Skip to content

Commit e0d2a07

Browse files
TaojunshenTaojunshen
authored
Merge pull request #256300 from MicrosoftDocs/main
10/26/2023 AM Publish
2 parents 9fc6553 + c7de416 commit e0d2a07

File tree

79 files changed

+1564
-1303
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+1564
-1303
lines changed

‎.openpublishing.redirection.json

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7928,11 +7928,6 @@
79287928
"redirect_url": "/azure/azure-arc/vmware-vsphere/setup-and-manage-self-service-access",
79297929
"redirect_document_id": false
79307930
},
7931-
{
7932-
"source_path_from_root": "/articles/azure-arc/vmware-vsphere/azure-arc-agent.md",
7933-
"redirect_url": "/azure/azure-arc/vmware-vsphere/overview",
7934-
"redirect_document_id": false
7935-
},
79367931
{
79377932
"source_path_from_root": "/articles/azure-arc/vmware-vsphere/azure-arc-resource-bridge.md",
79387933
"redirect_url": "/azure/azure-arc/vmware-vsphere/overview",
@@ -7943,11 +7938,6 @@
79437938
"redirect_url": "/azure/azure-arc/vmware-vsphere/overview",
79447939
"redirect_document_id": false
79457940
},
7946-
{
7947-
"source_path_from_root": "/articles/azure-arc/system-center-virtual-machine-manager/agent-overview-scvmm.md",
7948-
"redirect_url": "/azure/azure-arc/system-center-virtual-machine-manager/overview",
7949-
"redirect_document_id": false
7950-
},
79517941
{
79527942
"source_path_from_root": "/articles/azure-arc/system-center-virtual-machine-manager/azure-arc-resource-bridge.md",
79537943
"redirect_url": "/azure/azure-arc/system-center-virtual-machine-manager/overview",

‎.openpublishing.redirection.virtual-desktop.json

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,21 @@
204204
"source_path_from_root": "/articles/virtual-desktop/install-client-per-user.md",
205205
"redirect_url": "/azure/virtual-desktop/install-windows-client-per-user",
206206
"redirect_document_id": true
207+
},
208+
{
209+
"source_path_from_root": "/articles/virtual-desktop/create-host-pool.md",
210+
"redirect_url": "/azure/virtual-desktop/deploy-azure-virtual-desktop",
211+
"redirect_document_id": true
212+
},
213+
{
214+
"source_path_from_root": "/articles/virtual-desktop/create-application-group-workspace.md",
215+
"redirect_url": "/azure/virtual-desktop/deploy-azure-virtual-desktop",
216+
"redirect_document_id": false
217+
},
218+
{
219+
"source_path_from_root": "/articles/virtual-desktop/tutorial-create-connect-personal-desktop.md",
220+
"redirect_url": "/azure/virtual-desktop/tutorial-try-deploy-windows-11-desktop",
221+
"redirect_document_id": true
207222
}
208223
]
209224
}

‎articles/azure-arc/system-center-virtual-machine-manager/agent-overview-scvmm.md

