Migration guidance from Change Tracking and inventory using Log Analytics to Change Tracking and inventory using Azure Monitoring Agent version

Applies to: ✔️ Windows VMs ✔️ Linux VMs ✔️ Azure Arc-enabled servers.

This article provides guidance to move from Change Tracking and Inventory using Log Analytics (LA) version to the Azure Monitoring Agent (AMA) version.

Using the Azure portal, you can migrate from Change Tracking & Inventory with LA agent to Change Tracking & Inventory with AMA and there are two ways to do this migration:

• Migrate single/multiple VMs from the Virtual Machines page.
• Migrate multiples VMs on LA version solution within a particular Automation Account.

Note

File Integrity Monitoring (FIM) using Microsoft Defender for Endpoint (MDE) is now currently available. Follow the guidance to migrate from:

• FIM with Change Tracking and Inventory using AMA.
• FIM with Change Tracking and Inventory using MMA.

Onboarding to Change tracking and inventory using Azure Monitoring Agent

Single Azure VM - Azure portal

To onboard through Azure portal, follow these steps:

1. Sign in to the Azure portal and select your virtual machine

2. Under Operations , select Change tracking.

3. Select Configure with AMA and in the Configure with Azure monitor agent, provide the Log analytics workspace and select Migrate to initiate the deployment.

   

4. Select Switch to CT&I with AMA to evaluate the incoming events and logs across LA agent and AMA version.

   

Automation account - Azure portal

1. Sign in to Azure portal and select your Automation account.

2. Under Configuration Management, select Change tracking and then select Configure with AMA.

   

3. On the Onboarding to Change Tracking with Azure Monitoring page, you can view your automation account and list of both Azure and Azure Arc machines that are currently on Log Analytics and ready to be onboarded to Azure Monitoring Agent of Change Tracking and inventory.

   

4. On the Assess virtual machines tab, select the machines and then select Next.

5. On Assign workspace tab, assign a new Log Analytics workspace resource ID to which the settings of AMA based solution should be stored and select Next.

   

6. On Review tab, you can review the machines that are being onboarded and the new workspace.

7. Select Migrate to initiate the deployment.

8. After a successful migration, select Switch to CT&I with AMA to compare both the LA and AMA experience.

   

Single Azure Arc VM - Azure portal

1. Sign in to the Azure portal. Search for and select Machines-Azure Arc.

   

2. Select the specific Arc machine with Change Tracking V1 enabled that needs to be migrated to Change Tracking V2.

3. Select Migrate to Change Tracking with AMA and in the Configure with Azure monitor agent, provide the resource id in the Log analytics workspace and select Migrate to initiate the deployment.

   

4. Select Manage Activity log connection to evaluate the incoming events and logs across LA agent and AMA version.

Arc-enabled VMs - PowerShell script

To onboard Arc-enabled VMs, follow the steps:

Prerequisites

• Ensure you have PowerShell installed. The latest version of PowerShell 7 or higher is recommended. Follow the steps to Install PowerShell on Windows, Linux, and macOS.
• Obtain Read access for the specified workspace resources.
• Install the latest version of the Az PowerShell module. The Az.Accounts and Az.OperationalInsights modules are required to pull workspace agent configuration information.
• Ensure you have Azure credentials to run Connect-AzAccount and Select-AzContext which set the script's context. Follow these steps to migrate using scripts.

Migration guidance

1. Install the script and run it to conduct migrations. The script does the following:

   1. It ensures the new workspace resource ID is different from the one associated with the Change Tracking and Inventory using the LA version.

   2. It migrates the settings for the following data types:

      • Windows Services
      • Linux Files
      • Windows Files
      • Windows Registry
      • Linux Daemons

   3. The script consists of the following Parameters that require an input from you.

   Parameter	Required	Description
   InputWorkspaceResourceId	Yes	Resource ID of the workspace associated with Change Tracking & Inventory with Log Analytics.
   OutputWorkspaceResourceId	Yes	Resource ID of the workspace associated with Change Tracking & Inventory with Azure Monitoring Agent.
   OutputDCRName	Yes	Custom name of the new DCR created.
   OutputDCRLocation	Yes	Azure location of the output workspace ID.
   OutputDCRTemplateFolderPath	Yes	Folder path where DCR templates are created.

