touched unintentionally.

The IR service account failed to fetch certificate access

• Symptoms

  When yous install a self-hosted IR via Microsoft Integration Runtime Configuration Manager, a document with a trusted certificate authorisation (CA) is generated. The document couldn't exist applied to encrypt communication between two nodes, and the following mistake message is displayed:

  "Failed to change Intranet communication encryption mode: Failed to grant Integration Runtime service business relationship the access of to the certificate '<certificate proper noun>'. Error code 103"

  

• Cause

  The certificate is using fundamental storage provider (KSP) storage, which is not supported yet. To appointment, cocky-hosted IR supports only cryptographic service provider (CSP) storage.

• Resolution

  We recommend that y'all employ CSP certificates in this instance.

  Solution 1

  To import the certificate, run the post-obit command:

  Certutil.exe -CSP "CSP or KSP" -ImportPFX FILENAME.pfx

  

  Solution two

  To convert the document, run the following commands:

  openssl pkcs12 -in .\xxxx.pfx -out .\xxxx_new.pem -password pass: <EnterPassword> openssl pkcs12 -export -in .\xxxx_new.pem -out xxxx_new.pfx

  Before and afterward conversion:

  

  

Self-hosted integration runtime version 5.x

For the upgrade to version v.x of the self-hosted integration runtime, we require .NET Framework Runtime 4.7.2 or later. On the download page, y'all'll find download links for the latest 4.x version and the latest two 5.10 versions.

For Azure Information Factory v2 and Azure Synapse customers:

• If automatic update is on and you lot've already upgraded your .NET Framework Runtime to 4.7.two or later on, the self-hosted integration runtime volition be automatically upgraded to the latest 5.x version.
• If automated update is on and you haven't upgraded your .NET Framework Runtime to four.7.ii or afterward, the self-hosted integration runtime won't be automatically upgraded to the latest 5.10 version. The cocky-hosted integration runtime will stay in the current 4.10 version. You tin meet a warning for a .NET Framework Runtime upgrade in the portal and the self-hosted integration runtime client.
• If automatic update is off and you've already upgraded your .NET Framework Runtime to 4.7.ii or later, you can manually download the latest 5.x and install it on your machine.
• If automatic update is off and you lot oasis't upgraded your .NET Framework Runtime to 4.vii.2 or subsequently. When you try to manually install self-hosted integration runtime 5.x and register the fundamental, y'all will be required to upgrade your .NET Framework Runtime version first.

For Azure Information Factory v1 customers:

• Self-hosted integration runtime 5.10 doesn't support Azure Data Factory v1.
• The cocky-hosted integration runtime will be automatically upgraded to the latest version of 4.x. And the latest version of 4.x won't elapse.
• If you lot try to manually install self-hosted integration runtime 5.x and annals the key, y'all'll be notified that self-hosted integration runtime 5.10 doesn't support Azure Information Factory v1.

Self-hosted IR connectivity issues

Self-hosted integration runtime tin't connect to the cloud service

• Symptoms

  When you try to annals the self-hosted integration runtime, Configuration Manager displays the following error message:

  "The Integration Runtime (Self-hosted) node has encountered an error during registration."

  

• Cause

  The cocky-hosted IR tin can't connect to the service back stop. This issue is usually caused past network settings in the firewall.

• Resolution

  1. Check to see whether the integration runtime service is running. If information technology is, go to step 2.

     

  2. If no proxy is configured on the cocky-hosted IR, which is the default setting, run the following PowerShell command on the machine where the cocky-hosted integration runtime is installed:

                           (New-Object System.Net.WebClient).DownloadString("https://wu2.frontend.clouddatahub.net/")                                          

     Annotation

     The service URL might vary, depending on the location of your data factory or Synapse workspace instance. To find the service URL, use the Manage folio of the UI in your data factory or Azure Synapse example to observe Integration runtimes and click your cocky-hosted IR to edit information technology. At that place select the Nodes tab and click View Service URLs.

     The following is the expected response:

     

  3. If you don't receive the response you had expected, use ane of the post-obit methods, as appropriate:

     • If you receive a "Remote name could not be resolved" message, at that place'due south a Domain Proper name Arrangement (DNS) issue. Contact your network team to fix the effect.
     • If y'all receive an "ssl/tls cert is not trusted" bulletin, bank check the certificate to see whether information technology'due south trusted on the car, and then install the public certificate by using Certificate Director. This activeness should mitigate the issue.
     • Become to Windows > Event viewer (logs) > Applications and Services Logs > Integration Runtime, and check for any failure that's caused by DNS, a firewall dominion, or company network settings. If you discover such a failure, forcibly close the connection. Because every visitor has its own customized network settings, contact your network team to troubleshoot these bug.

