You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article provides high-level guidance on when and how to migrate to the new Azure Monitor agent (AMA) and data collection rules (DCR). This article will be updated when new migration tooling is available.
12
+
# Migrate to Azure Monitor agent from Log Analytics agent
13
+
The [Azure Monitor agent (AMA)](azure-monitor-agent-overview.md) collects monitoring data from the guest operating system of Azure and hybrid virtual machines and delivers it to Azure Monitor where it can be used by different features, insights, and other services such as [Microsoft Sentinel](../../sentintel/../sentinel/overview.md) and [Microsoft Defender for Cloud](../../defender-for-cloud/defender-for-cloud-introduction.md). The Azure Monitor agent is meant to replace the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines. This article provides high-level guidance on when and how to migrate to the new Azure Monitor agent (AMA) and the data collection rules (DCR) that define the data the agent should collect.
14
14
15
+
The decision to migrate to AMA will be based on the different features and services that you use. Considerations for Azure Monitor and other supported features and services are provided in this article since they should be considered together in your migration strategy.
15
16
16
-
## Review
17
-
- To help you decide if you should migrate to the new Azure Monitor agent now or later, see the guidance in [Azure Monitor agent overview](./azure-monitor-agent-overview.md#should-i-switch-to-the-azure-monitor-agent).
18
-
- For the Azure Monitor agent, review the new capabilities; the availability of existing features, services, and solutions; and current limitations in [Overview of Azure Monitor agents](./agents-overview.md#azure-monitor-agent).
17
+
> [!IMPORTANT]
18
+
> The Log Analytics agent will be [retired on **31 August, 2024**](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). If you are currently using the Log Analytics agent with Azure Monitor or other supported features and services, you should start planning your migration to the Azure Monitor agent using the information in this article.
19
+
20
+
## Current capabilities
21
+
22
+
Azure Monitor agent currently supports the following core functionality:
23
+
24
+
-**Collect guest logs and metrics** from any machine in Azure, in other clouds, or on-premises. [Azure Arc-enabled servers](/azure/azure-arc/servers/overview) are required for machines outside of Azure.
25
+
-**Centrally manage data collection configuration** using [data collection rules](/azure/azure-monitor/agents/data-collection-rule-overview), and management configuration using Azure Resource Manager (ARM) templates or policies.
26
+
-**Use Windows event filtering or multi-homing** for Windows or Linux logs.
27
+
-**Improved extension management.** The Azure Monitor agent uses a new method of handling extensibility that's more transparent and controllable than management packs and Linux plug-ins in the current Log Analytics agents.
28
+
29
+
> [!NOTE]
30
+
> Windows and Linux machines that reside on cloud platforms other than Azure, or are on-premises machines, must be Azure Arc-enabled so that the AMA can send logs to the Log Analytics workspace. For more information, see:
31
+
>
32
+
> -[What are Azure Arc–enabled servers?](/azure/azure-arc/servers/overview)
33
+
> -[Overview of Azure Arc – enabled servers agent](/azure/azure-arc/servers/agent-overview)
34
+
> -[Plan and deploy Azure Arc – enabled servers at scale](/azure/azure-arc/servers/plan-at-scale-deployment)
35
+
36
+
## Plan your migration
37
+
38
+
You migration plan to the Azure Monitor agent should include the following considerations:
39
+
40
+
|Consideration |Description |
41
+
|---------|---------|
42
+
|**Environment requirements**| Verify that your environment is currently supported by the AMA. For more information, see [Supported operating systems](/azure/azure-monitor/agents/agents-overview#supported-operating-systems). |
43
+
|**Current and new feature requirements**| While the AMA provides [several new features](#current-capabilities), such as filtering, scoping, and multi-homing, it is not yet at parity with the legacy Log Analytics agent.As you plan your migration, make sure that the features your organization requires are already supported by the AMA. You may decide to continue using the Log Analytics agent for now, and migrate at a later date. See [Supported services and features](/azure/azure-monitor/agents/azure-monitor-agent-overview#supported-services-and-features) for a current status of features that are supported and that may be in preview. |
44
+
45
+
46
+
## Gap analysis between agents
47
+
The following tables show gap analyses for the log types that are currently collected by each agent. This will be updated as support for AMA grows towards parity with the Log Analytics agent. For a general comparison of Azure Monitor agents, see [Overview of Azure Monitor agents](../agents/azure-monitor-agent-overview.md).
48
+
49
+
50
+
> [!IMPORTANT]
51
+
> If you use Microsoft Sentinel, see [Gap analysis for Microsoft Sentinel](../../sentinel/ama-migrate.md#gap-analysis-between-agents) for a comparison of the additional data collected by Microsoft Sentinel.
52
+
53
+
54
+
### Windows logs
55
+
56
+
|Log type / Support |Azure Monitor agent support |Log Analytics agent support |
57
+
|---------|---------|---------|
58
+
|**Security Events**| Yes | No |
59
+
|**Performance counters**| Yes | Yes |
60
+
|**Windows Event Logs**| Yes | Yes |
61
+
|**Filtering by event ID**| Yes | No |
62
+
|**Custom logs**| No | Yes |
63
+
|**IIS logs**| No | Yes |
64
+
|**Application and service logs**| Yes | Yes |
65
+
|**DNS logs**| No | Yes |
66
+
|**Multi-homing**| Yes | Yes |
67
+
68
+
### Linux logs
69
+
70
+
|Log type / Support |Azure Monitor agent support |Log Analytics agent support |
71
+
|---------|---------|---------|
72
+
|**Syslog**| Yes | Yes |
73
+
|**Custom logs**| No | Yes |
74
+
|**Multi-homing**| Yes | No |
19
75
20
76
21
77
## Test migration by using the Azure portal
22
-
1. To ensure safe deployment during migration, begin testing with a few resources in your nonproduction environment that are running the existing Log Analytics agent. After you can validate the data collected on these test resources, roll out to production by following the same steps.
