Skip to content

Commit d6003c8

Browse files
v-shilsv-shils
authored
Merge pull request #177415 from rpsqrd/ryanpu-overviewupdates
Updated directories, extension info and image
2 parents 2c6592d + 50966d1 commit d6003c8

File tree

2 files changed

+51
-55
lines changed

2 files changed

+51
-55
lines changed

‎articles/azure-arc/servers/agent-overview.md

Lines changed: 51 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Overview of the Connected Machine agent
33
description: This article provides a detailed overview of the Azure Arc-enabled servers agent available, which supports monitoring virtual machines hosted in hybrid environments.
4-
ms.date: 10/28/2021
4+
ms.date: 11/03/2021
55
ms.topic: conceptual
66
ms.custom: devx-track-azurepowershell
77
---
@@ -25,9 +25,9 @@ The Azure Connected Machine agent package contains several logical components, w
2525

2626
Note the following behavior with Azure Policy [guest configuration](../../governance/policy/concepts/guest-configuration.md) for a disconnected machine:
2727

28-
* An Azure Policy assignment that targets disconnected machines is unaffected.
29-
* Guest assignment is stored locally for 14 days. Within the 14-day period, if the Connected Machine agent reconnects to the service, policy assignments are reapplied.
30-
* Assignments are deleted after 14 days, and are not reassigned to the machine after the 14-day period.
28+
* An Azure Policy assignment that targets disconnected machines is unaffected.
29+
* Guest assignment is stored locally for 14 days. Within the 14-day period, if the Connected Machine agent reconnects to the service, policy assignments are reapplied.
30+
* Assignments are deleted after 14 days, and are not reassigned to the machine after the 14-day period.
3131

3232
* The Extension agent manages VM extensions, including install, uninstall, and upgrade. Extensions are downloaded from Azure and copied to the `%SystemDrive%\%ProgramFiles%\AzureConnectedMachineAgent\ExtensionService\downloads` folder on Windows, and for Linux to `/opt/GC_Ext/downloads`. On Windows, the extension is installed to the following path `%SystemDrive%\Packages\Plugins\<extension>`, and on Linux the extension is installed to `/var/lib/waagent/<extension>`.
3333

@@ -48,7 +48,7 @@ Metadata information about the connected machine is collected after the Connecte
4848
* Public key for managed identity
4949
* Policy compliance status and details (if using guest configuration policies)
5050
* SQL Server installed (Boolean value)
51-
* Cluster resource ID (for Azure Stack HCI nodes)
51+
* Cluster resource ID (for Azure Stack HCI nodes)
5252

5353
The following metadata information is requested by the agent from Azure:
5454

@@ -85,19 +85,20 @@ Azure Arc-enabled servers *does not* support installing the agent on virtual mac
8585

8686
The following versions of the Windows and Linux operating system are officially supported for the Azure Connected Machine agent:
8787

88-
- Windows Server 2008 R2 SP1, Windows Server 2012 R2, 2016, 2019, and 2022 (including Server Core)
89-
- Ubuntu 16.04, 18.04, and 20.04 LTS (x64)
90-
- CentOS Linux 7 and 8 (x64)
91-
- SUSE Linux Enterprise Server (SLES) 12 and 15 (x64)
92-
- Red Hat Enterprise Linux (RHEL) 7 and 8 (x64)
93-
- Amazon Linux 2 (x64)
94-
- Oracle Linux 7
88+
* Windows Server 2008 R2 SP1, Windows Server 2012 R2, 2016, 2019, and 2022 (including Server Core)
89+
* Ubuntu 16.04, 18.04, and 20.04 LTS (x64)
90+
* CentOS Linux 7 and 8 (x64)
91+
* SUSE Linux Enterprise Server (SLES) 12 and 15 (x64)
92+
* Red Hat Enterprise Linux (RHEL) 7 and 8 (x64)
93+
* Amazon Linux 2 (x64)
94+
* Oracle Linux 7
9595

9696
> [!WARNING]
9797
> The Linux hostname or Windows computer name cannot use one of the reserved words or trademarks in the name, otherwise attempting to register the connected machine with Azure will fail. See [Resolve reserved resource name errors](../../azure-resource-manager/templates/error-reserved-resource-name.md) for a list of the reserved words.
9898
9999
> [!NOTE]
100100
> While Azure Arc-enabled servers supports Amazon Linux, the following do not support this distro:
101+
>
101102
> * The Dependency agent used by Azure Monitor VM insights
102103
> * Azure Automation Update Management
103104
@@ -181,14 +182,15 @@ URLs:
181182

