Skip to content

Commit 42b82d5

Browse files
committed
Updates based on review feedback
1 parent 68c1cc6 commit 42b82d5

File tree

3 files changed

+21
-65
lines changed

3 files changed

+21
-65
lines changed

articles/azure-monitor/agents/agents-overview.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,17 +66,17 @@ Azure Monitor Agent currently supports these Azure Monitor features:
6666
| :--- | :--- | :--- | :--- |
6767
| Text logs and Windows IIS logs | Public preview | None | [Collect text logs with Azure Monitor Agent (preview)](data-collection-text-log.md) |
6868
| Windows client installer | Public preview | None | [Set up Azure Monitor Agent on Windows client devices](azure-monitor-agent-windows-client.md) |
69-
| [VM insights](../vm/vminsights-overview.md) | Private preview | Dependency Agent extension, if you’re using the Map Services feature | [Sign-up link](https://aka.ms/amadcr-privatepreviews) |
69+
| [VM insights](../vm/vminsights-overview.md) | Preview | Dependency Agent extension, if you’re using the Map Services feature | [Sign-up link](https://aka.ms/amadcr-privatepreviews) |
7070

7171
Azure Monitor Agent currently supports these Azure services:
7272

7373
| Azure service | Current support | Other extensions installed | More information |
7474
| :--- | :--- | :--- | :--- |
75-
| [Microsoft Defender for Cloud](../../security-center/security-center-introduction.md) | Private preview | <ul><li>Azure Security Agent extension</li><li>SQL Advanced Threat Protection extension</li><li>SQL Vulnerability Assessment extension</li></ul> | [Sign-up link](https://aka.ms/AMAgent) |
76-
| [Microsoft Sentinel](../../sentinel/overview.md) | <ul><li>Windows DNS logs: Private preview</li><li>Linux Syslog CEF: Private preview</li><li>Windows Forwarding Event (WEF): [Public preview](../../sentinel/data-connectors-reference.md#windows-forwarded-events-preview)</li><li>Windows Security Events: [Generally available](../../sentinel/connect-windows-security-events.md?tabs=AMA)</li></ul> | Sentinel DNS extension, if you’re collecting DNS logs. For all other data types, you just need the Azure Monitor Agent extension. | <ul><li>[Sign-up link for Windows DNS logs](https://aka.ms/AMAgent)</li><li>[Sign-up link for Linux Syslog CEF](https://aka.ms/AMAgent)</li><li>No sign-up needed for Windows Forwarding Event (WEF) and Windows Security Events</li></ul> |
77-
| [Change Tracking](../../automation/change-tracking/overview.md) (part of Defender) | Supported as File Integrity Monitoring in the Microsoft Defender for Cloud Private Preview. | Change Tracking extension | [Sign-up link](https://aka.ms/AMAgent) |
75+
| [Microsoft Defender for Cloud](../../security-center/security-center-introduction.md) | Preview | <ul><li>Azure Security Agent extension</li><li>SQL Advanced Threat Protection extension</li><li>SQL Vulnerability Assessment extension</li></ul> | [Sign-up link](https://aka.ms/AMAgent) |
76+
| [Microsoft Sentinel](../../sentinel/overview.md) | <ul><li>Windows DNS logs: Preview</li><li>Linux Syslog CEF: Preview</li><li>Windows Forwarding Event (WEF): [Public preview](../../sentinel/data-connectors-reference.md#windows-forwarded-events-preview)</li><li>Windows Security Events: [Generally available](../../sentinel/connect-windows-security-events.md?tabs=AMA)</li></ul> | Sentinel DNS extension, if you’re collecting DNS logs. For all other data types, you just need the Azure Monitor Agent extension. | <ul><li>[Sign-up link for Windows DNS logs](https://aka.ms/AMAgent)</li><li>[Sign-up link for Linux Syslog CEF](https://aka.ms/AMAgent)</li><li>No sign-up needed for Windows Forwarding Event (WEF) and Windows Security Events</li></ul> |
77+
| [Change Tracking](../../automation/change-tracking/overview.md) (part of Defender) | Supported as File Integrity Monitoring in the Microsoft Defender for Cloud: Preview. | Change Tracking extension | [Sign-up link](https://aka.ms/AMAgent) |
7878
| [Update Management](../../automation/update-management/overview.md) (available without Azure Monitor Agent) | Use Update Management v2 - Public preview | None | [Update management center (preview) documentation](/azure/update-center/) |
79-
| [Network Watcher](../../network-watcher/network-watcher-monitoring-overview.md) | Connection Monitor: Private preview | Azure NetworkWatcher extension | [Sign-up link](https://aka.ms/amadcr-privatepreviews) |
79+
| [Network Watcher](../../network-watcher/network-watcher-monitoring-overview.md) | Connection Monitor: Preview | Azure NetworkWatcher extension | [Sign-up link](https://aka.ms/amadcr-privatepreviews) |
8080

