Skip to content

Commit 90c2fb1

Browse files
authored
Merge pull request #204803 from paulth1/five-agents-articles
edit pass: Five agents articles
2 parents e2181a4 + 851ff9f commit 90c2fb1

File tree

6 files changed

+396
-358
lines changed

6 files changed

+396
-358
lines changed

articles/azure-monitor/agents/agent-windows.md

Lines changed: 123 additions & 119 deletions
Large diffs are not rendered by default.

articles/azure-monitor/agents/agents-overview.md

Lines changed: 71 additions & 74 deletions
Large diffs are not rendered by default.

articles/azure-monitor/agents/azure-monitor-agent-overview.md

Lines changed: 74 additions & 52 deletions
Large diffs are not rendered by default.

articles/azure-monitor/agents/data-sources-custom-logs.md

Lines changed: 90 additions & 78 deletions
Large diffs are not rendered by default.
Lines changed: 37 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Log Analytics agent overview
3-
description: This topic helps you understand how to collect data and monitor computers hosted in Azure, on-premises, or other cloud environment with Log Analytics.
3+
description: This article helps you understand how to collect data and monitor computers hosted in Azure, on-premises, or other cloud environments with Log Analytics.
44
ms.topic: conceptual
55
author: bwren
66
ms.author: bwren
@@ -11,86 +11,87 @@ ms.reviewer: luki
1111

1212
# Log Analytics agent overview
1313

14-
The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by [System Center Operations Manager](/system-center/scom/) and sends collected data to your Log Analytics workspace in Azure Monitor. The Log Analytics agent also supports insights and other services in Azure Monitor such as [VM insights](../vm/vminsights-enable-overview.md), [Microsoft Defender for Cloud](../../security-center/index.yml), and [Azure Automation](../../automation/automation-intro.md). This article provides a detailed overview of the agent, system and network requirements, and deployment methods.
14+
The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and machines monitored by [System Center Operations Manager](/system-center/scom/). Collected data is sent to your Log Analytics workspace in Azure Monitor.
15+
16+
The Log Analytics agent also supports insights and other services in Azure Monitor, such as [VM insights](../vm/vminsights-enable-overview.md), [Microsoft Defender for Cloud](../../security-center/index.yml), and [Azure Automation](../../automation/automation-intro.md). This article provides a detailed overview of the agent, system and network requirements, and deployment methods.
1517

1618
>[!IMPORTANT]
17-
>The Log Analytics agent is on a **deprecation path** and won't be supported after **August 31, 2024**. If you use the Log Analytics agent to ingest data to Azure Monitor, make sure to [migrate to the new Azure Monitor agent](./azure-monitor-agent-migration.md) prior to that date.
19+
>The Log Analytics agent is on a **deprecation path** and won't be supported after **August 31, 2024**. If you use the Log Analytics agent to ingest data to Azure Monitor, [migrate to the new Azure Monitor agent](./azure-monitor-agent-migration.md) prior to that date.
1820
19-
> [!NOTE]
20-
> You may also see the Log Analytics agent referred to as the Microsoft Monitoring Agent (MMA).
21+
You might also see the Log Analytics agent referred to as Microsoft Monitoring Agent (MMA).
2122

2223
## Comparison to other agents
23-
See [Overview of Azure Monitor agents](agents-overview.md) for a comparison between the Log Analytics and other agents in Azure Monitor.
24+
25+
For a comparison between the Log Analytics and other agents in Azure Monitor, see [Overview of Azure Monitor agents](agents-overview.md).
2426

2527
## Supported operating systems
2628

27-
See [Supported operating systems](../agents/agents-overview.md#supported-operating-systems) for a list of the Windows and Linux operating system versions that are supported by the Log Analytics agent.
29+
For a list of the Windows and Linux operating system versions that are supported by the Log Analytics agent, see [Supported operating systems](../agents/agents-overview.md#supported-operating-systems).
2830