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
---
2+
title: Overview of Azure Connected Machine agent to manage Windows and Linux machines
3+
description: This article provides a detailed overview of the Azure Connected Machine agent, which supports monitoring virtual machines hosted in hybrid environments.
4+
ms.date: 10/20/2023
5+
ms.topic: conceptual
6+
author: PriskeyJeronika-MS
7+
ms.author: v-gjeronika
8+
manager: jsuri
9+
ms.services: azure-arc
10+
ms.subservice: azure-arc-scvmm
11+
---
12+
13+
# Overview of Azure Connected Machine agent to manage Windows and Linux machines
14+
15+
The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers.
16+
17+
## Agent components
18+
19+
:::image type="content" source="media/agent-overview-scvmm/connected-machine-agent.png" alt-text="Diagram of Azure Connected Machine agent architectural overview." border="false":::
20+
21+
The Azure Connected Machine agent package contains several logical components bundled together:
22+
23+
* The Hybrid Instance Metadata service (HIMDS) manages the connection to Azure and the connected machine's Azure identity.
24+
25+
* The guest configuration agent provides functionality such as assessing whether the machine complies with required policies and enforcing compliance.
26+
27+
Note the following behavior with Azure Policy [guest configuration](../../governance/machine-configuration/overview.md) for a disconnected machine:
28+
29+
* An Azure Policy assignment that targets disconnected machines is unaffected.
30+
* Guest assignment is stored locally for 14 days. Within the 14-day period, if the Connected Machine agent reconnects to the service, policy assignments are reapplied.
31+
* Assignments are deleted after 14 days, and aren't reassigned to the machine after the 14-day period.
32+
33+
* The Extension agent manages VM extensions, including install, uninstall, and upgrade. Azure downloads extensions and copies them to the `%SystemDrive%\%ProgramFiles%\AzureConnectedMachineAgent\ExtensionService\downloads` folder on Windows, and to `/opt/GC_Ext/downloads` on Linux. On Windows, the extension installs to the following path `%SystemDrive%\Packages\Plugins\<extension>`, and on Linux the extension installs to `/var/lib/waagent/<extension>`.
34+
35+
>[!NOTE]
36+
> The [Azure Monitor agent](../../azure-monitor/agents/azure-monitor-agent-overview.md) (AMA) is a separate agent that collects monitoring data, and it does not replace the Connected Machine agent; the AMA only replaces the Log Analytics agent, Diagnostics extension, and Telegraf agent for both Windows and Linux machines.
37+
38+
## Agent resources
39+
40+
The following information describes the directories and user accounts used by the Azure Connected Machine agent.
41+
42+
### Windows agent installation details
43+
44+
The Windows agent is distributed as a Windows Installer package (MSI). Download the Windows agent from the [Microsoft Download Center](https://aka.ms/AzureConnectedMachineAgent).
45+
Installing the Connected Machine agent for Window applies the following system-wide configuration changes:
46+
47+
* The installation process creates the following folders during setup.
48+
49+
| Directory | Description |
50+
|-----------|-------------|
51+
| %ProgramFiles%\AzureConnectedMachineAgent | azcmagent CLI and instance metadata service executables.|
52+
| %ProgramFiles%\AzureConnectedMachineAgent\ExtensionService\GC | Extension service executables.|
53+
| %ProgramFiles%\AzureConnectedMachineAgent\GCArcService\GC | Guest configuration (policy) service executables.|
54+
| %ProgramData%\AzureConnectedMachineAgent | Configuration, log and identity token files for azcmagent CLI and instance metadata service.|
55+
| %ProgramData%\GuestConfig | Extension package downloads, guest configuration (policy) definition downloads, and logs for the extension and guest configuration services.|
56+
| %SYSTEMDRIVE%\packages | Extension package executables |
57+
58+
* Installing the agent creates the following Windows services on the target machine.
59+
60+
| Service name | Display name | Process name | Description |
61+
|--------------|--------------|--------------|-------------|
62+
| himds | Azure Hybrid Instance Metadata Service | himds | Synchronizes metadata with Azure and hosts a local REST API for extensions and applications to access the metadata and request Microsoft Entra managed identity tokens |
63+
| GCArcService | Guest configuration Arc Service | gc_service | Audits and enforces Azure guest configuration policies on the machine. |
64+
| ExtensionService | Guest configuration Extension Service | gc_service | Installs, updates, and manages extensions on the machine. |
65+
66+
* Agent installation creates the following virtual service account.
67+
68+
| Virtual Account | Description |
69+
|------------------|-------------|
70+
| NT SERVICE\\himds | Unprivileged account used to run the Hybrid Instance Metadata Service. |
