You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/agents-overview.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -66,17 +66,17 @@ Azure Monitor Agent currently supports these Azure Monitor features:
66
66
| :--- | :--- | :--- | :--- |
67
67
| Text logs and Windows IIS logs | Public preview | None |[Collect text logs with Azure Monitor Agent (preview)](data-collection-text-log.md)|
68
68
| Windows client installer | Public preview | None |[Set up Azure Monitor Agent on Windows client devices](azure-monitor-agent-windows-client.md)|
69
-
|[VM insights](../vm/vminsights-overview.md)|Private preview| Dependency Agent extension, if you’re using the Map Services feature |[Sign-up link](https://aka.ms/amadcr-privatepreviews)|
69
+
|[VM insights](../vm/vminsights-overview.md)|Preview| Dependency Agent extension, if you’re using the Map Services feature |[Sign-up link](https://aka.ms/amadcr-privatepreviews)|
70
70
71
71
Azure Monitor Agent currently supports these Azure services:
72
72
73
73
| Azure service | Current support | Other extensions installed | More information |
|[Microsoft Sentinel](../../sentinel/overview.md)| <ul><li>Windows DNS logs: Private preview</li><li>Linux Syslog CEF: Private preview</li><li>Windows Forwarding Event (WEF): [Public preview](../../sentinel/data-connectors-reference.md#windows-forwarded-events-preview)</li><li>Windows Security Events: [Generally available](../../sentinel/connect-windows-security-events.md?tabs=AMA)</li></ul> | Sentinel DNS extension, if you’re collecting DNS logs. For all other data types, you just need the Azure Monitor Agent extension. | <ul><li>[Sign-up link for Windows DNS logs](https://aka.ms/AMAgent)</li><li>[Sign-up link for Linux Syslog CEF](https://aka.ms/AMAgent)</li><li>No sign-up needed for Windows Forwarding Event (WEF) and Windows Security Events</li></ul> |
77
-
|[Change Tracking](../../automation/change-tracking/overview.md) (part of Defender) | Supported as File Integrity Monitoring in the Microsoft Defender for Cloud Private Preview. | Change Tracking extension |[Sign-up link](https://aka.ms/AMAgent)|
|[Microsoft Sentinel](../../sentinel/overview.md)| <ul><li>Windows DNS logs: Preview</li><li>Linux Syslog CEF: Preview</li><li>Windows Forwarding Event (WEF): [Public preview](../../sentinel/data-connectors-reference.md#windows-forwarded-events-preview)</li><li>Windows Security Events: [Generally available](../../sentinel/connect-windows-security-events.md?tabs=AMA)</li></ul> | Sentinel DNS extension, if you’re collecting DNS logs. For all other data types, you just need the Azure Monitor Agent extension. | <ul><li>[Sign-up link for Windows DNS logs](https://aka.ms/AMAgent)</li><li>[Sign-up link for Linux Syslog CEF](https://aka.ms/AMAgent)</li><li>No sign-up needed for Windows Forwarding Event (WEF) and Windows Security Events</li></ul> |
77
+
|[Change Tracking](../../automation/change-tracking/overview.md) (part of Defender) | Supported as File Integrity Monitoring in the Microsoft Defender for Cloud: Preview. | Change Tracking extension |[Sign-up link](https://aka.ms/AMAgent)|
78
78
|[Update Management](../../automation/update-management/overview.md) (available without Azure Monitor Agent) | Use Update Management v2 - Public preview | None |[Update management center (preview) documentation](/azure/update-center/)|
# Customer intent: As an IT manager, I want to undertstand if and when I should move from using legacy agents to Azure Monitor agent.
10
+
# Customer intent: As an IT manager, I want to understand if and when I should move from using legacy agents to Azure Monitor agent.
11
11
---
12
12
13
13
# Migrate to Azure Monitor agent from Log Analytics agent
14
-
[Azure Monitor agent (AMA)](azure-monitor-agent-overview.md) collects monitoring data from the guest operating system of Azure and hybrid virtual machines and delivers it to Azure Monitor for use by features, insights, and other services, such as [Microsoft Sentinel](../../sentintel/../sentinel/overview.md) and [Microsoft Defender for Cloud](../../defender-for-cloud/defender-for-cloud-introduction.md). Azure Monitor agent replaces the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines Azure Monitor and introduces a simplified, flexible method of configuring collection configuration called [Data Collection Rules (DCRs)](../essentials/data-collection-rule-overview.md). This article provides high-level guidance on when and how to migrate to the new Azure Monitor agent (AMA) based on the agent's benefits and limitations.
