Azure Monitoring Agent settings

Question

Azure Monitoring Agent settings

RobertAzure 0

Hi Guys!

There is a VM with the "Azure Monitoring Agent" extension enabled.

I have many "Log Analytics" instances and I don't know which one the Azure Monitoring Agent is using (of course I can go through all the Log Analytics instances manually and find where the agent is being used).

Where can I see which Log Analytics the Azure Monitoring Agent is using?

3 answers

Your answer

Answer 1

JimmySalian-2011 42,491

@RobertAzure Microsoft Monitoring Agent appears in Control Panel. To confirm it is reporting to Log Analytics, review the agent configuration.

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard#verify-agent-connectivity-to-azure-monitor

Hope this helps.

JS

==

Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.

RobertAzure 0 Reputation points

2023-03-08T23:30:32.6566667+00:00

Hi @JimmySalian-2011

Thanks for your reply

When I install the Log Analytics agent for Windows (legacy), actually the Microsoft Monitoring Agent appears in the Control Panel.

But if I create a Data collection rule and installed the Windows Azure Monitor agent, it does not appear in the Control Panel...

Answer 2

David Broggy 6,291 MVP Volunteer Moderator

Hi Robert,

If I may add, this kql query may show you where your AMA agents are installed, as well as any other related agents.

Typically if you deploy AMA it's with ARC, if it's an on-prem server.

But even if it's in Azure, the agents report back to a log analytics workspace, so the information you need should be queryable via kql.

https://www.kaidojarvemets.com/kql-query-who-removed-azure-monitor-agent-extension/

RobertAzure 0 Reputation points

2023-03-08T23:43:48+00:00

Hi @David Broggy

Thanks for your reply

1.

If I run a query in Log Analytics, then I look for information in it, but that's the issue, I don't know which Log Analytics I need :)

2.

I couldn't run the query because I don't have an AzureActivity table in Log Analytics

Log Analytics workspace -> Logs

please correct me if I ran the query in the wrong place :)
David Broggy 6,291 Reputation points MVP Volunteer Moderator

2023-03-09T01:20:05.57+00:00

Hi Robert,

I may be a bit spoiled because I usually use Sentinel to set up my data connectors.

If you don't use Sentinel then you need to go to Azure Logs > Diagnostic Settings > [your log analytics workspace] > + Add diagnostic setting - check off the audit box(es) and check off Log Analytics workspace as the destination.
That should create the required table however since your agents are already deployed your logs won't be here.
You'll have to depend on the Azure Activity logs which are harder to search, and the data you're looking for may have already expired.

If you're stuck using the Azure Activity logs I'd download them all as CSV and try to search that way.
I think you're looking for logs with the operation name like "Install or Update an Azure Arc extensions"
David Broggy 6,291 Reputation points MVP Volunteer Moderator

2023-03-09T01:35:22.52+00:00

There's also a Heartbeat table and I see on my tenant if you just type "Heartbeat", there's a Category column that shows 'Azure Monitor Agent' and the agent Version.
RobertAzure 0 Reputation points

2023-03-09T15:46:22.5033333+00:00

I can find VMs in Log Analytics, the problem is that I have a lot of them, and I need to go into each to find VM

I thought that in the Azure Monitor Agent settings I can find which Log Analytics it uses

Answer 3

Ryan Hill 30,281 Microsoft Employee Moderator

Try looking under Solutions in the portal or use az monitor log-analytics solution list. Once you click on an appropriate solution, you can hit the Virtual Machines blade and see the associated VMs. The Log Analytics workspace will be in ().

EDIT 20 March 2023

Use the following CLI command az monitor data-collection rule association list and let me know if that works. You should also be able to find the Data Collection Rule the VM was added to and check the Data Source > Destination on it.

RobertAzure 0 Reputation points

2023-03-12T02:38:04.73+00:00

Hi Ryan,

My "Solutions" is empty

Through the command line is also empty :( ...
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2023-03-14T18:47:33.2+00:00

Apologies for the delayed response @RobertAzure . Allow me to follow up with and get back with you.
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2023-03-21T00:18:04.7266667+00:00

Hey @RobertAzure I've updated my response above. Let me know if that helps.

Share via

Azure Monitoring Agent settings

3 answers

Your answer