2931
## Installation options
3032

3133
There are multiple methods to install the Log Analytics agent and connect your machine to Azure Monitor depending on your requirements. The following sections list the possible methods for different types of virtual machine.
3234

3335
> [!NOTE]
34-
> It is not supported to clone a machine with the Log Analytics Agent already configured. If the agent has already been associated with a workspace this will not work for 'golden images'.
36+
> Cloning a machine with the Log Analytics Agent already configured is *not* supported. If the agent is already associated with a workspace, cloning won't work for "golden images."
3537
3638
### Azure virtual machine
3739

38-
- Use [VM insights](../vm/vminsights-enable-overview.md) to install the agent for a [single machine using the Azure portal](../vm/vminsights-enable-portal.md) or for [multiple machines at scale](../vm/vminsights-enable-policy.md). This will install the Log Analytics agent and [Dependency agent](agents-overview.md#dependency-agent).
39-
- Log Analytics VM extension for [Windows](../../virtual-machines/extensions/oms-windows.md) or [Linux](../../virtual-machines/extensions/oms-linux.md) can be installed with the Azure portal, Azure CLI, Azure PowerShell, or a Azure Resource Manager template.
40-
- [Microsoft Defender for Cloud can provision the Log Analytics agent](../../security-center/security-center-enable-data-collection.md) on all supported Azure VMs and any new ones that are created if you enable it to monitor for security vulnerabilities and threats.
41-
- Install for individual Azure virtual machines [manually from the Azure portal](../vm/monitor-virtual-machine.md?toc=%2fazure%2fazure-monitor%2ftoc.json).
40+
- Use [VM insights](../vm/vminsights-enable-overview.md) to install the agent for a [single machine by using the Azure portal](../vm/vminsights-enable-portal.md) or for [multiple machines at scale](../vm/vminsights-enable-policy.md). This process will install the Log Analytics agent and [Dependency agent](agents-overview.md#dependency-agent).
41+
- Install the Log Analytics VM extension for [Windows](../../virtual-machines/extensions/oms-windows.md) or [Linux](../../virtual-machines/extensions/oms-linux.md) with the Azure portal, the Azure CLI, Azure PowerShell, or an Azure Resource Manager template.
42+
- Use [Microsoft Defender for Cloud to provision the Log Analytics agent](../../security-center/security-center-enable-data-collection.md) on all supported Azure VMs and any new ones that are created if you've enabled it to monitor for security vulnerabilities and threats.
43+
- Install individual Azure virtual machines [manually from the Azure portal](../vm/monitor-virtual-machine.md?toc=%2fazure%2fazure-monitor%2ftoc.json).
4244
- Connect the machine to a workspace from the **Virtual machines** option in the **Log Analytics workspaces** menu in the Azure portal.
4345

4446
### Windows virtual machine on-premises or in another cloud
4547

46-
- Use [Azure Arc-enabled servers](../../azure-arc/servers/overview.md) to deploy and manage the Log Analytics VM extension. Review the [deployment options](../../azure-arc/servers/concept-log-analytics-extension-deployment.md) to understand the different deployment methods available for the extension on machines registered with Arc-enabled servers.
48+
- Use [Azure Arc-enabled servers](../../azure-arc/servers/overview.md) to deploy and manage the Log Analytics VM extension. Review the [deployment options](../../azure-arc/servers/concept-log-analytics-extension-deployment.md) to understand the different deployment methods available for the extension on machines registered with Azure Arc-enabled servers.
4749
- [Manually install](../agents/agent-windows.md) the agent from the command line.
4850
- Automate the installation with [Azure Automation DSC](../agents/agent-windows.md#install-agent-using-dsc-in-azure-automation).
49-
- Use a [Resource Manager template with Azure Stack](https://github.com/Azure/AzureStack-QuickStart-Templates/tree/master/MicrosoftMonitoringAgent-ext-win)
51+
- Use a [Resource Manager template with Azure Stack](https://github.com/Azure/AzureStack-QuickStart-Templates/tree/master/MicrosoftMonitoringAgent-ext-win).
5052

