Migrate to Azure Monitor Agent from Log Analytics agent

Azure Monitor Agent (AMA) replaces the Log Analytics agent (also known as MMA and OMS) for Windows and Linux machines, in Azure and non-Azure environments, including on-premises and third-party clouds. The agent introduces a simplified, flexible method of configuring data collection using data collection rules (DCRs). This article provides guidance on how to implement a successful migration from the Log Analytics agent to Azure Monitor Agent.

If you're currently using the Log Analytics agent with Azure Monitor or other supported features and services, start planning your migration to Azure Monitor Agent by using the information in this article. If you are using the Log Analytics Agent for SCOM you will need to migrate to the SCOM Agent

The Log Analytics agent will be retired on August 31, 2024. You can expect the following when you use the MMA or OMS agent after this date.

  • Data upload: You can still upload data. At some point when major customer have finished migrating and data volumes significantly drop, upload will be suspended. You can expect this to take at least 6 to 9 months. You will not receive a breaking change notification of the suspension.
  • Install or reinstall: You can still install and reinstall the legacy agents. You will not be able to get support for installing or reinstalling issues.
  • Customer Support: You can expect support for MMA/OMS for security issues.

Benefits

In addition to consolidating and improving on the legacy Log Analytics agents, Azure Monitor Agent provides various immediate benefits, including cost savings, a simplified management experience, and enhanced security and performance.

Migration guidance

Before you begin migrating from the Log Analytics agent to Azure Monitor Agent, review the checklist below.

Before you begin

  • Check the prerequisites for installing Azure Monitor Agent.
    To monitor non-Azure and on-premises servers, you must install the Azure Arc agent. The Arc agent makes your on-premises servers visible as to Azure as a resource it can target. You won't incur any additional cost for installing the Azure Arc agent.
  • Understand your current needs.
    Use the Workspace overview tab of the AMA Migration Helper to see connected agents and discover solutions enabled on your Log Analytics workspaces that use legacy agents, including per-solution migration recommendations.
  • Verify that Azure Monitor Agent can address all of your needs.
    Azure Monitor Agent is generally available for data collection and is used for data collection by various Azure Monitor features and other Azure services. For details, see Supported services and features.
  • Consider installing Azure Monitor Agent together with a legacy agent for a transition period.
    Run Azure Monitor Agent alongside the legacy Log Analytics agent on the same machine to continue using existing functionality during evaluation or migration. Keep in mind that running two agents on the same machine doubles resource consumption, including but not limited to CPU, memory, storage space, and network bandwidth.
    • If you're setting up a new environment with resources, such as deployment scripts and onboarding templates, install Azure Monitor Agent together with a legacy agent in your new environment to decrease the migration effort later.
    • If you have two agents on the same machine, avoid collecting duplicate data.
      Collecting duplicate data from the same machine can skew query results, affect downstream features like alerts, dashboards, and workbooks, and generate extra charges for data ingestion and retention.
      To avoid data duplication:

Migration steps

Flow diagram that shows the steps involved in agent migration and how the migration tools help in generating DCRs and tracking the entire migration process.

  1. Use the DCR generator to convert your legacy agent configuration into data collection rules automatically.1

    Review the generated rules before you create them and take advantage of advanced options, such as filtering, granular targeting (per machine), and other optimizations. There are special steps needed to migrate MMA custom logs to AMA custom logs

  2. Test the new agent and data collection rules on a few nonproduction machines:

    1. Deploy the generated data collection rules and associate them with a few machines, as described in Installing and using DCR Config Generator.

      To avoid double ingestion, you can disable data collection from legacy agents during the testing phase without uninstalling the agents yet, by removing the workspace configurations for legacy agents.

    2. Compare the data ingested by Azure Monitor Agent with legacy agent data to ensure there are no gaps. You can do this on any table by using the join operator to add the Category column from the Heartbeat table, which indicates Azure Monitor Agent for data collected by the Azure Monitor Agent.

      For example, this query adds the Category column from the Heartbeat table to data retrieved from the Event table:

      Heartbeat
      | distinct Computer, SourceComputerId, Category
      | join kind=inner (
          Event
      | extend d=parse_xml(EventData)
          | extend sourceHealthServiceId = tostring(d.DataItem.["@sourceHealthServiceId"])
          | project-reorder TimeGenerated, Computer, EventID, sourceHealthServiceId, ParameterXml, EventData
          ) on $left.SourceComputerId==$right.sourceHealthServiceId
      | project TimeGenerated, Computer, Category, EventID, sourceHealthServiceId, ParameterXml, EventData
      
  3. Use built-in policies to deploy extensions and DCR associations at scale. Using policy also ensures automatic deployment of extensions and DCR associations for new machines.3

    Use the AMA Migration Helper to monitor the at-scale migration across your machines.