8181
## Supported regions
8282

articles/azure-monitor/agents/azure-monitor-agent-migration.md

Lines changed: 15 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@ ms.topic: conceptual
55
author: guywild
66
ms.author: guywild
77
ms.reviewer: shseth
8-
ms.date: 6/22/2022
8+
ms.date: 08/04/2022
99
ms.custom: devx-track-azurepowershell, devx-track-azurecli
10-
# Customer intent: As an IT manager, I want to undertstand if and when I should move from using legacy agents to Azure Monitor agent.
10+
# Customer intent: As an IT manager, I want to understand if and when I should move from using legacy agents to Azure Monitor agent.
1111
---
1212

1313
# Migrate to Azure Monitor agent from Log Analytics agent
14-
[Azure Monitor agent (AMA)](azure-monitor-agent-overview.md) collects monitoring data from the guest operating system of Azure and hybrid virtual machines and delivers it to Azure Monitor for use by features, insights, and other services, such as [Microsoft Sentinel](../../sentintel/../sentinel/overview.md) and [Microsoft Defender for Cloud](../../defender-for-cloud/defender-for-cloud-introduction.md). Azure Monitor agent replaces the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines Azure Monitor and introduces a simplified, flexible method of configuring collection configuration called [Data Collection Rules (DCRs)](../essentials/data-collection-rule-overview.md). This article provides high-level guidance on when and how to migrate to the new Azure Monitor agent (AMA) based on the agent's benefits and limitations.
14+
[Azure Monitor agent (AMA)](./agents-overview.md) collects monitoring data from the guest operating system of Azure and hybrid virtual machines. The agent delivers the data to Azure Monitor for use by features, insights, and other services, such as [Microsoft Sentinel](../../sentintel/../sentinel/overview.md) and [Microsoft Defender for Cloud](../../defender-for-cloud/defender-for-cloud-introduction.md). Azure Monitor agent replaces the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines Azure Monitor and introduces a simplified, flexible method of configuring collection configuration called [Data Collection Rules (DCRs)](../essentials/data-collection-rule-overview.md). This article provides high-level guidance on when and how to migrate to the new Azure Monitor agent (AMA) based on the agent's benefits and limitations.
1515

1616
## Why should I migrate to the Azure Monitor agent?
1717
- **Security and performance**
@@ -23,7 +23,7 @@ ms.custom: devx-track-azurepowershell, devx-track-azurecli
2323
- **Simpler management** of data collection, including ease of troubleshooting
2424
- Easy **multihoming** on Windows and Linux.
2525
- Centralized, ‘in the cloud’ agent configuration makes every action, across the data collection lifecycle, simpler and more easily scalable, from onboarding to deployment to updates and changes over time.
26-
- More transparency and control of additional capabilities and services, such as Sentinel, Defender for Cloud, and VM Insights, etc.
26+
- Greater transparency and control of more capabilities and services, such as Sentinel, Defender for Cloud, and VM Insights.
2727
- **A single agent** that consolidates all features necessary to address all telemetry data collection needs across servers and client devices (running Windows 10, 11). This is goal, though AMA is currently converging with the Log Analytics agents.
2828

2929
## When should I migrate to the Azure Monitor Agent?
@@ -42,69 +42,25 @@ Your migration plan to the Azure Monitor Agent should include the following cons
4242
> [!IMPORTANT]
4343
> The Log Analytics agent will be [retired on **31 August, 2024**](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). If you are currently using the Log Analytics agent with Azure Monitor or other supported features and services, you should start planning your migration to the Azure Monitor agent using the information in this article.
4444
45-
## Should I install install Azure Monitor Agent together with a legacy agent?
45+
## Should I install Azure Monitor Agent together with a legacy agent?
4646