5153
### Linux virtual machine on-premises or in another cloud
5254

53-
- Use [Azure Arc-enabled servers](../../azure-arc/servers/overview.md) to deploy and manage the Log Analytics VM extension. Review the [deployment options](../../azure-arc/servers/concept-log-analytics-extension-deployment.md) to understand the different deployment methods available for the extension on machines registered with Arc-enabled servers.
55+
- Use [Azure Arc-enabled servers](../../azure-arc/servers/overview.md) to deploy and manage the Log Analytics VM extension. Review the [deployment options](../../azure-arc/servers/concept-log-analytics-extension-deployment.md) to understand the different deployment methods available for the extension on machines registered with Azure Arc-enabled servers.
5456
- [Manually install](../vm/monitor-virtual-machine.md) the agent calling a wrapper-script hosted on GitHub.
5557
- Integrate [System Center Operations Manager](./om-agents.md) with Azure Monitor to forward collected data from Windows computers reporting to a management group.
5658

5759
## Data collected
5860

59-
The following table lists the types of data you can configure a Log Analytics workspace to collect from all connected agents. See [What is monitored by Azure Monitor?](../monitor-reference.md) for a list of insights, solutions, and other solutions that use the Log Analytics agent to collect other kinds of data.
61+
The following table lists the types of data you can configure a Log Analytics workspace to collect from all connected agents. For a list of insights and solutions that use the Log Analytics agent to collect other kinds of data, see [What is monitored by Azure Monitor?](../monitor-reference.md).
6062

6163
| Data Source | Description |
6264
| --- | --- |
63-
| [Windows Event logs](../agents/data-sources-windows-events.md) | Information sent to the Windows event logging system. |
64-
| [Syslog](../agents/data-sources-syslog.md) | Information sent to the Linux event logging system. |
65-
| [Performance](../agents/data-sources-performance-counters.md) | Numerical values measuring performance of different aspects of operating system and workloads. |
66-
| [IIS logs](../agents/data-sources-iis-logs.md) | Usage information for IIS web sites running on the guest operating system. |
67-
| [Custom logs](../agents/data-sources-custom-logs.md) | Events from text files on both Windows and Linux computers. |
68-
65+
| [Windows Event logs](../agents/data-sources-windows-events.md) | Information sent to the Windows event logging system |
66+
| [Syslog](../agents/data-sources-syslog.md) | Information sent to the Linux event logging system |
67+
| [Performance](../agents/data-sources-performance-counters.md) | Numerical values measuring performance of different aspects of operating system and workloads |
68+
| [IIS logs](../agents/data-sources-iis-logs.md) | Usage information for IIS websites running on the guest operating system |
69+
| [Custom logs](../agents/data-sources-custom-logs.md) | Events from text files on both Windows and Linux computers |
6970

7071
## Other services
7172

72-
The agent for Linux and Windows isn't only for connecting to Azure Monitor. Other services such as Microsoft Defender for Cloud and Microsoft Sentinel rely on the agent and its connected Log Analytics workspace. The agent also supports Azure Automation to host the Hybrid Runbook worker role and other services such as [Change Tracking](../../automation/change-tracking/overview.md), [Update Management](../../automation/update-management/overview.md), and [Microsoft Defender for Cloud](../../security-center/security-center-introduction.md). For more information about the Hybrid Runbook Worker role, see [Azure Automation Hybrid Runbook Worker](../../automation/automation-hybrid-runbook-worker.md).
73+
The agent for Linux and Windows isn't only for connecting to Azure Monitor. Other services such as Microsoft Defender for Cloud and Microsoft Sentinel rely on the agent and its connected Log Analytics workspace. The agent also supports Azure Automation to host the Hybrid Runbook Worker role and other services such as [Change Tracking](../../automation/change-tracking/overview.md), [Update Management](../../automation/update-management/overview.md), and [Microsoft Defender for Cloud](../../security-center/security-center-introduction.md). For more information about the Hybrid Runbook Worker role, see [Azure Automation Hybrid Runbook Worker](../../automation/automation-hybrid-runbook-worker.md).
7374

