You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Enable network isolation for Azure Monitor Agent
104
104
105
-
By default, Azure Monitor Agent connects to a public endpoint to connect to your Azure Monitor environment. To enable network isolation for your agents, you can create [data collection endpoints](../essentials/data-collection-endpoint-overview.md) and add them to your [Azure Monitor Private Link Scopes (AMPLS)](../logs/private-link-configure.md#connect-azure-monitor-resources).
105
+
By default, Azure Monitor Agent connects to a public endpoint to connect to your Azure Monitor environment. To enable network isolation for your agents, create [data collection endpoints](../essentials/data-collection-endpoint-overview.md) and add them to your [Azure Monitor Private Link Scopes (AMPLS)](../logs/private-link-configure.md#connect-azure-monitor-resources).
106
106
107
107
### Create a data collection endpoint
108
108
109
-
To use network isolation, you must create a data collection endpoint for each of your regions so that agents can connect instead of using the public endpoint. For information on how to create a DCE, see [Create a data collection endpoint](../essentials/data-collection-endpoint-overview.md#create-data-collection-endpoint). An agent can only connect to a DCE in the same region. If you have agents in multiple regions, you must create a DCE in each one.
110
-
109
+
[Create a data collection endpoint](../essentials/data-collection-endpoint-overview.md#create-data-collection-endpoint) for each of your regions so that agents can connect instead of using the public endpoint. An agent can only connect to a DCE in the same region. If you have agents in multiple regions, you must create a DCE in each one.
111
110
### Create a private link
112
111
113
112
With [Azure Private Link](../../private-link/private-link-overview.md), you can securely link Azure platform as a service (PaaS) resources to your virtual network by using private endpoints. An Azure Monitor private link connects a private endpoint to a set of Azure Monitor resources that define the boundaries of your monitoring network. That set is called an Azure Monitor Private Link Scope. For information on how to create and configure your AMPLS, see [Configure your private link](../logs/private-link-configure.md).
@@ -130,5 +129,5 @@ Associate the data collection endpoints to the target resources by editing the d
130
129
131
130
## Next steps
132
131
133
-
-[Associate endpoint to machines](../agents/data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association)
134
-
-[Add endpoint to AMPLS resource](../logs/private-link-configure.md#connect-azure-monitor-resources)
132
+
-[Associate endpoint to machines](../agents/data-collection-rule-azure-monitor-agent.md#create-a-data-collection-rule)
133
+
-[Add endpoint to AMPLS resource](../logs/private-link-configure.md#connect-azure-monitor-resources).
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/azure-monitor-agent-manage.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,7 +54,7 @@ The following prerequisites must be met prior to installing Azure Monitor Agent.
54
54
```
55
55
We recommend that you use `mi_res_id` as the `identifier-name`. The following sample commands only show usage with `mi_res_id` for the sake of brevity. For more information on `mi_res_id`, `object_id`, and `client_id`, see the [Managed identity documentation](../../active-directory/managed-identities-azure-resources/how-to-use-vm-token.md#get-a-token-using-http).
56
56
- **System-assigned**: This managed identity is suited for initial testing or small deployments. When used at scale, for example, for all VMs in a subscription, it results in a substantial number of identities created (and deleted) in Azure Active Directory. To avoid this churn of identities, use user-assigned managed identities instead. *For Azure Arc-enabled servers, system-assigned managed identity is enabled automatically* as soon as you install the Azure Arc agent. It's the only supported type for Azure Arc-enabled servers.
57
-
- **Not required for Azure Arc-enabled servers**: The system identity is enabled automatically if the agent is installed via [creating and assigning a data collection rule by using the Azure portal](data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association).
57
+
- **Not required for Azure Arc-enabled servers**: The system identity is enabled automatically when you [create a data collection rule in the Azure portal](data-collection-rule-azure-monitor-agent.md#create-a-data-collection-rule).
58
58
- **Networking**: If you use network firewalls, the [Azure Resource Manager service tag](../../virtual-network/service-tags-overview.md) must be enabled on the virtual network for the virtual machine. The virtual machine must also have access to the following HTTPS endpoints:
59
59
60
60
- global.handler.control.monitor.azure.com
@@ -69,7 +69,7 @@ The following prerequisites must be met prior to installing Azure Monitor Agent.
69
69
70
70
#### [Portal](#tab/azure-portal)
71
71
72
-
To install Azure Monitor Agent by using the Azure portal, follow the process to [create a data collection rule](data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) in the Azure portal. This process creates the rule, associates it to the selected resources, and installs Azure Monitor Agent on them if it's not already installed.
72
+
For information on how to install Azure Monitor Agent from the Azure portal, see [Create a data collection rule](data-collection-rule-azure-monitor-agent.md#create-a-data-collection-rule). This process creates the rule, associates it to the selected resources, and installs Azure Monitor Agent on them if it's not already installed.