  4. Validate that Azure Monitor Agent is collecting data as expected and all downstream dependencies, such as dashboards, alerts, and workbooks, function properly:

    1. Look at the Overview and Usage tabs of Log Analytics Workspace Insights for spikes or dips in ingestion rates following the migration. Check both the overall workspace ingestion and the table-level ingestion rates.
    2. Check your workbooks, dashboards, and alerts for variances from typical behavior following the migration.
  5. Clean up: After you confirm that Azure Monitor Agent is collecting data properly, disable or uninstall the legacy Log Analytics agents.

    • If you've migrated to Azure Monitor Agent for all your requirements, uninstall the Log Analytics agent from monitored resources. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent. Continue using the legacy Log Analytics for features and solutions that Azure Monitor Agent doesn't support.

      Use the MMA removal tool to discovery and remove the Log Analytics agent extension from all machines within your tenant.

    • Don't uninstall the legacy agent if you need to use it to upload data to System Center Operations Manager.

1 The DCR generator only converts the configurations for Windows event logs, Linux syslog and performance counters. Support for more features and solutions will be available soon.
2 You might need to deploy extensions required for specific solutions in addition to the Azure Monitor Agent extension.

Migrate additional services and features

Azure Monitor Agent is generally available for data collection. Most services that used Log Analytics agent for data collection have migrated to Azure Monitor Agent.

The following features and services now have an Azure Monitor Agent version (some are still in Public Preview). This means you can already choose to use Azure Monitor Agent to collect data when you enable the feature or service.

Service or feature Migration recommendation Current state More information
VM insights, Service Map, and Dependency agent Migrate to Azure Monitor Agent Generally Available Enable VM Insights
Container insights Migrate to Azure Monitor Agent Linux: Generally available
Windows:Public preview
Enable Container Insights
Microsoft Sentinel Migrate to Azure Monitor Agent Public Preview See AMA migration for Microsoft Sentinel. Only CEF and Firewall collection remain for GA status
Change Tracking and Inventory Migrate to Azure Monitor Agent Generally Available Migration guidance from Change Tracking and inventory using Log Analytics to Change Tracking and inventory using Azure Monitoring Agent version
Network Watcher Migrate to new service called Connection Monitor with Azure Monitor Agent Generally Available Monitor network connectivity using Azure Monitor agent with connection monitor
Azure Stack HCI Insights Migrate to Azure Monitor Agent Generally Available Monitor Azure Stack HCI with Insights
Azure Virtual Desktop (AVD) Insights Migrate to Azure Monitor Agent Generally Available Use Azure Virtual Desktop Insights to monitor your deployment
Container Monitoring Solution Migrate to new service called Container Insights with Azure Monitor Agent Generally Available Enable Container Insights
DNS Collector Use new Sentinel Connector Generally Available Enable DNS Connector

Note

Features and services listed above in preview may not be available in Azure Government and China clouds. They will be available typically within a month after the features/services become generally available.

When you migrate the following services, which currently use Log Analytics agent, to their respective replacements (v2), you no longer need either of the monitoring agents:

Service Migration recommendation Current state More information
Microsoft Defender for Cloud, Servers, SQL, and Endpoint Migrate to Microsoft Defender for Cloud (No dependency on Log Analytics agents or Azure Monitor Agent) Generally available Defender for Cloud plan and strategy for the Log Analytics agent deprecation
Update Management Migrate to Azure Update Manager (No dependency on Log Analytics agents or Azure Monitor Agent) Generally available Update Manager documentation
Automation Hybrid Runbook Worker overview Automation Hybrid Worker Extension (no dependency on Log Analytics agents or Azure Monitor Agent) Generally available Migrate an existing Agent based to Extension based Hybrid Workers

Frequently asked questions

This section provides answers to common questions.

Can Azure Monitor Agent and the Log Analytics agent coexist side by side?

Yes. If you're migrating to Azure Monitor Agent, you might consider installing Azure Monitor Agent together with a legacy agent for a transition period, but you must be mindful of certain considerations. Read more about agent coexistence considerations in the Azure Monitor Agent migration guidance.

Next steps

For more information, see: