Tutorial: Change a workspace and configure data collection rule

Applies to: ✔️ Windows VMs ✔️ Linux VMs ✔️ Windows Registry ✔️ Windows Files ✔️ Linux Files ✔️ Windows Software

This tutorial describes how to change a workspace and configure data collection rule.

Prerequisites

Before you change a workspace for your virtual machine and configure data collection rule, ensure you've enabled Change Tracking and Inventory on your VM using a data collection rule (DCR). For detailed information on how you can create a Data Collection Rule (DCR), see Create DCR.

Configure Windows, Linux files, and Windows Registry using Data Collection Rules

To configure Windows, Linux files, and Windows Registry using Data Collection Rules, follow these steps:

1. Sign in to the Azure portal and select the virtual machine.

   

2. Select a specific VM for which you would like to configure the Change tracking settings.

3. Under Operations, select Change tracking to view all the changes that have taken place on the VM.

   

4. Select Settings to view the Data Collection Rule Configuration (DCR) pane. Here, you can do the following actions:

   1. Configure changes on a VM at a granular level.
   2. Select the filter to configure the workspace.
   3. Use the filter to view all the DCRs that are configured to the specific LA workspace level.

   Note

   The settings that you configure apply to all virtual machines associated with the specified DCR. For more information about DCR, see Data collection rules in Azure Monitor.

5. Select + Add to configure new file settings. Use the procedure as specified for Windows, Linux files, and Windows Registry.

   

Windows Files

On the Windows Files tab > Select + Add > Add windows file setting pane, enter the information for the file or folder to track and select Add. The following table describes the properties that you can use to enter the information.

Property	Description
Enabled	True if the setting is applied, and false otherwise.
Item Name	Friendly name of the file to be tracked.
Group	A group name to group files logically
Path	The path to check for the file, for example, c:\temp*.txt. You can also use environment variables, such as %winDir%\System32\*.*.
Path Type	The type of path. Possible values are File and Folder.
Recursion	True if recursion is used when looking for the item to be tracked, and False otherwise.

Linux Files

On the Linux Files tab > Select + Add > Add Linux file setting pane, enter the information for the file or directory to track, and then select Add. The following table describes the properties that you can use to enter the information.

Property	Description
Enabled	True if the setting is applied, and false otherwise.
Item Name	Friendly name of the file to be tracked.
Group	A group name to group files logically
Path	The path to check for the file, for example, /etc/*.conf.
Path Type	The type of path. Possible values are File and Folder.
Recursion	True if recursion is used when looking for the item to be tracked, and False otherwise.

Windows Registry

On the Windows Registry tab > Select + Add > Add Windows registry setting pane, enter the information for the registry key to track, and then select Add. The following table describes the properties that you can use to enter the information.

Property	Description
Enabled	True if the setting is applied, and false otherwise.
Item Name	Friendly name of the registry key to be tracked.
Group	A group name to group keys logically
Windows Registry Key	The name of the Windows registry key.

You can now view the virtual machines configured to the DCR from the Data collection rules pane in the Azure portal.

Configure file content changes

To configure file content changes, follow these steps:

1. In your virtual machine, under Operations, select Change tracking > Settings.

2. On the Data Collection Rule Configuration pane, select the File Content tab > Link to link the storage account.

   

3. On the Content Location for Change Tracking pane, select your Subscription and Storage account to be used for file content change tracking.

4. Confirm if you are using System Assigned Managed Identity.

5. Select Upload file content for all settings, and then select Save to ensure that the file content changes for all the files residing in this DCR are tracked.

System Assigned Managed Identity

When the storage account is linked using the system assigned managed identity, a blob is created. For system-assigned managed identity, follow these steps:

1. Sign in to the Azure portal, go to Storage accounts, and select the storage account.

2. On the Storage accounts pane, under Data storage, select Containers > Changetracking blob > Access Control (IAM).

3. On the Changetrackingblob | Access Control (IAM) pane, select Add and, then select Add role assignment.

   

4. On the Add role assignment pane, use the search for Blob Data contributor to assign a storage Blob contributor role for the specific VM. This permission provides access to read, write, and delete storage blob containers and data.

   

5. Select the role and assign it to your virtual machine.

   

User Assigned Managed Identity

For user-assigned managed identity, follow these steps to assign the user assigned managed identity to the VM and provide the permission.

1. On the Storage accounts pane, under Data storage, select Containers > Changetracking blob > Access Control (IAM).

2. On Changetrackingblob | Access Control (IAM) pane, select Add, and then select Add role assignment.

3. Search for Storage Blob Data Contributor, select the role and assign it to your user-assigned managed identity.

   

4. Go to your virtual machine, under Settings, select Identity. Under the User assigned tab, select + Add.

5. In the Add user assigned managed identity, select the Subscription and add the user-assigned managed identity.

Upgrade the extension version for Windows and Linux

Note

Ensure that ChangeTracking-Linux/ ChangeTracking-Windows extension version is upgraded to the current general release version: GA Extension Version

Use the following command to upgrade the extension version:

az vm extension set -n {ExtensionName} --publisher Microsoft.Azure.ChangeTrackingAndInventory --ids {VirtualMachineResourceId} 

The extension for Windows is Vms - ChangeTracking-Windowsand for Linux is Vms - ChangeTracking-Linux.

Configure using wildcards

To configure the monitoring of files and folders using wildcards, consider the following:

• Wildcards are required for tracking multiple files.
• Wildcards can only be used in the last segment of a path, such as C:\folder\file or /etc/.conf*
• If an environment variable includes a path that is not valid, validation will succeed but the path will fail when inventory runs.
• When setting the path, avoid general paths such as *C: * which will result in too many folders being traversed.

Next steps

To enable Azure Change Tracking and Inventory (CTI) from the Azure portal, see Quickstart: Enable Azure Change Tracking and Inventory.