7475
## Workspace and management group limitations
7576

76-
See [Configure agent to report to an Operations Manager management group](../agents/agent-manage.md#configure-agent-to-report-to-an-operations-manager-management-group) for details on connecting an agent to an Operations Manager management group.
77+
For details on connecting an agent to an Operations Manager management group, see [Configure agent to report to an Operations Manager management group](../agents/agent-manage.md#configure-agent-to-report-to-an-operations-manager-management-group).
7778

78-
* Windows agents can connect to up to four workspaces, even if they are connected to a System Center Operations Manager management group.
79-
* The Linux agent does not support multi-homing and can only connect to a single workspace or management group.
79+
* Windows agents can connect to up to four workspaces, even if they're connected to a System Center Operations Manager management group.
80+
* The Linux agent doesn't support multi-homing and can only connect to a single workspace or management group.
8081

8182
## Security limitations
8283

83-
* The Windows and Linux agents support the [FIPS 140 standard](/windows/security/threat-protection/fips-140-validation), but [other types of hardening may not be supported](../agents/agent-linux.md#supported-linux-hardening).
84+
The Windows and Linux agents support the [FIPS 140 standard](/windows/security/threat-protection/fips-140-validation), but [other types of hardening might not be supported](../agents/agent-linux.md#supported-linux-hardening).
8485

8586
## TLS 1.2 protocol
8687

87-
To ensure the security of data in transit to Azure Monitor logs, we strongly encourage you to configure the agent to use at least Transport Layer Security (TLS) 1.2. Older versions of TLS/Secure Sockets Layer (SSL) have been found to be vulnerable and while they still currently work to allow backwards compatibility, they are **not recommended**. For additional information, review [Sending data securely using TLS 1.2](../logs/data-security.md#sending-data-securely-using-tls-12).
88+
To ensure the security of data in transit to Azure Monitor logs, we strongly encourage you to configure the agent to use at least Transport Layer Security (TLS) 1.2. Older versions of TLS/Secure Sockets Layer (SSL) have been found to be vulnerable. Although they still currently work to allow backward compatibility, they are *not recommended*. For more information, see [Sending data securely using TLS 1.2](../logs/data-security.md#sending-data-securely-using-tls-12).
8889

8990
## Network requirements
9091

91-
The agent for Linux and Windows communicates outbound to the Azure Monitor service over TCP port 443. If the machine connects through a firewall or proxy server to communicate over the Internet, review requirements below to understand the network configuration required. If your IT security policies do not allow computers on the network to connect to the Internet, you can set up a [Log Analytics gateway](gateway.md) and then configure the agent to connect through the gateway to Azure Monitor. The agent can then receive configuration information and send data collected.
92+
The agent for Linux and Windows communicates outbound to the Azure Monitor service over TCP port 443. If the machine connects through a firewall or proxy server to communicate over the internet, review the following requirements to understand the network configuration required. If your IT security policies do not allow computers on the network to connect to the internet, set up a [Log Analytics gateway](gateway.md) and configure the agent to connect through the gateway to Azure Monitor. The agent can then receive configuration information and send data collected.
9293

93-
![Log Analytics agent communication diagram](./media/log-analytics-agent/log-analytics-agent-01.png)
94+
![Diagram that shows Log Analytics agent communication.](./media/log-analytics-agent/log-analytics-agent-01.png)
9495

9596
The following table lists the proxy and firewall configuration information required for the Linux and Windows agents to communicate with Azure Monitor logs.
9697

@@ -103,7 +104,7 @@ The following table lists the proxy and firewall configuration information requi
103104
|*.blob.core.windows.net |Port 443 |Outbound|Yes |
104105
|*.azure-automation.net |Port 443 |Outbound|Yes |
105106