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/azure-monitor-agent-migration-tools.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -81,4 +81,4 @@ To install DCR Config Generator:
81
81
- Windows ARM template and parameter files - if the target workspace contains Windows performance counters or Windows events.
82
82
- Linux ARM template and parameter files - if the target workspace contains Linux performance counters or Linux Syslog events.
83
83
84
-
1. Use the built-in rule association policies to [associate the generated data collection rules with virtual machines](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) running the new agent.
84
+
1. Use the built-in rule association policies to [associate the generated data collection rules with virtual machines](./data-collection-rule-azure-monitor-agent.md#create-a-data-collection-rule) running the new agent.
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/azure-monitor-agent-migration.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -57,7 +57,7 @@ Review the [prerequisites](./azure-monitor-agent-manage.md#prerequisites) for us
57
57
58
58
To ensure safe deployment during migration, begin testing with few resources running Azure Monitor Agent in your nonproduction environment. After you validate the data collected on these test resources, roll out to production by following the same steps.
59
59
60
-
To start collecting some of the existing data types, see [Create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association). Alternatively, you can use the [DCR Config Generator](./azure-monitor-agent-migration-tools.md#installing-and-using-dcr-config-generator) to convert existing legacy agent configuration into data collection rules.
60
+
To start collecting some of the existing data types, see [Create new data collection rules](./data-collection-rule-azure-monitor-agent.md#create-a-data-collection-rule). Alternatively, you can use the [DCR Config Generator](./azure-monitor-agent-migration-tools.md#installing-and-using-dcr-config-generator) to convert existing legacy agent configuration into data collection rules.
61
61
62
62
After you *validate* that data is flowing as expected with Azure Monitor Agent, check the `Category` column in the [Heartbeat](/azure/azure-monitor/reference/tables/heartbeat) table for the value *Azure Monitor Agent* for AMA collected data. Ensure it matches data flowing through the existing Log Analytics agent.
(If using private links on the agent, you must also add the [data collection endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint))
55
-
6.Existing data collection rule(s) you wish to associate with the devices. If it doesn't exist already, [follow the guidance here to create data collection rule(s)](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association). **Do not associate the rule to any resources yet**.
55
+
6.A data collection rule you want to associate with the devices. If it doesn't exist already, [create a data collection rule](./data-collection-rule-azure-monitor-agent.md#create-a-data-collection-rule). **Do not associate the rule to any resources yet**.
56
56
57
57
## Install the agent
58
58
1. Download the Windows MSI installer for the agent using [this link](https://go.microsoft.com/fwlink/?linkid=2192409). You can also download it from **Monitor** > **Data Collection Rules** > **Create** experience on Azure portal (shown below):
@@ -174,7 +174,8 @@ PUT https://management.azure.com/providers/Microsoft.Insights/monitoredObjects/{
174
174
175
175
176
176
#### 3. Associate DCR to Monitored Object
177
-
Now we associate the Data Collection Rules (DCR) to the Monitored Object by creating Data Collection Rule Associations. If you haven't already, [follow instructions here](./data-collection-rule-azure-monitor-agent.md#create-data-collection-rule-and-association) to create data collection rules first.
177
+
Now we associate the Data Collection Rules (DCR) to the Monitored Object by creating Data Collection Rule Associations.
178
+
178
179
**Permissions required**: Anyone who has ‘Monitored Object Contributor’ at an appropriate scope can perform this operation, as assigned in step 1.
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/data-collection-iis.md
+20-13Lines changed: 20 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.reviewer: shseth
11
11
12
12
# Collect IIS logs with Azure Monitor Agent
13
13
14
-
The Internet Information Service (IIS) logs data to the local disk of Windows machines. This article describes how to create a data collection rule (DCR) that sets up [Azure Monitor Agent](azure-monitor-agent-overview.md)to collect IIS logs from monitored machines.
14
+
The Internet Information Service (IIS) logs data to the local disk of Windows machines. This article explains how to collect IIS logs from monitored machines with [Azure Monitor Agent](azure-monitor-agent-overview.md)by creating a data collection rule (DCR).
15
15
16
16
## Prerequisites
17
17
To complete this procedure, you need:
@@ -24,14 +24,15 @@ To complete this procedure, you need:
24
24
- The log file must be stored on a local drive of the machine on which Azure Monitor Agent is running.
25
25
- Each entry in the log file must be delineated with an end of line.
26
26
- The log file must not allow circular logging, log rotation where the file is overwritten with new entries or renaming where a file is moved and a new file with the same name is opened.
27
-
28
27
## Create data collection rule to collect IIS logs
29
28
The [data collection rule](../essentials/data-collection-rule-overview.md) defines:
30
29
31
30
- Which source log files Azure Monitor Agent scans for new events.
32
31
- How Azure Monitor transforms events during ingestion.
33
32
- The destination Log Analytics workspace and table to which Azure Monitor sends the data.
34
33
34
+
Create the data collection rule in the *same region* as your Log Analytics workspace. You can still associate the rule to machines in other supported regions.