182183
| Agent resource | Description |
183184
|---------|---------|
185+
|`azgn*.servicebus.windows.net`|Azure Arc Connectivity Platform|
184186
|`management.azure.com`|Azure Resource Manager|
185187
|`login.windows.net`|Azure Active Directory|
186188
|`login.microsoftonline.com`|Azure Active Directory|
187189
|`pas.windows.net`|Azure Active Directory|
188-
|`dc.services.visualstudio.com`|Application Insights|
189-
|`*.guestconfiguration.azure.com` |Guest configuration|
190-
|`*.his.arc.azure.com`|Hybrid Identity Service|
190+
|`*.guestconfiguration.azure.com` |Extension and guest configuration services|
191+
|`*.his.arc.azure.com`|Metadata and hybrid identity services|
191192
|`*.blob.core.windows.net`|Download source for Azure Arc-enabled servers extensions|
193+
|`dc.services.visualstudio.com`|Agent telemetry|
192194

193195
For a list of IP addresses for each service tag/region, see the JSON file - [Azure IP Ranges and Service Tags – Public Cloud](https://www.microsoft.com/download/details.aspx?id=56519). Microsoft publishes weekly updates containing each Azure Service and the IP ranges it uses. This information in the JSON file is the current point-in-time list of the IP ranges that correspond to each service tag. The IP addresses are subject to change. If IP address ranges are required for your firewall configuration, then the **AzureCloud** Service Tag should be used to allow access to all Azure services. Do not disable security monitoring or inspection of these URLs, allow them as you would other Internet traffic.
194196

@@ -224,47 +226,44 @@ After installing the Connected Machine agent for Windows, the following system-w
224226

225227
|Folder |Description |
226228
|-------|------------|
227-
|%ProgramFiles%\AzureConnectedMachineAgent |Default installation path containing the agent support files.|
228-
|%ProgramData%\AzureConnectedMachineAgent |Contains the agent configuration files.|
229-
|%ProgramData%\AzureConnectedMachineAgent\Tokens |Contains the acquired tokens.|
230-
|%ProgramData%\AzureConnectedMachineAgent\Config |Contains the agent configuration file `agentconfig.json` recording its registration information with the service.|
231-
|%ProgramFiles%\ArcConnectedMachineAgent\ExtensionService\GC | Installation path containing the guest configuration agent files. |
232-
|%ProgramData%\GuestConfig |Contains the (applied) policies from Azure.|
233-
|%ProgramFiles%\AzureConnectedMachineAgent\ExtensionService\downloads | Extensions are downloaded from Azure and copied here.|
229+
|%ProgramFiles%\AzureConnectedMachineAgent |azcmagent CLI and instance metadata service executables.|
230+
|%ProgramFiles%\AzureConnectedMachineAgent\ExtensionService\GC | Extension service executables.|
231+
|%ProgramFiles%\AzureConnectedMachineAgent\GuestConfig\GC | Guest configuration (policy) service executables.|
232+
|%ProgramData%\AzureConnectedMachineAgent |Configuration, log and identity token files for azcmagent CLI and instance metadata service.|
233+
|%ProgramData%\GuestConfig |Extension package downloads, guest configuration (policy) definition downloads, and logs for the extension and guest configuration services.|
234234

235235
* The following Windows services are created on the target machine during installation of the agent.
236236

237237
|Service name |Display name |Process name |Description |
238238
|-------------|-------------|-------------|------------|
239-
|himds |Azure Hybrid Instance Metadata Service |himds |This service implements the Azure Instance Metadata service (IMDS) to manage the connection to Azure and the connected machine's Azure identity.|
239+
|himds |Azure Hybrid Instance Metadata Service |himds |This service implements the Hybrid Instance Metadata service (IMDS) to manage the connection to Azure and the connected machine's Azure identity.|
240240
|GCArcService |Guest configuration Arc Service |gc_service |Monitors the desired state configuration of the machine.|
241241
|ExtensionService |Guest configuration Extension Service | gc_service |Installs the required extensions targeting the machine.|
242242