106-
For firewall information required for Azure Government, see [Azure Government management](../../azure-government/compare-azure-government-global-azure.md#azure-monitor).
107+
For firewall information required for Azure Government, see [Azure Government management](../../azure-government/compare-azure-government-global-azure.md#azure-monitor).
107108

108109
> [!IMPORTANT]
109110
> If your firewall is doing CNAME inspections, you need to configure it to allow all domains in the CNAME.
@@ -112,7 +113,9 @@ If you plan to use the Azure Automation Hybrid Runbook Worker to connect to and
112113

113114
### Proxy configuration
114115

115-
The Windows and Linux agent supports communicating either through a proxy server or Log Analytics gateway to Azure Monitor using the HTTPS protocol. Both anonymous and basic authentication (username/password) are supported. For the Windows agent connected directly to the service, the proxy configuration is specified during installation or [after deployment](../agents/agent-manage.md#update-proxy-settings) from Control Panel or with PowerShell. Log Analytics Agent (MMA) does not use the system proxy settings. Hence, user has to pass proxy setting while installing MMA and these settings will be stored under MMA configuration(registry) on VM.
116+
The Windows and Linux agent supports communicating either through a proxy server or Log Analytics gateway to Azure Monitor by using the HTTPS protocol. Both anonymous and basic authentication (username/password) are supported.
117+
118+
For the Windows agent connected directly to the service, the proxy configuration is specified during installation or [after deployment](../agents/agent-manage.md#update-proxy-settings) from Control Panel or with PowerShell. Log Analytics Agent (MMA) doesn't use the system proxy settings. As a result, the user has to pass the proxy setting while installing MMA. These settings will be stored under MMA configuration (registry) on the virtual machine.
116119

117120
For the Linux agent, the proxy server is specified during installation or [after installation](../agents/agent-manage.md#update-proxy-settings) by modifying the proxy.conf configuration file. The Linux agent proxy configuration value has the following syntax:
118121

@@ -130,10 +133,10 @@ For example:
130133
`https://user01:[email protected]:30443`
131134

132135
> [!NOTE]
133-
> If you use special characters such as "\@" in your password, you receive a proxy connection error because value is parsed incorrectly. To work around this issue, encode the password in the URL using a tool such as [URLDecode](https://www.urldecoder.org/).
136+
> If you use special characters such as "\@" in your password, you'll receive a proxy connection error because the value is parsed incorrectly. To work around this issue, encode the password in the URL by using a tool like [URLDecode](https://www.urldecoder.org/).
134137
135138
## Next steps
136139

137140
* Review [data sources](../agents/agent-data-sources.md) to understand the data sources available to collect data from your Windows or Linux system.
138-
* Learn about [log queries](../logs/log-query-overview.md) to analyze the data collected from data sources and solutions.
141+
* Learn about [log queries](../logs/log-query-overview.md) to analyze the data collected from data sources and solutions.
139142
* Learn about [monitoring solutions](../insights/solutions.md) that add functionality to Azure Monitor and also collect data into the Log Analytics workspace.

includes/log-analytics-agent-deprecation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ ms.date: 06/22/2022
77
---
88

99
> [!IMPORTANT]
10-
> The legacy [Log Analytics agent](../articles/azure-monitor/agents/log-analytics-agent.md) **will be deprecated by August 2024**. Please be sure to [migrate to Azure Monitor agent](../articles/azure-monitor/agents/azure-monitor-agent-migration.md) before August 2024 to continue ingesting data.
10+
> The legacy [Log Analytics agent](../articles/azure-monitor/agents/log-analytics-agent.md) **will be deprecated by August 2024**. [Migrate to Azure Monitor agent](../articles/azure-monitor/agents/azure-monitor-agent-migration.md) before August 2024 to continue ingesting data.

0 commit comments

Comments
 (0)