35
+
35
36
To create the data collection rule in the Azure portal:
36
37
37
38
1. On the **Monitor** menu, select **Data Collection Rules**.
@@ -46,19 +47,23 @@ To create the data collection rule in the Azure portal:
46
47
47
48
[](media/data-collection-rule-azure-monitor-agent/data-collection-rule-basics-updated.png#lightbox)
48
49
49
-
1. On the **Resources** tab, add the resources to which to associate the data collection rule. Resources can be virtual machines, virtual machine scale sets, and Azure Arc for servers. The Azure portal installs Azure Monitor Agent on resources that don't already have it installed.
50
+
1. On the **Resources** tab:
51
+
1. Select **+ Add resources** and associate resources to the data collection rule. Resources can be virtual machines, Virtual Machine Scale Sets, and Azure Arc for servers. The Azure portal installs Azure Monitor Agent on resources that don't already have it installed.
50
52
51
-
> [!IMPORTANT]
52
-
> The portal enables system-assigned managed identity on the target resources, along with existing user-assigned identities, if there are any. For existing applications, unless you specify the user-assigned identity in the request, the machine defaults to using system-assigned identity instead.
53
+
> [!IMPORTANT]
54
+
> The portal enables system-assigned managed identity on the target resources, along with existing user-assigned identities, if there are any. For existing applications, unless you specify the user-assigned identity in the request, the machine defaults to using system-assigned identity instead.
55
+
56
+
If you need network isolation using private links, select existing endpoints from the same region for the respective resources or [create a new endpoint](../essentials/data-collection-endpoint-overview.md).
53
57
54
-
If you need network isolation using private links, select existing endpoints from the same region for the respective resources or [create a new endpoint](../essentials/data-collection-endpoint-overview.md).
58
+
1. Select **Enable Data Collection Endpoints**.
59
+
1. Select a data collection endpoint for each of the resources associate to the data collection rule.
55
60
56
61
[](media/data-collection-rule-azure-monitor-agent/data-collection-rule-virtual-machines-with-endpoint.png#lightbox)
57
62
58
63
1. On the **Collect and deliver** tab, select **Add data source** to add a data source and set a destination.
59
64
1. Select **IIS Logs**.
60
65
61
-
[](media/data-collection-iis/iis-data-collection-rule.png#lightbox)
66
+
[](media/data-collection-iis/iis-data-collection-rule.png#lightbox)
62
67
63
68
1. Optionally, specify a file pattern to identify the directory where the log files are located.
64
69
1. On the **Destination** tab, add one or more destinations for the data source. You can select multiple destinations of the same or different types. For instance, you can select multiple Log Analytics workspaces, which is also known as multihoming.
@@ -75,7 +80,7 @@ To create the data collection rule in the Azure portal:
75
80
Use the following steps to troubleshoot collection of IIS logs.
76
81
77
82
### Check if any IIS logs have been received
78
-
Start by checking if any records have been collected for your IIS logs by running the following query in Log Analytics. If no records are returned then check the other sections for possible causes. This query looks for entires in the last two days, but you can modify for another time range.
83
+
Start by checking if any records have been collected for your IIS logs by running the following query in Log Analytics. If the query doesn't return records, check the other sections for possible causes. This query looks for entires in the last two days, but you can modify for another time range.
79
84
80
85
```kusto
81
86
W3CIISLog
@@ -128,9 +133,9 @@ Open IIS Manager and verify that the logs are being written in W3C format.
128
133
129
134
:::image type="content" source="media/data-collection-text-log/iis-log-format-setting.png" lightbox="media/data-collection-text-log/iis-log-format-setting.png" alt-text="Screenshot of IIS logging configuration dialog box on agent machine.":::
130
135
131
-
Open IIS log on the agent machine to verify logs are in W3C format.
136
+
Open the IIS log on the agent machine to verify logs are in W3C format.
132
137
133
-
:::image type="content" source="media/data-collection-text-log/iis-log-format.png" lightbox="media/data-collection-text-log/iis-log-format.png" alt-text="Screenshot of IIS log on agent machine showing the header specifies W3C format.":::
138
+
:::image type="content" source="media/data-collection-text-log/iis-log-format.png" lightbox="media/data-collection-text-log/iis-log-format.png" alt-text="Screenshot of an IIS log on an agent machine showing the header specifies W3C format.":::
134
139
135
140
### Share logs with Microsoft
136
141
If everything is configured properly, but you're still not collecting log data, use the following procedure to collect diagnostics logs for Azure Monitor agent to share with the Azure Monitor group.
@@ -142,6 +147,8 @@ If everything is configured properly, but you're still not collecting log data,
142
147
143
148
## Next steps
144
149
145
-
- Learn more about [Azure Monitor Agent](azure-monitor-agent-overview.md).
146
-
- Learn more about [data collection rules](../essentials/data-collection-rule-overview.md).
147
-
- Learn more about [data collection endpoints](../essentials/data-collection-endpoint-overview.md).
0 commit comments