Got 1 Linux Computers Connected via Log Analytics Linux agnet (legacy) after clean uninstall Azure Arc Machines

Question

I got trouble when want to clean uninstall Arc Machine in Ubuntu 22 because when i run troubleshoot while finised installed omsagent it says it's not support in Ubuntu 22.

So i want to make another machine with ubuntu 20, i'm running command for uninstall omsagent and AzureMonitorAgent with this code

sudo sh onboard_agent.sh --purge for uninstall omsagent and azcmagent disconnect for uninstall AMA. But unfortunately i got bug cache while i check in Log-Analytics-Workspaces it says 1 Linux computers connected via Log Analytics Linux agent (legacy) and when i check Data Connector still too much connected status (Syslog via AMA, Syslog via Legacy Agent, and CEF via Legacy Agent) i don't understand how to solve it. because i don't have machine in my azure sentinel. Also i already delete all Data Collection Rules and Data Collection Endpoints who integrated with this Data Connectors.

All i need is all this Data Connectors 100% Disconnected so i can focus in my new server machine with Ubuntu 20 OS.

Answer 1

@zake

I understand that you are trying to remove an Ubuntu 22.04 VM from Log Analytics. It also seems that this is the only computer connected to Log Analytics, if so it might be easiest to just create a new Log Analytics Account. If that is not an option please try this to clear the configuration:

sudo /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable && sudo rm /etc/opt/omi/conf/omsconfig/configuration/Current.mof* /etc/opt/omi/conf/omsconfig/configuration/Pending.mof*

The view in the Log Analytics Workspace --> Agents Management --> Machines, gets refreshed every 24 hours, so please wait for this machine to show disconnected.

The data in Log Analytics works on the basis of a first in first out scenario. This data doesn't get deleted when you uninstall an agent, but only under two circumstance.

The table or workspace retention period has passed https://learn.microsoft.com/en-us/azure/azure-monitor/platform/manage-cost-storage#default-retention The data has been purged via the API https://learn.microsoft.com/en-us/rest/api/loganalytics/workspacepurge/purge

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!