You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Documents that field lever data changes made in the migration.
5
4
author: JeffreyWolford
6
5
ms.author: jeffwo
7
6
ms.reviewer: guywild
8
7
ms.topic: reference
9
8
ms.date: 06/21/2024
10
-
11
9
Customer intent: As an azure administrator, I want to understand which Log Analytics Workspace queries I may need to update after AMA migration.
12
-
13
10
---
14
11
15
12
# AMA agent data field differences from MMA
13
+
16
14
[Azure Monitor Agent (AMA)](./agents-overview.md) replaces the Log Analytics agent, also known as Microsoft Monitor Agent (MMA) and OMS, for Windows and Linux machines, in Azure and non-Azure environments, on-premises and other clouds. The agent introduces a simplified, flexible method of configuring data collection using [Data Collection Rules (DCRs)](../essentials/data-collection-rule-overview.md). The article provides information on the data fields that change when collected by AMA, which is critical information for you to migrate your LAW queries.
17
15
18
16
Each of the data changes was carefully considered and the rational for each change is provided in the table. If you encounter a data field that isn't in the tables file a support request. Your help keeping the tables current and complete is appreciated.
19
17
20
18
## Log analytics workspace tables
19
+
21
20
### W3CIISLog Table for Internet Information Services (IIS)
21
+
22
22
This table collects log data from the Internet Information Service on Window systems.
23
23
24
24
|LAW Field | Difference | Reason| Additional Information |
@@ -27,14 +27,23 @@ This table collects log data from the Internet Information Service on Window sys
27
27
| Fileuri | No longer populated | not required for MMA parity | MMA doesn't collect this field. This field was only populated for IIS logs collected from Azure Cloud Services through the Azure Diagnostics Extension.|
28
28
29
29
### Windows event table
30
+
30
31
This table collects Events from the Windows Event log. There are two other tables that are used to store Windows events, the SecurityEvent and Event tables.
31
32
32
33
|LAW Field | Difference | Reason| Additional Information |
33
34
|---|---|---|---|
34
35
| UserName | MMA enriches the event with the username prior to sending the event for ingestion. AMA do not do the same enrichment. | The AMA enrichment is not yet implemented. | AMA principles dictate that the event data should remain unchanged by default. Adding and enriched field adds possible processing errors and additional cost for storage. In this case, the customer demand for the field is very high and work is underway to add the username. |
35
36
37
+
### Perf Table for Performance Counters
38
+
39
+
The Perf table collects performance counters from Windows and Linux agents, offering valuable insights into the performance of hardware components, operating systems, and applications. Below are key differences in how data is reported between OMS and Azure Monitor Agent (AMA).
40
+
41
+
| LAW Field | Difference | Reason | Additional Information |
| InstanceName | Reported as **_Total** by OMS<br>Reported as **total** by AMA || Where `ObjectName == "Logical Disk"` and `CounterName == "% Used Space"`, the InstanceName value is reported as **_Total** for records ingested by the OMS agent, whereas it is reported as **total** for records ingested by the Azure Monitor Agent (AMA).<br>This does not apply to records ingested by the Microsoft Monitoring Agent (MMA) on Windows. |
44
+
| CounterValue | Is rounded to the nearest whole number by OMS but not rounded by AMA || Where `ObjectName == "Logical Disk"` and `CounterName == "% Used Space"`, the CounterValue is value is rounded to the nearest whole number for records ingested by the OMS agent but not rounded for records ingested by the Azure Monitor Agent (AMA).<br>This does not apply to records ingested by the Microsoft Monitoring Agent (MMA) on Windows. |
0 commit comments