Bring up Azure Arc connection on another machine

Zambre, Akash 0

We have a setup with multiple machines and one of these machines is connected to Azure Arc via azcmagent.

In case this connected machine goes down, we want another machine to take over and manage the connection, for availability. For this we copy over the configuration files (localconfig, agentconfig and certs) to another machine and restart himds daemon. But this does not bring up the connection. However, if we do restart this machine we see the connection is active.

Is there a way to bring up the connection on another machine without having to restart?

Ashok Gandhi Kotnana 4,310 Reputation points Microsoft External Staff

2025-03-07T06:34:20.6+00:00

Hi @Zambre, Akash

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

To establish an Azure Arc connection on another machine without restarting it, ensure that the Azure Connected Machine agent is properly configured and running. Simply copying configuration files and restarting the himds daemon may not be enough.

After copying the necessary configuration files, run the azcmagent connect command on the new machine to explicitly register it with Azure Arc. This ensures a proper connection without requiring a reboot.

If issues arise, verify that the agent is running and check for any network connectivity problems that might be preventing communication with Azure.

Refer below MS documents for more information: -

https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-update-management-machines#add-machines-from-the-azure-portal

https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview#deployment-options-and-requirements

https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-agent?tabs=windows#alerting-for-azure-arc-enabled-server-disconnection

Feel free to reach out if you have any further questions or need additional information—I’m happy to assist!

Please provide your valuable comments
Zambre, Akash 0 Reputation points

2025-03-07T06:39:52.4433333+00:00

Thanks for your response Ashok.
The "azcmagent connect" command needs parameters right? Do we have to provide those?

We want to take over the same connection from one machine to another, not establish a new one.
Ashok Gandhi Kotnana 4,310 Reputation points Microsoft External Staff

2025-03-07T06:57:43.3266667+00:00

Hi @Zambre, Akash

Thanks for detailing clearly.

This is one approach you can try, let me know how it goes

Yes, the "azcmagent connect" command does require parameters to establish a connection. If you want to take over the same connection from one machine to another, you will need to provide the necessary parameters such as the service principal ID, service principal secret, tenant ID, subscription ID, resource group, and location.

However, to transfer the connection from one machine to another, you should first disconnect the original machine using the azcmagent disconnect command and then connect the new machine using the azcmagent connect command with the appropriate parameters.

azcmagent disconnect --force-local-only on each cloned machine, then rerun azcmagent connect using an appropriate credential to connect the machines to the cloud using a unique resource name.

https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-service-principal#install-the-agent-and-connect-to-azure

Please provide your valuable comments
Zambre, Akash 0 Reputation points

2025-03-07T07:08:39.22+00:00

Let say the setup I have is multiple machines serving as one Unit. If one goes down, other takes on the role. And one of this machine has the connection representing this entire Unit.

The disconnect and then connect is basically re-doing the connection all over again.
I can't really do the disconnect on the first machine because let say the machine is down.
What I am looking for is the second machine to take over the connection in such case.

Initial connection is done using access-token btw.

When I copy over the configuration files and restart the second machine, connection do comes up as active, with same setup of parameters and resource-name.

But restarting the machine itself is an expensive operation here.
Ashok Gandhi Kotnana 4,310 Reputation points Microsoft External Staff

2025-03-10T03:23:44.33+00:00

Hi @Zambre, Akash

Just want to check if you have tried doing the restart of the above services. and let us know how it goes

If the answer is helpful, please do "Upvote it"
Zambre, Akash 0 Reputation points

2025-03-10T03:35:26.11+00:00

Hi, I have a linux setup and just have himds service running. The azcmagent service is invoked when connect/disconnect is being run.

So restarting the himds service did not help.

Give me some time, I will collect the logs and attach here.
Ashok Gandhi Kotnana 4,310 Reputation points Microsoft External Staff

2025-03-10T03:37:33.9466667+00:00

Hi @Zambre, Akash

Thanks for the information, we will wait for your logs

Thanks
Zambre, Akash 0 Reputation points

2025-03-10T05:59:41.3433333+00:00

himds.log
Attaching the himds.log file here.

The daemon is restarted at time="2025-03-10T01:51:22-04:00", where is starts to load the bought over agentconfig and localconfig. This fails after few retries -

URL="https://login.microsoftonline.com/8e21f23a-10b9-46fb-9d50-720ef604be98/v2.0/.well-known/openid-configuration"

time="2025-03-10T01:54:43-04:00" level=error msg="failed to acquire token via certificate: error acquiring token from certificate: ClientCertificateCredential: unable to resolve an endpoint: server response error:\n context deadline exceeded" sessionId=97d2f199-1dae-4fed-9766-48066a692ba5

time="2025-03-10T01:54:43-04:00" level=debug msg="AcquireToken failed. Retry #2 failed to acquire token via certificate: error acquiring token from certificate: ClientCertificateCredential: unable to resolve an endpoint: server response error:\n context deadline exceeded"

time="2025-03-10T01:54:53-04:00" level=error msg="failed to acquire token via certificate: error acquiring token from certificate: ClientCertificateCredential: unable to resolve an endpoint: server response error:\n context deadline exceeded" location=DoHeartbeat_2a
Pranay Reddy Madireddy 2,490 Reputation points Microsoft External Staff

2025-03-10T12:01:54.1333333+00:00

Hi @Zambre, Akash

I have requested for below detailed in the private message, kindly share these details in the private message

1.Subscription ID

2.Tenant ID

3.Email ID

Thank you
Madugula Jahnavi 5 Reputation points Microsoft External Staff

2025-03-11T10:39:31.83+00:00

Zambre, Akash, I understand that still the issue persists though you tried all the above provided suggestions. Let me work on the issue further. Firstly, if restarting himds alone did not work, can you try clearing its cached credentials once with the help of Sudo commands!
Zambre, Akash 0 Reputation points

2025-03-11T13:23:51.76+00:00

Hi @Anonymous , how do I clear the cache credentials?
Madugula Jahnavi 5 Reputation points Microsoft External Staff

2025-03-12T11:02:09.4633333+00:00

Zambre, Akash, Can you check the sudo command provided here with the relevant himds path to clear it and restart the himds.

sudo rm -rf /var/lib/himds

1 answer

Ashok Gandhi Kotnana 4,310 Reputation points Microsoft External Staff

2025-03-07T14:33:50.0766667+00:00

Hi @Zambre, Akash

Below are the services that need to be restarted. along with azcmagent, restarting them will likely resolve the issue.

1.himds

2.gc_extension_service

3.extensionservice

4.azcmagent

If restarting these services doesn’t resolve the issue, please share the logs from the path below.

Log Files: Logs are stored locally for troubleshooting:

Linux: /var/opt/azcmagent/log/

Configuration files for the agent are stored in:

Linux: /etc/azcmagent

Please provide your valuable comments

Thankyou
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Bring up Azure Arc connection on another machine

1 answer

Your answer