71+
72+
> [!TIP]
73+
> This account requires the "Log on as a service" right. This right is automatically granted during agent installation, but if your organization configures user rights assignments with Group Policy, you might need to adjust your Group Policy Object to grant the right to "NT SERVICE\\himds" or "NT SERVICE\\ALL SERVICES" to allow the agent to function.
74+
75+
* Agent installation creates the following local security group.
76+
77+
| Security group name | Description |
78+
|---------------------|-------------|
79+
| Hybrid agent extension applications | Members of this security group can request Microsoft Entra tokens for the system-assigned managed identity |
80+
81+
* Agent installation creates the following environmental variables
82+
83+
| Name | Default value | Description |
84+
|------|---------------|------------|
85+
| IDENTITY_ENDPOINT | `http://localhost:40342/metadata/identity/oauth2/token` |
86+
| IMDS_ENDPOINT | `http://localhost:40342` |
87+
88+
* There are several log files available for troubleshooting, described in the following table.
89+
90+
| Log | Description |
91+
|-----|-------------|
92+
| %ProgramData%\AzureConnectedMachineAgent\Log\himds.log | Records details of the heartbeat and identity agent component. |
93+
| %ProgramData%\AzureConnectedMachineAgent\Log\azcmagent.log | Contains the output of the azcmagent tool commands. |
94+
| %ProgramData%\GuestConfig\arc_policy_logs\gc_agent.log | Records details about the guest configuration (policy) agent component. |
95+
| %ProgramData%\GuestConfig\ext_mgr_logs\gc_ext.log | Records details about extension manager activity (extension install, uninstall, and upgrade events). |
96+
| %ProgramData%\GuestConfig\extension_logs | Directory containing logs for individual extensions. |
97+
98+
* The process creates the local security group **Hybrid agent extension applications**.
99+
100+
* After uninstalling the agent, the following artifacts remain.
101+
102+
* %ProgramData%\AzureConnectedMachineAgent\Log
103+
* %ProgramData%\AzureConnectedMachineAgent
104+
* %ProgramData%\GuestConfig
105+
* %SystemDrive%\packages
106+
107+
### Linux agent installation details
108+
109+
The preferred package format for the distribution (`.rpm` or `.deb`) that's hosted in the Microsoft [package repository](https://packages.microsoft.com/) provides the Connected Machine agent for Linux. The shell script bundle [Install_linux_azcmagent.sh](https://aka.ms/azcmagent) installs and configures the agent.
110+
111+
Installing, upgrading, and removing the Connected Machine agent isn't required after server restart.
112+
113+
Installing the Connected Machine agent for Linux applies the following system-wide configuration changes.
114+
115+
* Setup creates the following installation folders.
116+
117+
| Directory | Description |
118+
|-----------|-------------|
119+
| /opt/azcmagent/ | azcmagent CLI and instance metadata service executables. |
120+
| /opt/GC_Ext/ | Extension service executables. |
121+
| /opt/GC_Service/ | Guest configuration (policy) service executables. |
122+
| /var/opt/azcmagent/ | Configuration, log and identity token files for azcmagent CLI and instance metadata service.|
123+
| /var/lib/GuestConfig/ | Extension package downloads, guest configuration (policy) definition downloads, and logs for the extension and guest configuration services.|
124+
125+
* Installing the agent creates the following daemons.
126+
127+
| Service name | Display name | Process name | Description |
128+
|--------------|--------------|--------------|-------------|
129+
| himdsd.service | Azure Connected Machine Agent Service | himds | This service implements the Hybrid Instance Metadata service (IMDS) to manage the connection to Azure and the connected machine's Azure identity.|
130+
| gcad.service | GC Arc Service | gc_linux_service | Audits and enforces Azure guest configuration policies on the machine. |
131+
| extd.service | Extension Service | gc_linux_service | Installs, updates, and manages extensions on the machine. |
132+
133+
* There are several log files available for troubleshooting, described in the following table.
134+
135+
| Log | Description |
136+
|-----|-------------|
137+
| /var/opt/azcmagent/log/himds.log | Records details of the heartbeat and identity agent component. |
138+
| /var/opt/azcmagent/log/azcmagent.log | Contains the output of the azcmagent tool commands. |
139+
| /var/lib/GuestConfig/arc_policy_logs | Records details about the guest configuration (policy) agent component. |
140+
| /var/lib/GuestConfig/ext_mgr_logs | Records details about extension manager activity (extension install, uninstall, and upgrade events). |
141+
| /var/lib/GuestConfig/extension_logs | Directory containing logs for individual extensions. |
142+
143+
* Agent installation creates the following environment variables, set in `/lib/systemd/system.conf.d/azcmagent.conf`.
144+
145+
| Name | Default value | Description |