  4. If "proxy" has been configured on the self-hosted integration runtime, verify that your proxy server can access the service endpoint. For a sample command, run into PowerShell, web requests, and proxies.

                           $user = $env:username $webproxy = (get-itemproperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings').ProxyServer $pwd = Read-Host "Countersign?" -assecurestring $proxy = new-object Arrangement.Internet.WebProxy $proxy.Address = $webproxy $account = new-object System.Net.NetworkCredential($user,[Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($pwd)), "") $proxy.credentials = $account $url = "https://wu2.frontend.clouddatahub.net/" $wc = new-object arrangement.net.WebClient $wc.proxy = $proxy $webpage = $wc.DownloadData($url) $string = [Organization.Text.Encoding]::ASCII.GetString($webpage) $string                                          

  The following is the expected response:

  

  Note

  Proxy considerations:

  • Check to see whether the proxy server needs to be put on the Safe Recipients listing. If so, make sure these domains are on the Safe Recipients list.
  • Cheque to see whether SSL/TLS certificate "wu2.frontend.clouddatahub.net/" is trusted on the proxy server.
  • If you're using Active Directory hallmark on the proxy, change the service account to the user account that tin can admission the proxy as "Integration Runtime Service."

Fault message: Self-hosted integration runtime node/logical self-hosted IR is in Inactive/ "Running (Limited)" country

• Cause

  The self-hosted integrated runtime node might have a condition of Inactive, every bit shown in the post-obit screenshot:

  

  This beliefs occurs when nodes tin can't communicate with each other.

• Resolution

  1. Log in to the node-hosted virtual machine (VM). Under Applications and Services Logs > Integration Runtime, open Event Viewer, and filter the error logs.

  2. Bank check to see whether an error log contains the following error:

                           System.ServiceModel.EndpointNotFoundException: Could not connect to internet.tcp://xxxxxxx.bwld.com:8060/ExternalService.svc/WorkerManager. The connexion attempt lasted for a time span of 00:00:00.9940994. TCP fault code 10061: No connection could be made because the target machine actively refused it ten.2.4.10:8060.  Organisation.Internet.Sockets.SocketException: No connection could be fabricated considering the target machine actively refused it.  10.2.four.ten:8060 at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) at System.Internet.Sockets.Socket.Connect(EndPoint remoteEP) at Arrangement.ServiceModel.Channels.SocketConnectionInitiator.Connect(Uri uri, TimeSpan timeout)                                          

  3. If you encounter this error, run the following command in a Control Prompt window:

                           telnet 10.2.4.ten 8060                                          

  4. If you receive the "Could not open connection to the host" command-line error that's shown in the following screenshot, contact your Information technology section for help to set up this outcome. After you can successfully telnet, contact Microsoft Support if you even so have issues with the integration runtime node status.

     

  5. Check to see whether the fault log contains the following entry:

                           Mistake log: Cannot connect to worker manager: cyberspace.tcp://xxxxxx:8060/ExternalService.svc/ No DNS entries be for host azranlcir01r1. No such host is known Exception detail: Arrangement.ServiceModel.EndpointNotFoundException: No DNS entries exist for host xxxxx. ---> System.Net.Sockets.SocketException: No such host is known at System.Internet.Dns.GetAddrInfo(String name) at System.Net.Dns.InternalGetHostByName(Cord hostName, Boolean includeIPv6) at System.Cyberspace.Dns.GetHostEntry(String hostNameOrAddress) at Organisation.ServiceModel.Channels.DnsCache.Resolve(Uri uri) --- Stop of inner exception stack trace --- Server stack trace: at Arrangement.ServiceModel.Channels.DnsCache.Resolve(Uri uri)                                          

  6. To resolve the issue, effort one or both of the following methods:

     • Put all the nodes in the same domain.
     • Add the IP to host mapping in all the hosted VM's host files.

Connectivity issue between the self-hosted IR and your information factory or Azure Synapse instance or the cocky-hosted IR and the data source or sink

To troubleshoot the network connectivity effect, you lot should know how to collect the network trace, understand how to use information technology, and clarify the Microsoft Network Monitor (Netmon) trace before applying the Netmon Tools in real cases from the self-hosted IR.

• Symptoms

  You lot might occasionally need to troubleshoot sure connectivity problems between the self-hosted IR and your data factory or Azure Synapse example, as shown in the post-obit screenshot, or between the self-hosted IR and the data source or sink.

