Skip to content

Commit b47c456

Browse files
authored
Merge pull request #213220 from paulth1/agents-articles-batch-4
edit pass: Agents articles batch 4
2 parents 270fe98 + 151cbdc commit b47c456

12 files changed

+178
-163
lines changed
Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Log Analytics agent data sources in Azure Monitor
3-
description: Data sources define the log data that Azure Monitor collects from agents and other connected sources. This article describes the concept of how Azure Monitor uses data sources, explains the details of how to configure them, and provides a summary of the different data sources available.
3+
description: Data sources define the log data that Azure Monitor collects from agents and other connected sources. This article describes how Azure Monitor uses data sources, explains how to configure them, and summarizes the different data sources available.
44
ms.topic: conceptual
55
author: bwren
66
ms.author: bwren
@@ -10,50 +10,54 @@ ms.reviewer: shseth
1010
---
1111

1212
# Log Analytics agent data sources in Azure Monitor
13-
The data that Azure Monitor collects from virtual machines with the legacy [Log Analytics](./log-analytics-agent.md) agent is defined by the data sources that you configure on the [Log Analytics workspace](../logs/data-platform-logs.md). Each data source creates records of a particular type with each type having its own set of properties.
1413

15-
![Log data collection](media/agent-data-sources/overview.png)
14+
The data that Azure Monitor collects from virtual machines with the legacy [Log Analytics](./log-analytics-agent.md) agent is defined by the data sources that you configure in the [Log Analytics workspace](../logs/data-platform-logs.md). Each data source creates records of a particular type. Each type has its own set of properties.
15+
16+
![Diagram that shows log data collection.](media/agent-data-sources/overview.png)
1617

1718
[!INCLUDE [Log Analytics agent deprecation](../../../includes/log-analytics-agent-deprecation.md)]
1819

1920
> [!IMPORTANT]
20-
> The data sources described in this article apply only to virtual machines running the Log Analytics agent.
21+
> The data sources described in this article apply only to virtual machines running the Log Analytics agent.
2122
2223
## Summary of data sources
23-
The following table lists the agent data sources that are currently available with the Log Analytics agent. Each has a link to a separate article providing detail for that data source. It also provides information on their method and frequency of collection.
2424

25+
The following table lists the agent data sources that are currently available with the Log Analytics agent. Each agent data source links to an article that provides information for that data source. It also provides information on their method and frequency of collection.
2526

26-
| Data source | Platform | Log analytics agent | Operations Manager agent | Azure storage | Operations Manager required? | Operations Manager agent data sent via management group | Collection frequency |
27+
| Data source | Platform | Log Analytics agent | Operations Manager agent | Azure Storage | Operations Manager required? | Operations Manager agent data sent via management group | Collection frequency |
2728
| --- | --- | --- | --- | --- | --- | --- | --- |
28-
| [Custom logs](data-sources-custom-logs.md) | Windows |• | | | | | on arrival |
29-
| [Custom logs](data-sources-custom-logs.md) | Linux |• | | | | | on arrival |
30-
| [IIS logs](data-sources-iis-logs.md) | Windows |• |• |• | | |depends on Log File Rollover setting |
31-
| [Performance counters](data-sources-performance-counters.md) | Windows |• |• | | | |as scheduled, minimum of 10 seconds |
32-
| [Performance counters](data-sources-performance-counters.md) | Linux |• | | | | |as scheduled, minimum of 10 seconds |
33-
| [Syslog](data-sources-syslog.md) | Linux |• | | | | |from Azure storage: 10 minutes; from agent: on arrival |
34-
| [Windows Event logs](data-sources-windows-events.md) |Windows |• |• |• | |• | on arrival |
29+
| [Custom logs](data-sources-custom-logs.md) | Windows |• | | | | | On arrival. |
30+
| [Custom logs](data-sources-custom-logs.md) | Linux |• | | | | | On arrival. |
31+
| [IIS logs](data-sources-iis-logs.md) | Windows |• |• |• | | |Depends on the Log File Rollover setting. |
32+
| [Performance counters](data-sources-performance-counters.md) | Windows |• |• | | | |As scheduled, minimum of 10 seconds. |
33+
| [Performance counters](data-sources-performance-counters.md) | Linux |• | | | | |As scheduled, minimum of 10 seconds. |
34+
| [Syslog](data-sources-syslog.md) | Linux |• | | | | |From Azure Storage is 10 minutes. From agent is on arrival. |
35+
| [Windows Event logs](data-sources-windows-events.md) |Windows |• |• |• | |• | On arrival. |
3536

37+
## Configure data sources
3638

37-
## Configuring data sources
38-
To configure data sources for Log Analytics agents, go to the **Log Analytics workspaces** menu in the Azure portal and select a workspace. Click on **Agents configuration**. Select the tab for the data source you want to configure. You can follow the links in the table above to documentation for each data source and details on their configuration.
39+
To configure data sources for Log Analytics agents, go to the **Log Analytics workspaces** menu in the Azure portal and select a workspace. Select **Agents configuration**. Select the tab for the data source you want to configure. Use the links in the preceding table to access documentation for each data source and information on their configuration.
3940

40-
Any configuration is delivered to all agents connected to that workspace. You cannot exclude any connected agents from this configuration.
41+
Any configuration is delivered to all agents connected to that workspace. You can't exclude any connected agents from this configuration.
4142

42-
[![Configure Windows events](media/agent-data-sources/configure-events.png)](media/agent-data-sources/configure-events.png#lightbox)
43+
[![Screenshot that shows configuring Windows events.](media/agent-data-sources/configure-events.png)](media/agent-data-sources/configure-events.png#lightbox)
4344

45+
## Data collection
4446

47+
Data source configurations are delivered to agents that are directly connected to Azure Monitor within a few minutes. The specified data is collected from the agent and delivered directly to Azure Monitor at intervals specific to each data source. See the documentation for each data source for these specifics.
4548

46-
## Data collection
47-
Data source configurations are delivered to agents that are directly connected to Azure Monitor within a few minutes. The specified data is collected from the agent and delivered directly to Azure Monitor at intervals specific to each data source. See the documentation for each data source for these specifics.
49+
For System Center Operations Manager agents in a connected management group, data source configurations are translated into management packs and delivered to the management group every 5 minutes by default. The agent downloads the management pack like any other and collects the specified data. Depending on the data source, the data will either be sent to a management server, which forwards the data to the Azure Monitor, or the agent will send the data to Azure Monitor without going through the management server.
4850

49-
For System Center Operations Manager agents in a connected management group, data source configurations are translated into management packs and delivered to the management group every 5 minutes by default. The agent downloads the management pack like any other and collects the specified data. Depending on the data source, the data will be either sent to a management server which forwards the data to the Azure Monitor, or the agent will send the data to Azure Monitor without going through the management server. See [Data collection details for monitoring solutions in Azure](../monitor-reference.md) for details. You can read about details of connecting Operations Manager and Azure Monitor and modifying the frequency that configuration is delivered at [Configure Integration with System Center Operations Manager](./om-agents.md).
51+
For more information, see [Data collection details for monitoring solutions in Azure](../monitor-reference.md). You can read about details of connecting Operations Manager and Azure Monitor and modifying the frequency that configuration is delivered at [Configure integration with System Center Operations Manager](./om-agents.md).
5052

51-
If the agent is unable to connect to Azure Monitor or Operations Manager, it will continue to collect data that it will deliver when it establishes a connection. Data can be lost if the amount of data reaches the maximum cache size for the client, or if the agent is not able to establish a connection within 24 hours.
53+
If the agent is unable to connect to Azure Monitor or Operations Manager, it will continue to collect data that it will deliver when it establishes a connection. Data can be lost if the amount of data reaches the maximum cache size for the client, or if the agent can't establish a connection within 24 hours.
5254

5355
## Log records
54-
All log data collected by Azure Monitor is stored in the workspace as records. Records collected by different data sources will have their own set of properties and be identified by their **Type** property. See the documentation for each data source and solution for details on each record type.
56+
57+
All log data collected by Azure Monitor is stored in the workspace as records. Records collected by different data sources will have their own set of properties and be identified by their **Type** property. See the documentation for each data source and solution for details on each record type.
5558

5659
## Next steps
60+
5761
* Learn about [monitoring solutions](../insights/solutions.md) that add functionality to Azure Monitor and also collect data into the workspace.
58-
* Learn about [log queries](../logs/log-query-overview.md) to analyze the data collected from data sources and monitoring solutions.
62+
* Learn about [log queries](../logs/log-query-overview.md) to analyze the data collected from data sources and monitoring solutions.
5963
* Configure [alerts](../alerts/alerts-overview.md) to proactively notify you of critical data collected from data sources and monitoring solutions.

articles/azure-monitor/agents/agent-linux-troubleshoot.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ A clean reinstall of the agent fixes most issues. This task might be the first s
7878
Extra configurations | `/etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/*.conf`
7979

8080
> [!NOTE]
81-
> Editing configuration files for performance counters and Syslog is overwritten if the collection is configured from the [agent's configuration](../agents/agent-data-sources.md#configuring-data-sources) in the Azure portal for your workspace. To disable configuration for all agents, disable collection from **Agents configuration**. For a single agent, run the following script:
81+
> Editing configuration files for performance counters and Syslog is overwritten if the collection is configured from the [agent's configuration](../agents/agent-data-sources.md#configure-data-sources) in the Azure portal for your workspace. To disable configuration for all agents, disable collection from **Agents configuration**. For a single agent, run the following script:
8282
>
8383
> `sudo /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable && sudo rm /etc/opt/omi/conf/omsconfig/configuration/Current.mof* /etc/opt/omi/conf/omsconfig/configuration/Pending.mof*`
8484

0 commit comments

Comments
 (0)