Review : Agent Installation/Policy In Azure Landscape

Ananthu Subramanian 0

I would like to review, get suggestions on one of the solutions which we had for running script/installing agent in a huge number of subscriptions.

Runbook which loops over subscriptions and get VM details and then create a webhook to another runbook -> Another runbook which will actually run the script -> Monitor Logs from Log Analytics

1 answer

tbgangav-MSFT 10,386 Reputation points

2023-03-06T03:25:35.7866667+00:00
Hi @Ananthu Subramanian ,

Can you provide little more context.

Is your requirement to run a script (which installs an agent) remotely in set of VM's over different subscriptions?

What is the agent about? Wanted to know it to see if there are any direct approaches to accomplish the requirement.

What VM details are you getting and why?

What is the reason to create webhook to another runbook?

If your requirement is to run a script (which installs an agent) remotely then may be follow one of the approaches explained here https://learn.microsoft.com/en-us/answers/questions/526820/azure-automation-running-power-shell-scripts-in-ru. Also, same runbook can be improved to work for multiple VM's across subscriptions using for loops.
Please sign in to rate this answer.
Ananthu Subramanian 0 Reputation points

2023-03-06T03:25:55.8+00:00

Hi @tbgangav-MSFT ,

Good Day, Thanks for the reply. Below are the details.

Is your requirement to run a script (which installs an agent) remotely in set of VM's over different subscriptions?
Yup, In this case we would like to run a script remotely over different subscription.

What is the agent about? Wanted to know it to see if there are any direct approaches to accomplish the requirement. BigFix is the agent.

What VM details are you getting and why? VM resource group and the subscription context which we need to pass on Invoke-RunVM

What is the reason to create webhook to another runbook? Because the runbook times out after 2 hrs. even if I did for loop in parallel in PowerShell {We have lot of servers and subscriptions} The 2-runbook strategy worked for about 50-60 subscriptions. Would like to know if any other solutions we have?

ForEach ($Subscription in $Subscriptions) { echo "Running in Subscription" echo $Subscription.Name Get-AzSubscription -SubscriptionName $Subscription.Name | Set-AzContext #Get all VMs under a subscription $vms = Get-AzVM #Parallely run installation in VMs $vms | ForEach-Object -Parallel {

tbgangav-MSFT 10,386 Reputation points

2023-03-06T03:41:57.92+00:00

Hi @Ananthu Subramanian ,

Great! Then I believe the solution you have in place now is reliable, efficient and extensible however if bigfix agent configuration can be sent as DSC configuration then there is scope of another solution using Azure DSC (https://learn.microsoft.com/en-us/azure/automation/automation-dsc-overview). If possible, try to do a proof of concept and validate the performance of this new solution from the lens of reliability, efficiency, extensibility, cost optimization, maintenance or adminstration, etc.

Ruben Garcia 0 Reputation points

2023-03-15T12:54:38.1733333+00:00

Hi @tbgangav-MSFT Could you give me your opinion on this approach?

The installation of the agent now is done from a policy so that the runbook does not timeout.

The runbook only takes care of assigning the policy (and doing some extra checking steps).

(not clear yet) The execution state of the policy (for logging) is monitored from an azure function, from what I've seen I can add PolicyStateChanges to an eventgrid and monitor it.

Is this third step a viable solution?

tbgangav-MSFT 10,386 Reputation points

2023-03-16T11:58:57.8+00:00

Hi @Ruben Garcia,

Assuming your requirement is also to install agent on multiple VM's and then monitor logs from Log Analytics.

If step 2 is based on a runbook then why don't you have step 3 also with another runbook, may be a child runbook of the runbook mentioned in step 2.

That child runbook can leverage cmdlets of this / this modules and then forward Azure Automation logs to Log Analytics as explained here.
Sign in to comment