You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/azure-monitor-agent-overview.md
+11-13Lines changed: 11 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.custom: references_regions
10
10
11
11
# Azure Monitor agent overview
12
12
The Azure Monitor agent (AMA) collects monitoring data from the guest operating system of Azure virtual machines and delivers it to Azure Monitor. This article provides an overview of the Azure Monitor agent and includes information on how to install it and how to configure data collection.
13
-
Here's an **introductory video** explaining all about this new agent, including a quick demo of how to set things up using the Azure Portal: [ITOps Talk: Azure Monitor Agent](https://www.youtube.com/watch?v=f8bIrFU8tCs)
13
+
Here's an **introductory video** explaining all about this new agent, including a quick demo of how to set things up using the Azure portal: [ITOps Talk: Azure Monitor Agent](https://www.youtube.com/watch?v=f8bIrFU8tCs)
14
14
15
15
## Relationship to other agents
16
16
Eventually, the Azure Monitor agent will replace the following legacy monitoring agents that are currently used by Azure Monitor to collect guest data from virtual machines ([view known gaps](../faq.yml)):
@@ -30,10 +30,7 @@ In addition to consolidating this functionality into a single agent, the Azure M
30
30
-**Improved extension management:** The Azure Monitor agent uses a new method of handling extensibility that's more transparent and controllable than management packs and Linux plug-ins in the current Log Analytics agents.
31
31
32
32
### Current limitations
33
-
When compared with the legacy agents, this new agent doesn't yet have full parity.
34
-
-**Comparison with Log Analytics agents (MMA/OMS):**
35
-
- Not all Log Analytics solutions are supported yet. [View supported features and services](#supported-services-and-features).
36
-
- The support for collecting file based logs or IIS logs is in [private preview](https://aka.ms/amadcr-privatepreviews).
33
+
Not all Log Analytics solutions are supported yet. [View supported features and services](#supported-services-and-features).
37
34
38
35
### Changes in data collection
39
36
The methods for defining data collection for the existing agents are distinctly different from each other. Each method has challenges that are addressed with the Azure Monitor agent.
@@ -84,6 +81,7 @@ The Azure Monitor agent sends data to Azure Monitor Metrics (preview) or a Log A
84
81
| Performance | Azure Monitor Metrics (preview)<sup>1</sup> - Insights.virtualmachine namespace<br>Log Analytics workspace - [Perf](/azure/azure-monitor/reference/tables/perf) table | Numerical values measuring performance of different aspects of operating system and workloads |
85
82
| Windows event logs | Log Analytics workspace - [Event](/azure/azure-monitor/reference/tables/Event) table | Information sent to the Windows event logging system |
86
83
| Syslog | Log Analytics workspace - [Syslog](/azure/azure-monitor/reference/tables/syslog)<sup>2</sup> table | Information sent to the Linux event logging system |
84
+
| Text logs | Log Analytics workspace - custom table | Events sent to log file on agent machine. |
87
85
88
86
<sup>1</sup> [Click here](../essentials/metrics-custom-overview.md#quotas-and-limits) to review other limitations of using Azure Monitor Metrics. On Linux, using Azure Monitor Metrics as the only destination is supported in v1.10.9.0 or higher.
89
87
<sup>2</sup> Azure Monitor Linux Agent v1.15.2 or higher supports syslog RFC formats including **Cisco Meraki, Cisco ASA, Cisco FTD, Sophos XG, Juniper Networks, Corelight Zeek, CipherTrust, NXLog, McAfee and CEF (Common Event Format)**.
@@ -100,16 +98,16 @@ The following table shows the current support for the Azure Monitor agent with A
100
98
101
99
| Azure Monitor feature | Current support | More information |
102
100
|:---|:---|:---|
103
-
|File based logs and Windows IIS logs |Private preview |[Sign-up link](https://aka.ms/amadcr-privatepreviews)|
101
+
|Text logs and Windows IIS logs |Public preview |[Collect text logs with Azure Monitor agent (preview)](data-collection-text-log.md)|
104
102
| Windows Client OS installer | Private preview |[Sign-up link](https://aka.ms/amadcr-privatepreviews)|
The following table shows the current support for the Azure Monitor agent with Azure solutions.
108
106
109
107
| Solution | Current support | More information |
110
108
|:---|:---|:---|
111
-
|[Change Tracking](../../automation/change-tracking/overview.md)| Supported as File Integrity Monitoring in the Microsoft Defender for Cloud private preview. |[Sign-up link](https://aka.ms/AMAgent)|
112
-
|[Update Management](../../automation/update-management/overview.md)| Use Update Management v2 (private preview) that doesn't require an agent. |[Sign-up link](https://www.yammer.com/azureadvisors/threads/1064001355087872)|
109
+
|[Change Tracking](../../automation/change-tracking/overview.md)| Supported as File Integrity Monitoring in the Microsoft Defender for Cloud Private Preview. |[Sign-up link](https://aka.ms/AMAgent)|
110
+
|[Update Management](../../automation/update-management/overview.md)| Use Update Management v2 (Private Preview) that doesn't require an agent. |[Sign-up link](https://www.yammer.com/azureadvisors/threads/1064001355087872)|
113
111
114
112
## Costs
115
113
There's no cost for the Azure Monitor agent, but you might incur charges for the data ingested. For details on Log Analytics data collection and retention and for customer metrics, see [Azure Monitor pricing](https://azure.microsoft.com/pricing/details/monitor/).
@@ -119,7 +117,7 @@ There's no cost for the Azure Monitor agent, but you might incur charges for the
119
117
The Azure Monitor agent doesn't require any keys but instead requires a [system-assigned managed identity](../../active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm.md#system-assigned-managed-identity). You must have a system-assigned managed identity enabled on each virtual machine before you deploy the agent.
