Edit

Install and manage the Azure Monitor Agent

This article describes the different methods you can use to install, uninstall, update, and configure the Azure Monitor Agent on Azure virtual machines, virtual machine scale sets, and Azure Arc-enabled servers.

Prerequisites

For prerequisites and other requirements for using the Azure Monitor Agent, see these articles:

Important

If the agent connects to the Log Analytics workspace by using Azure private link, see Enable private link for monitoring virtual machines and Kubernetes clusters in Azure Monitor.

Important

You don't need to restart the machine when you install, upgrade, or uninstall the Azure Monitor Agent.

Installation options

The following table lists the options for installing the Azure Monitor Agent on Azure VMs and Azure Arc-enabled servers.

For any machine that isn't in Azure, you must install the Azure Arc agent on the machine before you can install the Azure Monitor Agent.

Installation method Description
Virtual machine (VM) extension Use any of the methods described in this article to install the agent via the Azure extension framework. This method doesn't create a data collection rule (DCR), so you must create at least one DCR and associate it with the agent before data collection begins.
Create a DCR When you create a DCR in the Azure portal, the Azure Monitor Agent is installed on any machine that's added as a resource for the DCR. The agent immediately begins to collect data as defined in the DCR.
VM insights When you enable VM insights on a machine, the Azure Monitor Agent is installed and a DCR is created to collect a predefined set of data. You shouldn't modify this DCR, but you can create more DCRs to collect more data.
Container insights When you enable collection of Prometheus metrics or container logs on a Kubernetes cluster, a containerized version of the Azure Monitor Agent is installed in the cluster and a DCR is created to immediately begin collecting data. You can modify the DCR by using the guidance in Configure data collection and cost optimization in Container insights by using DCRs.
Client installer Install the agent by using a Windows MSI installer for Windows 11 and Windows 10 clients.
Azure Policy Use Azure Policy to automatically install the agent on Azure virtual machines and Azure Arc-enabled servers, and to automatically associate them with required DCRs.

Note

  • To send data across tenants, you must first enable Azure Lighthouse.

  • Cloning a machine that has Azure Monitor Agent installed isn't supported. The best practice for this scenario is to use Azure Policy or an infrastructure as a code (IaaC) tool to deploy the Azure Monitor Agent at scale.

The following table summarizes which methods are available for each Azure Monitor Agent operation:

Operation Azure portal Azure PowerShell Azure CLI Resource Manager template
Install
Verify
Uninstall
Update
Configure agent settings (preview)

Install the agent extension

To install the agent and create a DCR to collect data by using the Azure portal, use the guidance in Collect data by using the Azure Monitor Agent.

Verify installation

After you install the Azure Monitor Agent, verify that the agent is running and sending data to your Log Analytics workspace.

Check extension status in the Azure portal

  1. Go to your virtual machine or Azure Arc-enabled server in the Azure portal.
  2. Select Extensions + applications (or Extensions for Arc-enabled servers).
  3. Confirm that AzureMonitorWindowsAgent or AzureMonitorLinuxAgent is listed with a status of Provisioning succeeded.

Check extension status with Azure CLI

Run the following command to list installed extensions and verify that the Azure Monitor Agent extension is present and provisioned:

az vm extension list --resource-group <resource-group-name> --vm-name <virtual-machine-name> --output table

For Azure Arc-enabled servers, use:

az connectedmachine extension list --resource-group <resource-group-name> --machine-name <arc-server-name> --output table

Verify data collection with a Heartbeat query

Query the Heartbeat table in your Log Analytics workspace to confirm the Azure Monitor Agent is sending heartbeat data. In Log Analytics, run:

Heartbeat
| where Category == "Azure Monitor Agent"
| where TimeGenerated > ago(5m)
| project Computer, TimeGenerated, Category, OSType
| order by TimeGenerated desc

If the query returns results, the Azure Monitor Agent is successfully installed and sending data to the workspace.

Note

It can take several minutes after installation for the first heartbeat data to appear. If you don't see results, verify that a data collection rule is associated with the machine.

Uninstall

To uninstall the Azure Monitor Agent by using the Azure portal, go to your virtual machine, scale set, or Azure Arc-enabled server. Select the Extensions tab, and then select AzureMonitorWindowsAgent or AzureMonitorLinuxAgent. In the dialog that opens, select Uninstall.

Update

Note

Always update to the latest version of the agent or opt in to automatic extension upgrade.

Automatic extension rollout follows standard Azure deployment practices to safely deploy the latest version of the agent. Automatic updates take weeks to roll out the latest version.

Upgrades are issued in batches, so some of your virtual machines, scale sets, or Azure Arc-enabled servers might be upgraded before others.

If you need to upgrade an extension immediately, use the manual instructions described in this article. Only agents released in the past year are supported.

To update the agent, go to your virtual machine or scale set. Select the Extensions tab, check the agent, and select Update.

Enable automatic update of the agent by enabling automatic extension upgrade. Go to your virtual machine or scale set, select the Extensions tab, and then select AzureMonitorWindowsAgent or AzureMonitorLinuxAgent. In the dialog that opens, select Enable automatic upgrade.

Configure agent settings (preview)

Data collection rules (DCRs) manage the Azure Monitor Agent on your machine. Use the AgentSettings DCR to configure certain Azure Monitor Agent parameters to match your specific monitoring needs.

Note

Important considerations when you work with the AgentSettings DCR:

  • Currently, you can configure the AgentSettings DCR only by using an Azure Resource Manager template.
  • AgentSettings must be a single DCR with no other settings.
  • The virtual machine and the AgentSettings DCR must be in the same region.

Supported parameters

The AgentSettings DCR currently supports setting the following parameters:

Parameter Description Valid values
MaxDiskQuotaInMB To provide resiliency, the agent collects data in a local cache when the agent can't send data. The agent sends the data in the cache after the connection is restored. This parameter is the amount of disk space used (in MB) by the Azure Monitor Agent log files and cache. Linux: 4,000 to 1,000,000 default: 10,000
Windows: 4,000 to 1,000,000
UseTimeReceivedForForwardedEvents Changes the WEF column in the Microsoft Sentinel Windows Event Forwarding (WEF) table to use TimeReceived instead of TimeGenerated data 0 or 1

Set up the AgentSettings DCR

Currently not supported.

Create a data collection rule to collect data from the agent and send it to Azure Monitor.