146+
|------|---------------|-------------|
147+
| IDENTITY_ENDPOINT | `http://localhost:40342/metadata/identity/oauth2/token` |
148+
| IMDS_ENDPOINT | `http://localhost:40342` |
149+
150+
* After uninstalling the agent, the following artifacts remain.
151+
152+
* /var/opt/azcmagent
153+
* /var/lib/GuestConfig
154+
155+
## Agent resource governance
156+
157+
The Azure Connected Machine agent is designed to manage agent and system resource consumption. The agent approaches resource governance under the following conditions:
158+
159+
* The Guest Configuration agent can use up to 5% of the CPU to evaluate policies.
160+
* The Extension Service agent can use up to 5% of the CPU to install, upgrade, run, and delete extensions. Some extensions might apply more restrictive CPU limits once installed. The following exceptions apply:
161+
162+
| Extension type | Operating system | CPU limit |
163+
| -------------- | ---------------- | --------- |
164+
| AzureMonitorLinuxAgent | Linux | 60% |
165+
| AzureMonitorWindowsAgent | Windows | 100% |
166+
| AzureSecurityLinuxAgent | Linux | 30% |
167+
| LinuxOsUpdateExtension | Linux | 60% |
168+
| MDE.Linux | Linux | 60% |
169+
| MicrosoftDnsAgent | Windows | 100% |
170+
| MicrosoftMonitoringAgent | Windows | 60% |
171+
| OmsAgentForLinux | Windows | 60%|
172+
173+
During normal operations, defined as the Azure Connected Machine agent being connected to Azure and not actively modifying an extension or evaluating a policy, you can expect the agent to consume the following system resources:
174+
175+
| | Windows | Linux |
176+
| --- | ------- | ----- |
177+
| **CPU usage (normalized to 1 core)** | 0.07% | 0.02% |
178+
| **Memory usage** | 57 MB | 42 MB |
179+
180+
The performance data above was gathered in April 2023 on virtual machines running Windows Server 2022 and Ubuntu 20.04. Actual agent performance and resource consumption will vary based on the hardware and software configuration of your servers.
181+
182+
## Instance metadata
183+
184+
Metadata information about a connected machine is collected after the Connected Machine agent registers with Azure Arc-enabled servers. Specifically:
185+
186+
* Operating system name, type, and version
187+
* Computer name
188+
* Computer manufacturer and model
189+
* Computer fully qualified domain name (FQDN)
190+
* Domain name (if joined to an Active Directory domain)
191+
* Active Directory and DNS fully qualified domain name (FQDN)
192+
* UUID (BIOS ID)
193+
* Connected Machine agent heartbeat
194+
* Connected Machine agent version
195+
* Public key for managed identity
196+
* Policy compliance status and details (if using guest configuration policies)
197+
* SQL Server installed (Boolean value)
198+
* Cluster resource ID (for Azure Stack HCI nodes)
199+
* Hardware manufacturer
200+
* Hardware model
201+
* CPU family, socket, physical core and logical core counts
202+
* Total physical memory
203+
* Serial number
204+
* SMBIOS asset tag
205+
* Cloud provider
206+
207+
The agent requests the following metadata information from Azure:
208+
209+
* Resource location (region)
210+
* Virtual machine ID
211+
* Tags
212+
* Microsoft Entra managed identity certificate
213+
* Guest configuration policy assignments
214+
* Extension requests - install, update, and delete.
215+
216+
> [!NOTE]
217+
> Azure Arc-enabled servers doesn't store/process customer data outside the region the customer deploys the service instance in.
218+
219+
## Next steps
220+
221+
- [Connect your SCVMM server to Azure Arc](/azure/azure-arc/system-center-virtual-machine-manager/quickstart-connect-system-center-virtual-machine-manager-to-arc).
222+
- [Install Arc agent at scale for your SCVMM VMs](/azure/azure-arc/system-center-virtual-machine-manager/enable-guest-management-at-scale).
223+
- [Install Arc agent using a script for SCVMM VMs](/azure/azure-arc/system-center-virtual-machine-manager/install-arc-agents-using-script).

‎articles/azure-arc/system-center-virtual-machine-manager/index.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,11 @@ landingContent:
1818
links:
1919
- text: What is Azure Arc-enabled System Center Virtual Machine Manager?
2020
url: overview.md
21-
21+
- linkListType: concept
22+
links:
23+
- text: Azure Arc agent
24+
url: agent-overview-scvmm.md
25+
2226
- title: Get started with Arc-enabled SCVMM
2327
linkLists:
2428
- linkListType: quickstart

‎articles/azure-arc/system-center-virtual-machine-manager/media/agent-overview-scvmm/connected-machine-agent.png

213 KB
Loading

‎articles/azure-arc/system-center-virtual-machine-manager/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414
items:
1515
- name: Create a virtual machine on SCVMM Management server
1616
href: create-virtual-machine.md
17+
- name: Concepts
18+
items:
19+
- name: Azure Arc agent
20+
href: agent-overview-scvmm.md
1721
- name: How-to guides
1822
items:
1923
- name: Deploy

0 commit comments

Comments
 (0)