47-
The Azure Monitor agent can coexist (run side by side on the same machine) with the legacy Log Analytics agents so that you can continue to use their existing functionality during evaluation or migration. While this allows you to begin transition given the limitations, you must review the below points carefully:
48-
- Be careful in collecting duplicate data because it could skew query results and affect downstream features like alerts, dashboards or workbooks. For example, VM insights uses the Log Analytics agent to send performance data to a Log Analytics workspace. You might also have configured the workspace to collect Windows events and Syslog events from agents. If you install the Azure Monitor agent and create a data collection rule for these same events and performance data, it will result in duplicate data. As such, ensure you're not collecting the same data from both agents. If you are, ensure they're **collecting from different machines** or **going to separate destinations**.
49-
- Besides data duplication, this would also generate more charges for data ingestion and retention.
50-
- Running two telemetry agents on the same machine would result in double the resource consumption, including but not limited to CPU, memory, storage space and network bandwidth.
47+
Azure Monitor Agent can run alongside the legacy Log Analytics agents on the same machine so that you can continue to use their existing functionality during evaluation or migration. While this allows you to begin the transition given the limitations, keep in mind the considerations below:
48+
- Be careful in collecting duplicate data because it could skew query results and affect downstream features like alerts, dashboards or workbooks. For example, VM insights uses the Log Analytics agent to send performance data to a Log Analytics workspace. You might also have configured the workspace to collect Windows events and Syslog events from agents. If you install Azure Monitor Agent and create a data collection rule for these events and performance data, you'll collect duplicate data. Make sure you're not collecting the same data from both agents. If you're collecting the same data with both agents, ensure they're **collecting from different machines** or **going to separate destinations**. Collecting duplicate data also generates more charges for data ingestion and retention.
49+
- Running two telemetry agents on the same machine consumes double the resources, including, but not limited to CPU, memory, storage space, and network bandwidth.
5150

5251
> [!NOTE]
5352
> When you use both agents during evaluation or migration, you can use the **Category** column of the [Heartbeat](/azure/azure-monitor/reference/tables/Heartbeat) table in your Log Analytics workspace, and filter for **Azure Monitor Agent**.
5453
55-
5654
## Current capabilities
5755

58-
Azure Monitor agent currently supports the following core functionality:
59-
60-
- **Collect guest logs and metrics** from any machine in Azure, in other clouds, or on-premises. [Azure Arc-enabled servers](../../azure-arc/servers/overview.md) are required for machines outside of Azure.
61-
- **Centrally manage data collection configuration** using [data collection rules](/azure/azure-monitor/agents/data-collection-rule-overview), and management configuration using Azure Resource Manager (ARM) templates or policies.
62-
- **Use Windows event filtering or multihoming** for Windows or Linux logs.
63-
- **Improved extension management.** The Azure Monitor agent uses a new method of handling extensibility that's more transparent and controllable than management packs and Linux plug-ins in the current Log Analytics agents.
64-
65-
> [!NOTE]
66-
> Windows and Linux machines that reside on cloud platforms other than Azure, or are on-premises machines, must be Azure Arc-enabled so that the AMA can send logs to the Log Analytics workspace. For more information, see:
67-
>
68-
> - [What are Azure Arc–enabled servers?](../../azure-arc/servers/overview.md)
69-
> - [Overview of Azure Arc – enabled servers agent](../../azure-arc/servers/agent-overview.md)
70-
> - [Plan and deploy Azure Arc – enabled servers at scale](../../azure-arc/servers/plan-at-scale-deployment.md)
71-
72-
73-
## Gap analysis between agents
74-
The following tables show gap analyses for the **log types** that are currently collected by each agent. This will be updated as support for AMA grows towards parity with the Log Analytics agent. For a general comparison of Azure Monitor agents, see [Overview of Azure Monitor agents](../agents/azure-monitor-agent-overview.md).
75-
76-
77-
> [!IMPORTANT]
78-
> If you use Microsoft Sentinel, see [Gap analysis for Microsoft Sentinel](../../sentinel/ama-migrate.md#gap-analysis-between-agents) for a comparison of the additional data collected by Microsoft Sentinel.
79-
80-
81-
### Windows logs
82-
83-
|Log type / Support |Azure Monitor agent support |Log Analytics agent support |
84-
|---------|---------|---------|
85-
| **Security Events** | Yes | No |
86-
| **Performance counters** | Yes | Yes |
87-
| **Windows Event Logs** | Yes | Yes |
88-
| **Filtering by event ID** | Yes | No |
89-
| **Text logs** | Yes | Yes |
90-
| **IIS logs** | Yes | Yes |
91-
| **Application and service logs** | Yes | Yes |
92-
| **Multi-homing** | Yes | Yes |
93-
94-
### Linux logs
95-
96-
|Log type / Support |Azure Monitor agent support |Log Analytics agent support |
97-
|---------|---------|---------|
98-
| **Syslog** | Yes | Yes |
99-
| **Performance counters** | Yes | Yes |
100-
| **Text logs** | Yes | Yes |
101-
| **Multi-homing** | Yes | No |
56+
For full details about the capabilities of Azure Monitor Agent and a comparison with legacy agent capabilities, see [Azure Monitor Agent overview](../agents/agents-overview.md).
10257

58+
If you use Microsoft Sentinel, see [Gap analysis for Microsoft Sentinel](../../sentinel/ama-migrate.md#gap-analysis-between-agents) for a comparison of the extra data collected by Microsoft Sentinel.
10359

10460
## Test migration
10561
To ensure safe deployment during migration, begin testing with few resources running the existing Log Analytics agent in your nonproduction environment. After you validate the data collected on these test resources, roll out to production by following the same steps.
10662

107-
See [create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) to start collecting some of the existing data types. Once you validate data is flowing as expected with the Azure Monitor agent, check the `Category` column in the [Heartbeat](/azure/azure-monitor/reference/tables/heartbeat) table for the value *Azure Monitor Agent* for AMA collected data. Ensure it matches data flowing through the existing Log Analytics agent.
63+
See [create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) to start collecting some of the existing data types. After you validate that data is flowing as expected with Azure Monitor Agent, check the `Category` column in the [Heartbeat](/azure/azure-monitor/reference/tables/heartbeat) table for the value *Azure Monitor Agent* for AMA collected data. Ensure it matches data flowing through the existing Log Analytics agent.
10864

10965
## At-scale migration using Azure Policy
11066
[Azure Policy](../../governance/policy/overview.md) and [Resource Manager templates](../resource-manager-samples.md) provide scalability to migrate a large number of agents.
@@ -121,12 +77,12 @@ See [Using Azure Policy](azure-monitor-agent-manage.md#using-azure-policy) for d
12177

12278
Validate that data is flowing as expected with the Azure Monitor agent and that all downstream dependencies like dashboards, alerts, and runbook workers. Workbooks should all continue to function using data from the new agent.
12379

124-
When you confirm that data is being collected properly, [uninstall the Log Analytics agent](./agent-manage.md#uninstall-agent) from the resources. Don't uninstall it if you need to use it for System Center Operations Manager scenarios or others solutions not yet available on the Azure Monitor agent. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
80+
When you confirm that data is being collected properly, [uninstall the Log Analytics agent](./agent-manage.md#uninstall-agent) from the resources. Don't uninstall it if you need to use it for System Center Operations Manager scenarios or others solutions not yet available on Azure Monitor Agent. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
12581

12682
## Next steps
12783

12884
For more information, see:
12985

130-
- [Overview of the Azure Monitor agents](agents-overview.md)
131-
- [AMA migration for Microsoft Sentinel](../../sentinel/ama-migrate.md)
132-
- [Frequently asked questions for AMA migration](/azure/azure-monitor/faq#azure-monitor-agent)
86+
- [Azure Monitor Agent overview](agents-overview.md)
87+
- [Azure Monitor Agent migration for Microsoft Sentinel](../../sentinel/ama-migrate.md)
88+
- [Frequently asked questions for Azure Monitor Agent migration](/azure/azure-monitor/faq#azure-monitor-agent)

articles/migrate/concepts-dependency-visualization.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ After discovery of dependency data begins, polling begins:
4545
- Name of application that run processes that have active connections.
4646
- Destination port on the active connections.
4747

48-
- The gathered data is processed on the Azure Migrate appliance, to deduce identity information, and is sent to Azure Migrate every six hour
48+
- The gathered data is processed on the Azure Migrate appliance, to deduce identity information, and is sent to Azure Migrate every six hours.
4949

5050

5151
## Agent-based analysis

0 commit comments

Comments
 (0)