23
-
1. Go to **Monitor** > **Settings** > **Data Collection Rules** and [create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-rule-and-association-in-azure-portal) to start collecting some of the existing data types. When you use the portal GUI, it performs the following steps on all the target resources for you:
24
-
- Enables system-assigned managed identity
25
-
- Installs the Azure Monitor agent extension
26
-
- Creates and deploys data collection rule associations
27
-
1. Validate data is flowing as expected via the Azure Monitor agent. Check the **Heartbeat** table for new agent version values. Ensure it matches data flowing through the existing Log Analytics agent.
28
-
29
-
30
-
## At-scale migration by using policies
31
-
1. Start by analyzing your current monitoring setup with MMA/OMS by using the following criteria:
32
-
- Sources, such as virtual machines, virtual machine scale sets, and on-premises servers
33
-
- Data sources, such as performance counters, Windows event logs, and Syslog
34
-
- Destinations, such as Log Analytics workspaces
35
-
1.[Create new data collection rules](/rest/api/monitor/datacollectionrules/create#examples) by using the preceding configuration. As a best practice, you might want to have a separate data collection rule for Windows versus Linux sources. Or you might want separate data collection rules for individual teams with different data collection needs.
36
-
1.[Enable system-assigned managed identity](../../active-directory/managed-identities-azure-resources/qs-configure-template-windows-vm.md#system-assigned-managed-identity) on target resources.
37
-
2. Install the Azure Monitor agent extension. Deploy data collection rule associations on all target resources by using the [built-in policy initiative](azure-monitor-agent-manage.md#using-azure-policy). Provide the preceding data collection rule as an input parameter.
38
-
1. Validate data is flowing as expected via the Azure Monitor agent. Check the **Heartbeat** table for new agent version values. Ensure it matches data flowing through the existing Log Analytics agent.
39
-
2. Validate all downstream dependencies like dashboards, alerts, and runbook workers. Workbooks all continue to function now by using data from the new agent.
40
-
3.[Uninstall the Log Analytics agent](./agent-manage.md#uninstall-agent) from the resources. Don't uninstall it if you need to use it for System Center Operations Manager scenarios or other solutions not yet available on the Azure Monitor agent.
41
-
4. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
78
+
To ensure safe deployment during migration, you should begin testing with a few resources in your nonproduction environment that are running the existing Log Analytics agent. After you can validate the data collected on these test resources, roll out to production by following the same steps.
79
+
80
+
See [create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-rule-and-association-in-azure-portal) to start collecting some of the existing data types. Once you validate data is flowing as expected with the Azure Monitor agent, check the `Category` column in the [Heartbeat](/azure/azure-monitor/reference/tables/heartbeat) table for the value *Azure Monitor Agent* for AMA collected data. Ensure it matches data flowing through the existing Log Analytics agent.
81
+
82
+
83
+
## At-scale migration using Azure Policy
84
+
[Azure Policy](../../governance/policy/overview.md) and [Resource Manager templates](../resource-manager-samples.md) provide scalability to migrate a large number of agents.
85
+
Start by analyzing your current monitoring setup with the Log Analytics agent using the following criteria:
86
+
87
+
- Sources, such as virtual machines, virtual machine scale sets, and on-premises servers
88
+
- Data sources, such as performance counters, Windows event logs, and Syslog
89
+
- Destinations, such as Log Analytics workspaces
90
+
91
+
> [!IMPORTANT]
92
+
> Before you deploy to a large number of agents, you should consider [configuring the workspace](agent-data-sources.md) to disable data collection for the Log Analytics agent. If you leave it enabled, you may collect duplicate data resulting in increased cost until you remove the Log Analytics agents from your virtual machines. Alternatively, you may choose to have duplicate collection during the migration period until you can confirm that the AMA has been deployed and configured correctly.
93
+
94
+
See [Using Azure Policy](azure-monitor-agent-manage.md#using-azure-policy) for details on deploying Azure Monitor agent across a set of virtual machines. Associate the agents to the data collection rules developed during your [testing](#test-migration-by-using-the-azure-portal).
95
+
96
+
Validate that data is flowing as expected with the Azure Monitor agent and that all downstream dependencies like dashboards, alerts, and runbook workers. Workbooks should all continue to function using data from the new agent.
97
+
98
+
When you confirm that data is being collected properly, [uninstall the Log Analytics agent](./agent-manage.md#uninstall-agent) from the resources. Don't uninstall it if you need to use it for System Center Operations Manager scenarios or others solutions not yet available on the Azure Monitor agent. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
99
+
100
+
## Next steps
42
101
102
+
For more information, see:
43
103
104
+
-[Overview of the Azure Monitor agents](agents-overview.md)
105
+
-[AMA migration for Microsoft Sentinel](../../sentinel/ama-migrate.md)
106
+
-[Frequently asked questions for AMA migration](/azure/azure-monitor/faq#azure-monitor-agent)
0 commit comments