  

  In either instance, you might meet the following errors:

  • "Re-create failed with error:Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Bulletin=Cannot connect to SQL Server: 'IP address'"

  • "One or more errors occurred. An error occurred while sending the request. The underlying connection was airtight: An unexpected mistake occurred on a receive. Unable to read data from the ship connection: An existing connection was forcibly closed by the remote host. An existing connection was forcibly closed by the remote host Activity ID."

• Resolution

  When you see the preceding errors, troubleshoot them by post-obit the instructions in this department.

  • Collect a Netmon trace for analysis:

    1. You can set up the filter to run across a reset from the server to the customer side. In the following case screenshot, y'all can come across that the server side is the Data Mill server.

       

    2. When you get the reset packet, you can find the conversation by post-obit Transmission Control Protocol (TCP).

       

    3. Get the conversation between the client and the Information Factory server below by removing the filter.

       

  • An assay of the Netmon trace you lot've nerveless shows that the Time to Live (TTL)) total is 64. According to the values mentioned in the IP Fourth dimension to Live (TTL) and Hop Limit Basics commodity, extracted in the following listing, y'all tin see that it's the Linux Organisation that resets the packet and causes the disconnection.

    Default TTL and Hop Limit values vary betwixt different operating systems, as listed here:

    • Linux kernel 2.4 (circa 2001): 255 for TCP, User Datagram Protocol (UDP), and Internet Command Message Protocol (ICMP)
    • Linux kernel iv.10 (2015): 64 for TCP, UDP, and ICMP
    • Windows XP (2001): 128 for TCP, UDP, and ICMP
    • Windows 10 (2015): 128 for TCP, UDP, and ICMP
    • Windows Server 2008: 128 for TCP, UDP, and ICMP
    • Windows Server 2019 (2018): 128 for TCP, UDP, and ICMP
    • macOS (2001): 64 for TCP, UDP, and ICMP

    

    In the preceding case, the TTL is shown every bit 61 instead of 64, considering when the network package reaches its destination, it needs to go through diverse hops, such every bit routers or network devices. The number of routers or network devices is deducted to produce the final TTL.

    In this case, y'all tin can encounter that a reset can be sent from the Linux System with TTL 64.

  • To confirm where the reset device might come up from, bank check the 4th hop from self-hosted IR.

    Network bundle from Linux System A with TTL 64 -> B TTL 64 minus 1 = 63 -> C TTL 63 minus 1 = 62 -> TTL 62 minus 1 = 61 self-hosted IR

  • In an ideal state of affairs, the TTL hops number would exist 128, which means that the Windows operating system is running your data factory instance. As shown in the following example, 128 minus 107 = 21 hops, which means that 21 hops for the bundle were sent from the data factory instance to the self-hosted IR during the TCP three handshake.

    

    Therefore, you need to appoint the network team to check to see what the 4th hop is from the self-hosted IR. If it'due south the firewall, as with the Linux System, cheque any logs to encounter why that device resets the parcel after the TCP 3 handshake.

    If yous're unsure where to investigate, try to get the Netmon trace from both the self-hosted IR and the firewall during the problematic time. This approach will help you figure out which device might have reset the parcel and acquired the disconnection. In this example, you lot also demand to appoint your network team to move forward.

Clarify the Netmon trace

Annotation

The post-obit instructions apply to the Netmon trace. Considering Netmon trace is currently out of support, you can utilise Wireshark for this purpose.

When y'all endeavor to telnet 8.viii.eight.viii 888 with the collected Netmon trace, y'all should see the trace in the following screenshots:

The preceding images evidence that you couldn't brand a TCP connectedness to the 8.8.8.8 server side on port 888, and so you see two SynReTransmit additional packages there. Considering source Cocky-HOST2 couldn't connect to 8.8.8.eight with the first package, information technology will go on trying to make the connection.

Tip

To make this connection, try the following solution:

1. Select Load Filter > Standard Filter > Addresses > IPv4 Addresses.
2. To apply the filter, enter IPv4.Address == 8.8.8.eight, and and then select Utilise. You should so meet the communication from the local machine to destination 8.8.viii.viii.

Successful scenarios are shown in the following examples:

• If y'all can telnet 8.8.eight.eight 53 without any bug, there's a successful TCP 3 handshake, and the session finishes with a TCP 4 handshake.

  

  

• The preceding TCP three handshake produces the following workflow:

  

• The TCP 4 handshake to finish the session is illustrated past the post-obit workflows:

  

  

Microsoft email notification near updating your network configuration

You lot might receive the following email notification, which recommends that you update your network configuration to allow communication with new IP addresses for Azure Data Factory by viii Nov 2020:

Determine whether this notification affects you

This notification applies to the following scenarios:

Scenario 1: Outbound communication from a self-hosted integration runtime that'due south running on-premises behind a corporate firewall

How to make up one's mind whether you're affected:

• Y'all are not afflicted if yous're defining firewall rules based on fully qualified domain names (FQDNs) that use the approach described in Fix a firewall configuration and allowlist for IP addresses.

• You lot are afflicted if you're explicitly enabling the allowlist for outbound IPs on your corporate firewall.

  If you're afflicted, accept the following activeness: by November 8, 2020, notify your network infrastructure team to update your network configuration to utilise the latest data factory IP addresses. To download the latest IP addresses, go to Discover service tags by using downloadable JSON files.

Scenario 2: Outbound communication from a self-hosted integration runtime that's running on an Azure VM inside a customer-managed Azure virtual network

How to determine whether you're affected:

• Check to run across whether y'all have any outbound network security group (NSG) rules in a private network that contains self-hosted integration runtime. If there are no outbound restrictions, you aren't affected.

• If you lot have outbound rule restrictions, check to see whether you're using service tags. If y'all're using service tags, you're not affected. There's no demand to alter or add together anything, because the new IP range is under your existing service tags.

  

• You are affected if you're explicitly enabling the allowlist for outbound IP addresses on your NSG rules setting on the Azure virtual network.

  If you're affected, take the following action: by November 8, 2020, notify your network infrastructure squad to update the NSG rules on your Azure virtual network configuration to utilise the latest information manufacturing plant IP addresses. To download the latest IP addresses, go to Detect service tags past using downloadable JSON files.

Scenario iii: Outbound communication from SSIS Integration Runtime in a customer-managed Azure virtual network

How to make up one's mind whether you're afflicted:

• Bank check to see whether yous have any outbound NSG rules in a private network that contains SQL Server Integration Services (SSIS) Integration Runtime. If there are no outbound restrictions, you aren't affected.

• If yous have outbound rule restrictions, cheque to encounter whether you're using service tags. If y'all're using service tags, you lot're not affected. There's no need to change or add anything because the new IP range is nether your existing service tags.

• Yous are affected if y'all're explicitly enabling the allowlist for outbound IP addresses on your NSG rules setting on the Azure virtual network.

  If you're affected, take the post-obit action: past November viii, 2020, notify your network infrastructure team to update the NSG rules on your Azure virtual network configuration to utilise the latest data factory IP addresses. To download the latest IP addresses, become to Notice service tags by using downloadable JSON files.

Couldn't establish a trust relationship for the SSL/TLS secure channel

• Symptoms

  The self-hosted IR couldn't connect to the Azure Information Factory or Azure Synapse service.

  When you cheque the self-hosted IR effect log or the client notification logs in the CustomLogEvent table, you'll find the following mistake bulletin:

  "The underlying connection was closed: Could not establish trust human relationship for the SSL/TLS secure aqueduct. The remote certificate is invalid according to the validation procedure."

  The simplest manner to check the server certificate of the service is to open the service URL in your browser. For example, open the check server certificate link on the automobile where the self-hosted IR is installed, and and so view the server document information.

  

  

• Cause

  There are two possible reasons for this issue:

  • Reason ane: The root CA of the service'due south server certificate isn't trusted on the machine where the self-hosted IR is installed.
  • Reason 2: You're using a proxy in your surroundings, the server certificate of the service is replaced by the proxy, and the replaced server certificate isn't trusted past the machine where the self-hosted IR is installed.

• Resolution

  • For reason i: Make sure that the service'southward server certificate and its certificate concatenation are trusted by the machine where the self-hosted IR is installed.
  • For reason ii: Either trust the replaced root CA on the self-hosted IR auto, or configure the proxy non to replace the service'south server certificate.

  For more data most trusting certificates on Windows, meet Installing the trusted root certificate.

• Additional information
  Nosotros've rolled out a new SSL certificate, which is signed from DigiCert. Bank check to see whether the DigiCert Global Root G2 is in the trusted root CA.

  

  If information technology isn't in the trusted root CA, download it here.

Next steps

For more assistance with troubleshooting, try the following resources:

• Data Manufacturing plant blog
• Data Manufacturing plant feature requests
• Azure videos
• Microsoft Q&A page
• Stack overflow forum for Data Factory
• Twitter information about Data Manufacturing plant
• Mapping information flows functioning guide

Feedback

Submit and view feedback for

durkinyazzle1943.blogspot.com

Source: https://docs.microsoft.com/en-us/azure/data-factory/self-hosted-integration-runtime-troubleshoot-guide

Share this post