Edit

Migrate to Azure Monitor Agent from Log Analytics agent

  • Article
  • 4 minutes to read

Azure Monitor Agent (AMA) replaces the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines, in both Azure and non-Azure (on-premises and third-party clouds) environments. It introduces a simplified, flexible method of configuring collection configuration called data collection rules (DCRs). This article outlines the benefits of migrating to Azure Monitor Agent and provides guidance on how to implement a successful migration.

Important

The Log Analytics agent will be retired on August 31, 2024. If you're currently using the Log Analytics agent with Azure Monitor or other supported features and services, you should start planning your migration to Azure Monitor Agent by using the information in this article.

Benefits

In addition to consolidating and improving upon legacy Log Analytics agents, Azure Monitor Agent provides additional immediate benefits for cost savings, simplified management experience, security and performance. Learn more about these benefits

Migration guidance

Before you begin

  1. Review and follow the prerequisites for use with Azure Monitor Agent.
    • For non-Azure and on premises servers, installing the Azure Arc agent is required though it's not mandatory to use Azure Arc for management overall. As such, this should incur no additional cost for Arc.
  2. Service (legacy Solutions) requirements - The legacy Log Analytics agents are used by various Azure services to collect required data. If you're not using any additional Azure service, you may skip this step altogether.
    • Use the AMA Migration Helper to discover solutions enabled on your workspace(s) that use the legacy agents, including the per-solution migration recommendation1 shown under Workspace overview tab.
    • If you use Microsoft Sentinel, see Gap analysis for Microsoft Sentinel for a comparison of the extra data collected by Microsoft Sentinel.
  3. Agent coexistence:
    • If you're setting up a new environment with resources, such as deployment scripts and onboarding templates, install Azure Monitor Agent together with a legacy agent in your new environment to decrease the migration effort later.
    • Azure Monitor Agent can run alongside the legacy Log Analytics agents on the same machine so that you can continue to use existing functionality during evaluation or migration. You can begin the transition, but ensure you understand the limitations below:
      • Be careful when you collect duplicate data from the same machine, as this could skew query results, affect downstream features like alerts, dashboards, workbooks and generate more charges for data ingestion and retention. To avoid data duplication, ensure the agents are collecting data from different machines or sending the data to different destinations. Additionally,
      • Running two telemetry agents on the same machine consumes double the resources, including but not limited to CPU, memory, storage space, and network bandwidth.

1 Start testing your scenarios during the preview phase. This will save time, avoid surprises later and ensure you're ready to deploy to production as soon as the service becomes generally available. Moreover you benefit from added security and reduced cost immediately.

Migration steps

Flow diagram that shows the steps involved in agent migration and how the migration tools help in generating DCRs and tracking the entire migration process.

  1. Create data collection rules. You can use the DCR generator1 to automatically convert your legacy agent configuration into data collection rule templates. Review the generated rules before you create them, to leverage benefits like filtering, granular targeting (per machine), and other optimizations.

  2. Deploy extensions and DCR-associations:

    1. Test first by deploying extensions2 and DCR-Associations on a few non-production machines. You can also deploy side-by-side on machines running legacy agents (see the section above for agent coexistence
    2. Once data starts flowing via Azure Monitor agent, compare it with legacy agent data to ensure there are no gaps. You can do this by joining with the Category column in the Heartbeat table which indicates 'Azure Monitor Agent' for the new data collection
    3. Post testing, you can roll out broadly3 using built-in policies for at-scale deployment of extensions and DCR-associations. Using policy will also ensure automatic deployment of extensions and DCR-associations for any new machines in future.
    4. Use the AMA Migration Helper to monitor the at-scale migration across your machines

  3. Validate that Azure Monitor Agent is collecting data as expected and all downstream dependencies, such as dashboards, alerts, and workbooks, function properly.

  4. Clean up: After you confirm that Azure Monitor Agent is collecting data properly, you may choose to either disable or uninstall the legacy Log Analytics agents

    1. If you have migrated to Azure Monitor agent for selected features/solutions and you need to continue using the legacy Log Analytics for others, you can
    2. If you've migrated to Azure Monitor agent for all your requirements, you may uninstall the Log Analytics agent from monitored resources. Clean up any configuration files, workspace keys, or certificates that were used previously by the Log Analytics agent.
    3. Don't uninstall the legacy agent if you need to use it for uploading data to System Center Operations Manager.

1 The DCR generator only converts the configurations for Windows event logs, Linux syslog and performance counters. Support for additional features and solutions will be available soon
2 In addition to the Azure Monitor agent extension, you need to deploy additional extensions required for specific solutions. See other extensions to be installed here
3 Before you deploy a large number of agents, consider configuring the workspace to disable data collection for the Log Analytics agent. If you leave data collection for the Log Analytics agent enabled, you might collect duplicate data and increase your costs. You might choose to collect duplicate data for a short period during migration until you verify that you've deployed and configured Azure Monitor Agent correctly.

Next steps

For more information, see: