Edit

Remove Dependency Agent from Azure Virtual Machines and Virtual Machine Scale Sets

The Dependency Agent is a required component for the map feature in VM insights. This feature is being deprecated so the dependency agent is longer be required. This article provides the steps for safely uninstalling the Dependency Agent from both Windows and Linux-based Azure virtual machines and virtual machine scale set instances.

Important

VM insights isn't being retired, just the map feature and any components that rely on it, such as the dependency agent.

Understand the Dependency Agent

The Dependency Agent collects data about machine processes, connections, and dependencies. Before proceeding with removal, consider how this may affect your monitoring, troubleshooting, or compliance workflows. Removing the agent stops data collection for the map feature of Azure Monitor and any workbooks or other solutions you may have that depend on this data.

Best practices

  • Test removal on a nonproduction virtual machine or virtual machine scale set instance before rolling out widely.
  • Document the removal process and notify all affected teams before proceeding.
  • Update your configuration management and automation scripts to prevent future unintended deployments of the Dependency Agent.
  • Re-enable or replace any monitoring or security features that depended on the agent, if necessary.

Prerequisites and considerations

  • Identify machines or scale set instances where the Dependency Agent is installed. See VM Insights Map and Dependency Agent retirement guidance.
  • Ensure you have Owner or Contributor permission, or equivalent administrative rights, on the target VM.
  • Ensure you have at least Reader access to the VM insights Data Collection Rules (DCR).
  • If you use Azure Policy to enable VM insights, you might need to change policy assignments to prevent compliance problems or reinstallation of the Dependency Agent after it's removed. See Migrate Dependency Agent policy and initiative assignments.
  • Review any monitoring solutions that rely on the Dependency Agent and communicate with your IT or monitoring teams to avoid unintended disruptions. Any alert rules that use any of the VMComputer, VMProcess, VMConnection, or VMBoundPort tables from a Log Analytics Workspace are affected. The contents of the InsightsMetrics table will change and may affect monitoring solutions.
  • Removal doesn't require a VM reboot but follow your organization’s best practice to avoid adversely affecting production systems.
  • For virtual machine scale set, changes need to be applied across all instances.
  • Previously collected data in workspaces isn't deleted but is retained according to existing data retention policies.

Identify the Dependency Agent installation

The Dependency Agent is typically installed as an Azure extension. You can verify its installation using any of the methods below.

  1. Open the menu for the virtual machine or virtual machine scale set in the Azure portal.
  2. Select Extensions + applications in the left menu.
  3. Look for DependencyAgentWindows or DependencyAgentLinux in the list of installed extensions.

Update Data Collection Rule Assignments (DCRA)

This step disables sending process and connection data to the workspace. Prior to this step, verify that you removed or disabled any alerts and monitoring in your environment that depend upon this data.

The portal can't make changes for all possible Data Collection Rule Associations (DCRA), since the VM might be associated with multiple DCRs. Use the query below in the Azure Resource Graph Explorer to check if your VM can use the Azure portal to update its DCRA. If it doesn't return Ok to use portal, you need to use PowerShell or CLI to update each DCRA.