120
118
121
119
## Networking
122
-
The Azure Monitor agent supports Azure service tags (both AzureMonitor and AzureResourceManager tags are required). It supports connecting via **direct proxies, Log Analytics gateway, and private links** as described below.
120
+
The Azure Monitor agent supports Azure service tags (both *AzureMonitor* and *AzureResourceManager* tags are required). It supports connecting via **direct proxies, Log Analytics gateway, and private links** as described below.
@@ -135,7 +133,7 @@ The Azure Monitor agent supports Azure service tags (both AzureMonitor and Azure
135
133
| Azure China |`<log-analytics-workspace-id>`.ods.opinsights.azure.cn |Ingest logs data |Port 443 |Outbound|Yes |
136
134
137
135
138
-
If using private links on the agent, you must also add the [dce endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint)
136
+
If using private links on the agent, you must also add the [DCE endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint)
139
137
140
138
### Proxy configuration
141
139
If the machine connects through a proxy server to communicate over the internet, review requirements below to understand the network configuration required.
@@ -149,7 +147,7 @@ The Azure Monitor agent extensions for Windows and Linux can communicate either
149
147
150
148
151
149
152
-
2. After the values for the *settings* and *protectedSettings* parameters are determined, **provide these additional parameters** when you deploy the Azure Monitor agent by using PowerShell commands. Refer the following examples.
150
+
2. After the values for the *settings* and *protectedSettings* parameters are determined, **provide these additional parameters** when you deploy the Azure Monitor agent by using PowerShell commands. Refer to the following examples.
1. Follow the instructions above to configure proxy settings on the agent and provide the IP address and port number corresponding to the gateway server. If you have deployed multiple gateway servers behind a load balancer, the agent proxy configuration is the virtual IP address of the load balancer instead.
191
-
2. Add the **configuration endpoint URL** to fetch data collection rules to the allow list for the gateway
189
+
2. Add the **configuration endpoint URL** to fetch data collection rules to the allowlist for the gateway
(If using private links on the agent, you must also add the [dce endpoints](../essentials/data-collection-endpoint-overview.md#components-of-a-data-collection-endpoint))
195
-
3. Add the **data ingestion endpoint URL** to the allow list for the gateway
193
+
3. Add the **data ingestion endpoint URL** to the allowlist for the gateway
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/data-collection-rule-azure-monitor-agent.md
+5-8Lines changed: 5 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,30 +1,26 @@
1
1
---
2
2
title: Configure data collection for the Azure Monitor agent
3
-
description: Describes how to create a data collection rule to collect data from virtual machines using the Azure Monitor agent.
3
+
description: Describes how to create a data collection rule to collect events and performance data from virtual machines using the Azure Monitor agent.
4
4
ms.topic: conceptual
5
5
ms.date: 03/16/2022
6
6
7
7
---
8
8
9
9
# Configure data collection for the Azure Monitor agent
10
-
11
-
Data Collection Rules (DCR) define data coming into Azure Monitor and specify where it should be sent. This article describes how to create a data collection rule to collect data from virtual machines using the Azure Monitor agent.
12
-
13
-
For a complete description of data collection rules, see [Data collection rules in Azure Monitor](../essentials/data-collection-rule-overview.md).
10
+
This article describes how to create a [data collection rule](../essentials/data-collection-rule-overview.md) to collect events and performance counters from virtual machines using the Azure Monitor agent. The data collection rule defines data coming into Azure Monitor and specify where it should be sent.
14
11
15
12
> [!NOTE]
16
13
> This article describes how to configure data for virtual machines with the Azure Monitor agent only.
17
14
18
15
## Data collection rule associations
19
16
20
-
To apply a DCR to a virtual machine, you create an association for the virtual machine. A virtual machine may have an association to multiple DCRs, and a DCR may have multiple virtual machines associated to it. This allows you to define a set of DCRs, each matching a particular requirement, and apply them to only the virtual machines where they apply.
17
+
To apply a DCR to a virtual machine, you create an association for the virtual machine. A virtual machine may have an association to multiple DCRs, and a DCR may have multiple virtual machines associated to it. This allows you to define a set of DCRs, each matching a particular requirement, and apply them to only the virtual machines where they apply.
21
18
22
19
For example, consider an environment with a set of virtual machines running a line of business application and others running SQL Server. You might have one default data collection rule that applies to all virtual machines and separate data collection rules that collect data specifically for the line of business application and for SQL Server. The associations for the virtual machines to the data collection rules would look similar to the following diagram.
23
20
24
21
25
22
26
23
27
-
28
24
## Create rule and association in Azure portal
29
25
30
26
You can use the Azure portal to create a data collection rule and associate virtual machines in your subscription to that rule. The Azure Monitor agent will be automatically installed and a managed identity created for any virtual machines that don't already have it installed.
@@ -77,7 +73,7 @@ Since you're charged for any data collected in a Log Analytics workspace, you sh
77
73
To specify additional filters, you must use Custom configuration and specify an XPath that filters out the events you don't. XPath entries are written in the form `LogName!XPathQuery`. For example, you may want to return only events from the Application event log with an event ID of 1035. The XPathQuery for these events would be `*[System[EventID=1035]]`. Since you want to retrieve the events from the Application event log, the XPath would be `Application!*[System[EventID=1035]]`
78
74
79
75
### Extracting XPath queries from Windows Event Viewer
80
-
One of the ways to create XPath quries is to use Windows Event Viewer to extract XPath queries as shown below.
76
+
One of the ways to create XPath queries is to use Windows Event Viewer to extract XPath queries as shown below.
81
77
*In step 5 when pasting over the 'Select Path' parameter value, you must append the log type category followed by '!' and then paste the copied value.
0 commit comments