14
+
[Azure Monitor agent (AMA)](./agents-overview.md) collects monitoring data from the guest operating system of Azure and hybrid virtual machines. The agent delivers the data to Azure Monitor for use by features, insights, and other services, such as [Microsoft Sentinel](../../sentintel/../sentinel/overview.md) and [Microsoft Defender for Cloud](../../defender-for-cloud/defender-for-cloud-introduction.md). Azure Monitor agent replaces the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines Azure Monitor and introduces a simplified, flexible method of configuring collection configuration called [Data Collection Rules (DCRs)](../essentials/data-collection-rule-overview.md). This article provides high-level guidance on when and how to migrate to the new Azure Monitor agent (AMA) based on the agent's benefits and limitations.
15
15
16
16
## Why should I migrate to the Azure Monitor agent?
-**Simpler management** of data collection, including ease of troubleshooting
24
24
- Easy **multihoming** on Windows and Linux.
25
25
- Centralized, ‘in the cloud’ agent configuration makes every action, across the data collection lifecycle, simpler and more easily scalable, from onboarding to deployment to updates and changes over time.
26
-
-More transparency and control of additional capabilities and services, such as Sentinel, Defender for Cloud, and VM Insights, etc.
26
+
-Greater transparency and control of more capabilities and services, such as Sentinel, Defender for Cloud, and VM Insights.
27
27
-**A single agent** that consolidates all features necessary to address all telemetry data collection needs across servers and client devices (running Windows 10, 11). This is goal, though AMA is currently converging with the Log Analytics agents.
28
28
29
29
## When should I migrate to the Azure Monitor Agent?
@@ -42,69 +42,25 @@ Your migration plan to the Azure Monitor Agent should include the following cons
42
42
> [!IMPORTANT]
43
43
> The Log Analytics agent will be [retired on **31 August, 2024**](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). If you are currently using the Log Analytics agent with Azure Monitor or other supported features and services, you should start planning your migration to the Azure Monitor agent using the information in this article.
44
44
45
-
## Should I install install Azure Monitor Agent together with a legacy agent?
45
+
## Should I install Azure Monitor Agent together with a legacy agent?
46
46
47
-
The Azure Monitor agent can coexist (run side by side on the same machine) with the legacy Log Analytics agents so that you can continue to use their existing functionality during evaluation or migration. While this allows you to begin transition given the limitations, you must review the below points carefully:
48
-
- Be careful in collecting duplicate data because it could skew query results and affect downstream features like alerts, dashboards or workbooks. For example, VM insights uses the Log Analytics agent to send performance data to a Log Analytics workspace. You might also have configured the workspace to collect Windows events and Syslog events from agents. If you install the Azure Monitor agent and create a data collection rule for these same events and performance data, it will result in duplicate data. As such, ensure you're not collecting the same data from both agents. If you are, ensure they're **collecting from different machines** or **going to separate destinations**.
49
-
- Besides data duplication, this would also generate more charges for data ingestion and retention.
50
-
- Running two telemetry agents on the same machine would result in double the resource consumption, including but not limited to CPU, memory, storage space and network bandwidth.
47
+
Azure Monitor Agent can run alongside the legacy Log Analytics agents on the same machine so that you can continue to use their existing functionality during evaluation or migration. While this allows you to begin the transition given the limitations, keep in mind the considerations below:
48
+
- Be careful in collecting duplicate data because it could skew query results and affect downstream features like alerts, dashboards or workbooks. For example, VM insights uses the Log Analytics agent to send performance data to a Log Analytics workspace. You might also have configured the workspace to collect Windows events and Syslog events from agents. If you install Azure Monitor Agent and create a data collection rule for these events and performance data, you'll collect duplicate data. Make sure you're not collecting the same data from both agents. If you're collecting the same data with both agents, ensure they're **collecting from different machines** or **going to separate destinations**. Collecting duplicate data also generates more charges for data ingestion and retention.
49
+
- Running two telemetry agents on the same machine consumes double the resources, including, but not limited to CPU, memory, storage space, and network bandwidth.
51
50
52
51
> [!NOTE]
53
52
> When you use both agents during evaluation or migration, you can use the **Category** column of the [Heartbeat](/azure/azure-monitor/reference/tables/Heartbeat) table in your Log Analytics workspace, and filter for **Azure Monitor Agent**.
54
53
55
-
56
54
## Current capabilities
57
55
58
-
Azure Monitor agent currently supports the following core functionality:
59
-
60
-
-**Collect guest logs and metrics** from any machine in Azure, in other clouds, or on-premises. [Azure Arc-enabled servers](../../azure-arc/servers/overview.md) are required for machines outside of Azure.
61
-
-**Centrally manage data collection configuration** using [data collection rules](/azure/azure-monitor/agents/data-collection-rule-overview), and management configuration using Azure Resource Manager (ARM) templates or policies.
62
-
-**Use Windows event filtering or multihoming** for Windows or Linux logs.
63
-
-**Improved extension management.** The Azure Monitor agent uses a new method of handling extensibility that's more transparent and controllable than management packs and Linux plug-ins in the current Log Analytics agents.