243243
* The following environmental variables are created during agent installation.
244244

245245
|Name |Default value |Description |
246246
|-----|--------------|------------|
247-
|IDENTITY_ENDPOINT |http://localhost:40342/metadata/identity/oauth2/token ||
248-
|IMDS_ENDPOINT |http://localhost:40342 ||
247+
|IDENTITY_ENDPOINT |<http://localhost:40342/metadata/identity/oauth2/token> ||
248+
|IMDS_ENDPOINT |<http://localhost:40342> ||
249249

250250
* There are several log files available for troubleshooting. They are described in the following table.
251251

252252
|Log |Description |
253253
|----|------------|
254-
|%ProgramData%\AzureConnectedMachineAgent\Log\himds.log |Records details of the agents (HIMDS) service and interaction with Azure.|
255-
|%ProgramData%\AzureConnectedMachineAgent\Log\azcmagent.log |Contains the output of the azcmagent tool commands, when the verbose (-v) argument is used.|
256-
|%ProgramData%\GuestConfig\gc_agent_logs\gc_agent.log |Records details of the DSC service activity,<br> in particular the connectivity between the HIMDS service and Azure Policy.|
257-
|%ProgramData%\GuestConfig\gc_agent_logs\gc_agent_telemetry.txt |Records details about DSC service telemetry and verbose logging.|
254+
|%ProgramData%\AzureConnectedMachineAgent\Log\himds.log |Records details of the heartbeat and identity agent component.|
255+
|%ProgramData%\AzureConnectedMachineAgent\Log\azcmagent.log |Contains the output of the azcmagent tool commands.|
256+
|%ProgramData%\GuestConfig\arc_policy_logs\ |Records details about the guest configuration (policy) agent component.|
258257
|%ProgramData%\GuestConfig\ext_mgr_logs|Records details about the Extension agent component.|
259-
|%ProgramData%\GuestConfig\extension_logs\<Extension>|Records details from the installed extension.|
258+
|%ProgramData%\GuestConfig\extension_logs\\\<Extension>|Records details from the installed extension.|
260259

261260
* The local security group **Hybrid agent extension applications** is created.
262261

263262
* During uninstall of the agent, the following artifacts are not removed.
264263

265-
* %ProgramData%\AzureConnectedMachineAgent\Log
266-
* %ProgramData%\AzureConnectedMachineAgent and subdirectories
267-
* %ProgramData%\GuestConfig
264+
* %ProgramData%\AzureConnectedMachineAgent\Log
265+
* %ProgramData%\AzureConnectedMachineAgent and subdirectories
266+
* %ProgramData%\GuestConfig
268267

269268
### Linux agent installation details
270269

@@ -276,54 +275,51 @@ After installing the Connected Machine agent for Linux, the following system-wid
276275

277276
|Folder |Description |
278277
|-------|------------|
279-
|/var/opt/azcmagent/ |Default installation path containing the agent support files.|
280-
|/opt/azcmagent/ |
281-
|/opt/GC_Ext | Installation path containing the guest configuration agent files.|
282-
|/opt/DSC/ |
283-
|/var/opt/azcmagent/tokens |Contains the acquired tokens.|
284-
|/var/lib/GuestConfig |Contains the (applied) policies from Azure.|
285-
|/opt/GC_Ext/downloads|Extensions are downloaded from Azure and copied here.|
278+
|/opt/azcmagent/ |azcmagent CLI and instance metadata service executables.|
279+
|/opt/GC_Ext/ | Extension service executables.|
280+
|/opt/GC_Service/ |Guest configuration (policy) service executables.|
281+
|/var/opt/azcmagent/ |Configuration, log and identity token files for azcmagent CLI and instance metadata service.|
282+
|/var/lib/GuestConfig/ |Extension package downloads, guest configuration (policy) definition downloads, and logs for the extension and guest configuration services.|
286283

287284
* The following daemons are created on the target machine during installation of the agent.
288285

289286
|Service name |Display name |Process name |Description |
290287
|-------------|-------------|-------------|------------|
291-
|himdsd.service |Azure Connected Machine Agent Service |himds |This service implements the Azure Instance Metadata service (IMDS) to manage the connection to Azure and the connected machine's Azure identity.|
288+
|himdsd.service |Azure Connected Machine Agent Service |himds |This service implements the Hybrid Instance Metadata service (IMDS) to manage the connection to Azure and the connected machine's Azure identity.|
292289
|gcad.service |GC Arc Service |gc_linux_service |Monitors the desired state configuration of the machine. |
293290
|extd.service |Extension Service |gc_linux_service | Installs the required extensions targeting the machine.|
294291