resources
| where id =~ '<resource-id>' // add VM/VMSS resource id here 
| project azureResourceId = tolower(id), 
          computeName = name 
| join kind = leftouter ( 
    insightsresources 
    | extend azureResourceId = tostring(split(tolower(id), '/providers/microsoft.insights/datacollectionruleassociations/')[0]) 
  ) on azureResourceId 
| project id, computeName, dcraName = name, 
          foundDcra = isnotempty(id),
          dataCollectionRulesId = tolower(properties.dataCollectionRuleId) 
| join kind=leftouter ( 
    resources 
    | where type == "microsoft.insights/datacollectionrules"  
    | project dataCollectionRulesId = tolower(id), properties  
  ) on dataCollectionRulesId 
| project id, computeName, dcraName, foundDcra,
          dataCollectionRulesId,
          flows = properties.dataFlows  
| mv-expand flows  
| summarize vmiFlowCount =
            countif(flows.streams contains "Microsoft-InsightsMetric" or 
                    flows.streams contains "Microsoft-ServiceMap")
            by id, computeName, dcraName, dataCollectionRulesId, foundDcra 
| extend isVmiDcra = vmiFlowCount > 0,
         nonconformingName = dcraName != strcat(computeName,'-VMInsights-Dcr-Association')
| summarize 
    Total = count(),
    TotalDcra = countif(foundDcra),
    TotalVmiDcra = countif(isVmiDcra),
    NonconformingNameCount = countif(isVmiDcra and nonconformingName) 
| project PortalCompatibility = 
          case(Total == 0, 'Check VM/VMSS id', 
               TotalVmiDcra == 0, 'No DCRA found',
               TotalVmiDcra > 1, 'More than one DCRA', 
               NonconformingNameCount > 0, 'Not using Portal style name', 
               'Ok to use portal')

If your VM can use the portal, follow these steps:

  1. Open the menu for the VM in the Azure portal.
  2. Select Monitoring configuration at the top of the screen.
  3. The monitoring configuration should display the name of a Data Collection Rule (DCR) with Processes and dependencies (Map) enabled. If Processes and dependencies (Map) is disabled, then right DCR is already being used. You can skip to the next section to uninstall the Dependency Agent.
  4. Click Edit at the bottom of the screen.
  5. Select an existing DCR or create a new DCR that has Processes and dependencies (Map) disabled.
  6. Click Configure and wait for the update to be completed.

Remove the Dependency Agent

  1. Open the menu for the virtual machine scale set or virtual machine scale set in the Azure portal.
  2. Select Extensions + applications in the left menu.
  3. Select the extension with a Type of either DependencyAgentWindows or DependencyAgentLinux.
  4. Click Uninstall and wait for the process to complete.

If the virtual machine scale set is configured with manual upgrade mode, then an extra step is required to remove the extension from any currently running instances. See Performing manual upgrades on Virtual Machine Scale Sets.

Verify removal

After removal, verify that the agent is fully uninstalled and no related processes are running.

  • Check the Extensions + applications blade in the Azure portal. The Dependency Agent should no longer be listed.
  • Review monitoring dashboards to ensure expected changes in data collection.
  • After several days, check for unintentional reinstallation of the process and connection monitoring. The VM's Activity Log can be used to identify when the changes were made and who made them. After addressing the cause of the reinstallation, complete the steps above again.

Troubleshooting

Extension Removal Fails
If the uninstall fails, review the common issues below. The VM's Activity Log may provide more details.

  • Linux

    • Could not acquire package manager (yum or dpkg) lock.
      This is typically a transient issue when some other process is interacting with the package manager. Try to uninstall the VM extension again.

  • Windows

    • The uninstall did not complete in time and was killed.
      This is typically a transient issue when the VM is resource constrained. Try to uninstall the VM extension again when the VM has a lower CPU/Memory usage.
    • C:\Program Files\Microsoft Dependency Agent\Uninstall_version.exe non-zero exit code n.
      Log onto the system with administrator privileges and run the uninstaller interactively and address any reported issues. Do the VM extension uninstall again to complete the process.
    • PowerShell Exit Status = n and there is no other error message.
      Log onto the system with administrator privileges. Locate the program named C:\Program Files\Microsoft Dependency Agent\Uninstall_<version>.exe, where version is a four part version number. Run it interactively and address any reported issues. Do the VM extension uninstall again to complete the process.

Agent reinstalls automatically
Review policies, automation pipelines, and ARM templates to ensure the Dependency Agent isn't included in deployment scripts.

Permission Issues
Make sure your Azure account has sufficient rights to remove extensions from virtual machine or virtual machine scale set resources.

Related content

  • Last updated on