64
-
65
-
> [!NOTE]
66
-
> Windows and Linux machines that reside on cloud platforms other than Azure, or are on-premises machines, must be Azure Arc-enabled so that the AMA can send logs to the Log Analytics workspace. For more information, see:
67
-
>
68
-
> -[What are Azure Arc–enabled servers?](../../azure-arc/servers/overview.md)
69
-
> -[Overview of Azure Arc – enabled servers agent](../../azure-arc/servers/agent-overview.md)
70
-
> -[Plan and deploy Azure Arc – enabled servers at scale](../../azure-arc/servers/plan-at-scale-deployment.md)
71
-
72
-
73
-
## Gap analysis between agents
74
-
The following tables show gap analyses for the **log types** that are currently collected by each agent. This will be updated as support for AMA grows towards parity with the Log Analytics agent. For a general comparison of Azure Monitor agents, see [Overview of Azure Monitor agents](../agents/azure-monitor-agent-overview.md).
75
-
76
-
77
-
> [!IMPORTANT]
78
-
> If you use Microsoft Sentinel, see [Gap analysis for Microsoft Sentinel](../../sentinel/ama-migrate.md#gap-analysis-between-agents) for a comparison of the additional data collected by Microsoft Sentinel.
79
-
80
-
81
-
### Windows logs
82
-
83
-
|Log type / Support |Azure Monitor agent support |Log Analytics agent support |
84
-
|---------|---------|---------|
85
-
|**Security Events**| Yes | No |
86
-
|**Performance counters**| Yes | Yes |
87
-
|**Windows Event Logs**| Yes | Yes |
88
-
|**Filtering by event ID**| Yes | No |
89
-
|**Text logs**| Yes | Yes |
90
-
|**IIS logs**| Yes | Yes |
91
-
|**Application and service logs**| Yes | Yes |
92
-
|**Multi-homing**| Yes | Yes |
93
-
94
-
### Linux logs
95
-
96
-
|Log type / Support |Azure Monitor agent support |Log Analytics agent support |
97
-
|---------|---------|---------|
98
-
|**Syslog**| Yes | Yes |
99
-
|**Performance counters**| Yes | Yes |
100
-
|**Text logs**| Yes | Yes |
101
-
|**Multi-homing**| Yes | No |
56
+
For full details about the capabilities of Azure Monitor Agent and a comparison with legacy agent capabilities, see [Azure Monitor Agent overview](../agents/agents-overview.md).
102
57
58
+
If you use Microsoft Sentinel, see [Gap analysis for Microsoft Sentinel](../../sentinel/ama-migrate.md#gap-analysis-between-agents) for a comparison of the extra data collected by Microsoft Sentinel.
103
59
104
60
## Test migration
105
61
To ensure safe deployment during migration, begin testing with few resources running the existing Log Analytics agent in your nonproduction environment. After you validate the data collected on these test resources, roll out to production by following the same steps.
106
62
107
-
See [create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) to start collecting some of the existing data types. Once you validate data is flowing as expected with the Azure Monitor agent, check the `Category` column in the [Heartbeat](/azure/azure-monitor/reference/tables/heartbeat) table for the value *Azure Monitor Agent* for AMA collected data. Ensure it matches data flowing through the existing Log Analytics agent.
63
+
See [create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) to start collecting some of the existing data types. After you validate that data is flowing as expected with Azure Monitor Agent, check the `Category` column in the [Heartbeat](/azure/azure-monitor/reference/tables/heartbeat) table for the value *Azure Monitor Agent* for AMA collected data. Ensure it matches data flowing through the existing Log Analytics agent.
108
64
109
65
## At-scale migration using Azure Policy
110
66
[Azure Policy](../../governance/policy/overview.md) and [Resource Manager templates](../resource-manager-samples.md) provide scalability to migrate a large number of agents.
@@ -121,12 +77,12 @@ See [Using Azure Policy](azure-monitor-agent-manage.md#using-azure-policy) for d
121
77
122
78
Validate that data is flowing as expected with the Azure Monitor agent and that all downstream dependencies like dashboards, alerts, and runbook workers. Workbooks should all continue to function using data from the new agent.
123
79
124
-
When you confirm that data is being collected properly, [uninstall the Log Analytics agent](./agent-manage.md#uninstall-agent) from the resources. Don't uninstall it if you need to use it for System Center Operations Manager scenarios or others solutions not yet available on the Azure Monitor agent. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
80
+
When you confirm that data is being collected properly, [uninstall the Log Analytics agent](./agent-manage.md#uninstall-agent) from the resources. Don't uninstall it if you need to use it for System Center Operations Manager scenarios or others solutions not yet available on Azure Monitor Agent. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
125
81
126
82
## Next steps
127
83
128
84
For more information, see:
129
85
130
-
-[Overview of the Azure Monitor agents](agents-overview.md)
131
-
-[AMA migration for Microsoft Sentinel](../../sentinel/ama-migrate.md)
132
-
-[Frequently asked questions for AMA migration](/azure/azure-monitor/faq#azure-monitor-agent)
0 commit comments