295292
* There are several log files available for troubleshooting. They are described in the following table.
296293

297294
|Log |Description |
298295
|----|------------|
299-
|/var/opt/azcmagent/log/himds.log |Records details of the agents (HIMDS) service and interaction with Azure.|
300-
|/var/opt/azcmagent/log/azcmagent.log |Contains the output of the azcmagent tool commands, when the verbose (-v) argument is used.|
301-
|/opt/logs/dsc.log |Records details of the DSC service activity,<br> in particular the connectivity between the himds service and Azure Policy.|
302-
|/opt/logs/dsc.telemetry.txt |Records details about DSC service telemetry and verbose logging.|
303-
|/var/lib/GuestConfig/ext_mgr_logs |Records details about the Extension agent component.|
304-
|/var/lib/GuestConfig/extension_logs|Records details from the installed extension.|
296+
|/var/opt/azcmagent/log/himds.log |Records details of the heartbeat and identity agent component.|
297+
|/var/opt/azcmagent/log/azcmagent.log |Contains the output of the azcmagent tool commands.|
298+
|/var/lib/GuestConfig/arc_policy_logs |Records details about the guest configuration (policy) agent component.|
299+
|/var/lib/GuestConfig/ext_mgr_logs |Records details about the extension agent component.|
300+
|/var/lib/GuestConfig/extension_logs|Records details from extension install/update/uninstall operations.|
305301

306302
* The following environmental variables are created during agent installation. These variables are set in `/lib/systemd/system.conf.d/azcmagent.conf`.
307303

308304
|Name |Default value |Description |
309305
|-----|--------------|------------|
310-
|IDENTITY_ENDPOINT |http://localhost:40342/metadata/identity/oauth2/token ||
311-
|IMDS_ENDPOINT |http://localhost:40342 ||
306+
|IDENTITY_ENDPOINT |<http://localhost:40342/metadata/identity/oauth2/token> ||
307+
|IMDS_ENDPOINT |<http://localhost:40342> ||
312308

313309
* During uninstall of the agent, the following artifacts are not removed.
314310

315-
* /var/opt/azcmagent
316-
* /opt/logs
311+
* /var/opt/azcmagent
312+
* /var/lib/GuestConfig
317313

318314
### Agent resource governance
319315

320316
Azure Arc-enabled servers Connected Machine agent is designed to manage agent and system resource consumption. The agent approaches resource governance under the following conditions:
321317

322-
- The Guest Configuration agent limits up to 5% of the CPU to evaluate policies.
323-
- The Extension Service agent is limited to use up to 5% of the CPU.
318+
* The Guest Configuration agent is limited to use up to 5% of the CPU to evaluate policies.
319+
* The Extension Service agent is limited to use up to 5% of the CPU to install and manage extensions.
324320

325-
- This only applies to install/uninstall/upgrade operations. Once installed, extensions are responsible for their own resource utilization and the 5% CPU limit does not apply.
326-
- The Log Analytics agent and Azure Monitor Agent are allowed to use up to 60% of the CPU during their install/upgrade/uninstall operations on Red Hat Linux, CentOS, and other enterprise Linux variants. The limit is higher for this combination of extensions and operating systems to accommodate the performance impact of [SELinux](https://www.redhat.com/en/topics/linux/what-is-selinux) on these systems.
321+
* Once installed, each extension is limited to use up to 5% of the CPU while running. For example, if you have 2 extensions installed, they can use a combined total of 10% of the CPU.
322+
* The Log Analytics agent and Azure Monitor Agent are allowed to use up to 60% of the CPU during their install/upgrade/uninstall operations on Red Hat Linux, CentOS, and other enterprise Linux variants. The limit is higher for this combination of extensions and operating systems to accommodate the performance impact of [SELinux](https://www.redhat.com/en/topics/linux/what-is-selinux) on these systems.
327323

328324
## Next steps
329325

‎articles/azure-arc/servers/media/agent-overview/connected-machine-agent.png

172 KB
Loading

0 commit comments

Comments
 (0)