2. A DCR template is generated when you run the above script and the template is available in OutputDCRTemplateFolderPath. You have to associate the new DCR to transfer the settings to the Change Tracking and Inventory using AMA.

   1. Sign in to Azure portal and go to Monitor and under Settings, select Data Collection Rules.
   2. Select the data collection rule that you have created in Step 1 from the listing page.
   3. In the data collection rule page, under Configurations, select Resources and then select Add.
   4. In the Select a scope, from Resource types, select Machines-Azure Arc that is connected to the subscription and then select Apply to associate the ctdcr created in Step 1 to the Arc-enabled machine and it will also install the Azure Monitoring Agent extension. For more information, see Enable Change Tracking and Inventory - for Arc-enabled VMs - using portal/CLI.

   Install the Change Tracking extension as per the OS type for the Arc-enabled VM.

   Linux

   az connectedmachine extension create  --name ChangeTracking-Linux  --publisher Microsoft.Azure.ChangeTrackingAndInventory --type-handler-version 2.20  --type ChangeTracking-Linux  --machine-name XYZ --resource-group XYZ-RG  --location X --enable-auto-upgrade
   

   Windows

   az connectedmachine extension create  --name ChangeTracking-Windows  --publisher Microsoft.Azure.ChangeTrackingAndInventory --type-handler-version 2.20  --type ChangeTracking-Windows  --machine-name XYZ --resource-group XYZ-RG  --location X --enable-auto-upgrade
   

   If the CT logs table schema does not exist, the script mentioned in Step 1 will fail. To troubleshoot, run the following script -

   
   $psWorkspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName $resourceGroup -Name $laws
     # Enabling CT solution on LA ws
     New-AzMonitorLogAnalyticsSolution -Type ChangeTracking -ResourceGroupName $resourceGroup -Location $psWorkspace.Location -WorkspaceResourceId $psWorkspace.ResourceId
   

Compare data across Log analytics Agent and Azure Monitoring Agent version

After you complete the onboarding to Change tracking with AMA version, select Switch to CT with AMA on the landing page to switch across the two versions and compare the following events.

For example, if the onboarding to AMA version of service takes place after 3rd November at 6:00 a.m. You can compare the data by keeping consistent filters across parameters like Change Types, Time Range. You can compare incoming logs in Changes section and in the graphical section to be assured on data consistency.

Note

You must compare for the incoming data and logs after the onboarding to AMA version is done.

Obtain Log Analytics Workspace Resource ID

To obtain the Log Analytics Workspace resource ID, follow these steps:

1. Sign in to Azure portal

2. In Log Analytics Workspace, select the specific workspace and select Json View.

3. Copy the Resource ID.

   

Limitations

Using Azure portal

For single VM and Automation Account

1. 100 VMs per Automation Account can be migrated in one instance.
2. Any VM with > 100 file/registry settings for migration via portal isn't supported now.
3. Arc VM migration isn't supported with portal, we recommend that you use PowerShell script migration.
4. For File Content changes-based settings, you have to migrate manually from LA version to AMA version of Change Tracking & Inventory. Follow the guidance listed in Track file contents.
5. Alerts that you configure using the Log Analytics Workspace must be manually configured.

Using PowerShell script

1. For File Content changes-based settings, you must migrate manually from LA version to AMA version of Change Tracking & Inventory. Follow the guidance listed in Track file contents.
2. Any VM with > 100 file/registry settings for migration via Azure portal isn't supported.
3. Alerts that you configure using the Log Analytics Workspace must be manually configured.

Disable Change tracking using Log Analytics Agent

After you enable management of your virtual machines using Change Tracking and Inventory using Azure Monitoring Agent, you might decide to stop using Change Tracking & Inventory with LA agent version and remove the configuration from the account.

The disable method incorporates the following:

• Removes change tracking with LA agent for selected few VMs within Log Analytics Workspace.
• Removes change tracking with LA agent from the entire Log Analytics Workspace.

Next steps

• To enable from the Azure portal, see Enable Change Tracking and Inventory from the Azure portal.