Migrate from Log Analytics agent to Azure Monitor Agent

Azure Monitor Agent (AMA) replaces the Log Analytics agent, also known as Microsoft Monitoring Agent (MMA) and Operations Management Suite (OMS), for Windows and Linux machines in Azure, non-Azure, on-premises, and other cloud environments. Azure Monitor Agent uses data collection rules (DCRs) to configure data collection, which is simpler and more flexible than the workspace-based configuration the Log Analytics agent uses.

This article walks you through the end-to-end migration process from the Log Analytics agent to Azure Monitor Agent:

1. Assess your current environment (agents, workspaces, and dependent services).
2. Configure and deploy Azure Monitor Agent with data collection rules.
3. Validate that data collection works correctly.
4. Remove the Log Analytics agent from your machines.

Prerequisites

• Review the prerequisites for installing Azure Monitor Agent.
• For non-Azure and on-premises servers, install the Azure Arc Connected Machine agent. The Azure Arc agent makes your on-premises servers visible to Azure as targetable resources at no extra cost.
• Verify that you have the required permissions to install Azure Monitor Agent on the target machines.
• Confirm that Azure Monitor Agent supports your data collection requirements. Azure Monitor Agent is generally available (GA) for data collection, and various Azure Monitor features and Azure services use it.

Migration tools

Two tools help you throughout the migration process:

Assess your current agent deployment

Before you start migrating, inventory your current Log Analytics agent deployment. The Azure Monitor Agent Migration Helper workbook helps you answer these questions:

Audit workspaces and solutions

Review your Log Analytics workspaces to understand which ones actively receive data and which solutions you configured. Migration is a good opportunity to consolidate unused workspaces.

The Migration Helper workbook shows which workspaces you have, which solutions you implemented, and when you last used each solution. Each solution includes a migration recommendation.

You can also use the Azure Monitor Workspace Auditing workbook for detailed workspace analysis. To set up this workbook, copy it from the GitHub repository and import it into your Log Analytics workspace. This workbook shows:

• All data sources sending data to the workspace.
• Agents sending heartbeats to the workspace.
• Resources sending data to the workspace.
• Application Insights resources sending data to the workspace.

Identify dependent services

Before migrating, determine which services depend on the Log Analytics agent and plan their migration path.

Configure data collection rules and deploy Azure Monitor Agent

Follow these steps to set up Azure Monitor Agent with data collection rules:

1. Identify a pilot group. Select a small group of servers to validate data collection before deploying at scale.

2. Generate data collection rules. Use the DCR Config Generator to convert your existing workspace-based data collection configuration into data collection rules. Deploy the generated rules to your pilot group.

3. Migrate VM insights. If you use VM insights (Azure Monitor for Virtual Machines), migrate VM insights to Azure Monitor Agent for the pilot group.

4. Disable Log Analytics agent data collection during testing. To avoid double ingestion, remove the workspace configurations for the Log Analytics agent on pilot servers without uninstalling the Log Analytics agent. For more information, see Configure data sources for the Log Analytics agent.

5. Deploy at scale by using Azure Policy. Use built-in policies to deploy Azure Monitor Agent extensions and data collection rule associations at scale. Azure Policy also automatically deploys to new machines. For more information, see Use Azure Policy to install and manage the Azure Monitor Agent.

Validate Azure Monitor Agent data collection

After deploying Azure Monitor Agent to your pilot group, verify that data collection works correctly before expanding the deployment:

1. Compare ingested data. Run KQL queries against your Log Analytics workspace to compare the data ingested by the Log Analytics agent with data ingested by Azure Monitor Agent. For example, query the Heartbeat table and filter by Category to confirm Azure Monitor Agent heartbeats are arriving.

2. Check for data gaps. Verify that Azure Monitor Agent collects all expected data types (performance counters, Windows events, Syslog, custom logs). Compare record counts and data types between the two agents over the same time period.

3. Validate dependent services. Confirm that services like Microsoft Defender for Cloud, Microsoft Sentinel, and Change Tracking continue to function correctly with Azure Monitor Agent.

After validation succeeds, expand the Azure Monitor Agent deployment to the rest of your environment.

Remove the Log Analytics agent

After you validate that Azure Monitor Agent is collecting data correctly across your environment, remove the Log Analytics agent to avoid duplicate data collection.

• At scale: Use the MMA Discovery and Removal tool to remove the Log Analytics agent from machines across your environment.
• SCOM exception: If you use System Center Operations Manager, keep the Log Analytics agent on machines managed by SCOM. The Operations Manager Admin Management Pack helps you remove workspace configurations at scale while keeping the SCOM Management Group configuration intact.

Known migration issues

• IIS logs: When you enable IIS log collection, Azure Monitor Agent might not populate the sSiteName column of the W3CIISLog table. The Log Analytics agent collects this field by default. To collect sSiteName with Azure Monitor Agent, enable the Service Name (s-sitename) field in W3C logging for IIS. For steps, see Select W3C fields to log.
• SQL Assessment Solution: This solution is part of SQL best practice assessment. The deployment policies require one Log Analytics workspace per subscription, which differs from the recommended Azure Monitor Agent deployment approach.

Related content

• Azure Monitor Agent migration helper workbook
• DCR Config Generator
• MMA Discovery and Removal tool