On Linux VM the syslog filling with .sst log AMA agent loggin error.

S Bak 21 Reputation points
2026-10-16T12:35:14.4966667+00:00

Here is error logs from mdsd.err

external/WindowsAgent/src/shared/mcsmanager/lib/src/RefreshConfigurations.cpp:318,GetAgentConfigurations]Could not obtain configuration from https://global.handler.control.monitor.azure.us after first round of tries. Will try again with a fallback endpoint. ErrorCode:1310977

2026-10-13T16:55:27.9541880Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/RefreshGigToken.cpp:187,RefreshGigToken]Failed to get gig token from https://global.handler.control.monitor.azure.us/subscriptions/1eb7e601-a1/resourceGroups/RG-Enhance-Axx/providers/Microsoft.Compute/virtualMachines/OR-AFMSIxxxx/agentConfigurations/dcr-xxxxx/channels/ods-6f0455f5-f87f-41ac-bc77-b1/issueIngestionToken?operatingLocation=usgovvirginia&platform=linux&includeMeConfig=true&api-version=2022-06-02 after first round of tries, will try again with a fallback endpoint. Error: ErrorCode:-2146171645

2026-10-13T16:57:40.4166880Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/RefreshConfigurations.cpp:354,GetAgentConfigurations]Could not obtain configuration from https://usgovvirginia.handler.control.monitor.azure.us after attempting an immediate retry. ErrorCode:1310977

2026-10-13T16:57:40.4173130Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/RefreshConfigurations.cpp:384,GetAgentConfigurations]Response Code: 0; Response: . ErrorCode:-2146172665

2026-10-13T16:57:48.3361670Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/RefreshGigToken.cpp:216,RefreshGigToken]Failed to get gig token from https://usgovvirginia.handler.control.monitor.azure.us after attempting imm-

Azure Monitor
Azure Monitor

An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.

0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Rukshan edirisinghe 2,365 Reputation points
    2026-10-18T13:28:16.7333333+00:00

    Hi @S Bak

    Those mdsd errors all point to one thing: the agent can't reach the Azure Monitor control endpoints in Azure Government. "Response Code: 0" means it never got any reply, so it keeps retrying, and every retry gets logged. That's what is flooding syslog. Once the agent can connect, the noise stops by itself.

    1. From the VM, test the connection directly with curl -v https://global.handler.control.monitor.azure.us and curl -v https://usgovvirginia.handler.control.monitor.azure.us. A timeout or TLS error confirms a network block.
    2. Allow outbound TCP 443 from the VM to global.handler.control.monitor.azure.us, usgovvirginia.handler.control.monitor.azure.us and <workspace-id>.ods.opinsights.azure.us. If you use an NSG or Azure Firewall, the AzureMonitor and AzureResourceManager service tags cover these.
    3. If traffic goes through a firewall or proxy that does HTTPS inspection, exclude these endpoints. AMA doesn't work with inspected TLS.
    4. If the VM can only get out through a proxy, configure it on the AMA extension (the proxy setting). Proxy environment variables only work from AMA for Linux 1.24.2 onwards.
    5. If you use Azure Monitor Private Link, the agent should use your private data collection endpoint instead. Check that the DCR has a DCE associated and that private DNS resolves it.

    Also, I'd avoid posting subscription IDs and resource paths here, even partly masked. Share those privately if someone asks.

    What does the curl test return from the VM: a timeout, or a certificate error?

    If this resolved your issue, please consider accepting it as the answer. If the endpoints are reachable and the errors continue, let me know and I'll be happy to keep helping.

    Reference:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.