- Article
- 10 minutes to read
This article provides details on installing the Log Analytics agent on Linux computers hosted in other clouds or on-premises.
Important
The legacy Log Analytics agent will be deprecated by August 2024. Migrate to Azure Monitor agent before August 2024 to continue ingesting data.
The installation methods described in this article are:
- Install the agent for Linux using a wrapper-script hosted on GitHub. This is the recommended method to install and upgrade the agent when the computer has connectivity with the Internet, directly or through a proxy server.
- Manually download and install the agent. This is required when the Linux computer doesn't have access to the Internet and will be communicating with Azure Monitor or Azure Automation through the Log Analytics gateway.
See Installation options for more efficient options you can use for Azure virtual machines.
Requirements
Supported operating systems
See Overview of Azure Monitor agents for a list of Linux distributions supported by the Log Analytics agent.
Note
OpenSSL 1.1.0 is only supported on x86_x64 platforms (64-bit) and OpenSSL earlier than 1.x is not supported on any platform.
Note
The Log Analytics Linux Agent does not run in containers. To monitor containers, use the Container Monitoring solution for Docker hosts or Container insights for Kubernetes.
Starting with versions released after August 2018, we're making the following changes to our support model:
- Only the server versions are supported, not client.
- Focus support on any of the Azure Linux Endorsed distros. There may be some delay between a new distro/version being Azure Linux Endorsed and it being supported for the Log Analytics Linux agent.
- All minor releases are supported for each major version listed.
- Versions that have passed their manufacturer's end-of-support date aren't supported.
- Only support VM images; containers, even those derived from official distro publishers' images, aren't supported.
- New versions of AMI aren't supported.
- Only versions that run OpenSSL 1.x by default are supported.
Note
If you are using a distro or version that is not currently supported and doesn't align to our support model, we recommend that you fork this repo, acknowledging that Microsoft support will not provide assistance with forked agent versions.
Python requirement
Starting from Agent version 1.13.27, the Linux Agent will support both Python 2 and 3. We always recommend using the latest agent.
If you're using an older version of the agent, you must have the Virtual Machine use Python 2 by default. If your virtual machine is using a distro that doesn't include Python 2 by default, then you must install it. The following sample commands will install Python 2 on different distros.
- Red Hat, CentOS, Oracle:
yum install -y python2 - Ubuntu, Debian:
apt-get install -y python2 - SUSE:
zypper install -y python2
Again, only if you're using an older version of the agent, the python2 executable must be aliased to python. Following is one method that you can use to set this alias:
Run the following command to remove any existing aliases.
sudo update-alternatives --remove-all pythonRun the following command to create the alias.
sudo update-alternatives --install /usr/bin/python python /usr/bin/python2 1
Supported Linux hardening
The OMS Agent has limited customization and hardening support for Linux.
The following are currently supported:
- SELinux (Marketplace images for CentOS and RHEL with their default settings)
- FIPS (Marketplace images for CentOS and RHEL 6/7 with their default settings)
The following aren't supported:
- CIS
- SELinux (custom hardening like MLS)
CIS, FIPS and SELinux hardening support is planned for Azure Monitoring Agent. Further hardening and customization methods aren't supported nor planned for OMS Agent. For instance, OS images like GitHub Enterprise Server which include customizations such as limitations to user account privileges aren't supported.
Agent prerequisites
The following table highlights the packages required for supported Linux distros that the agent will be installed on.
| Required package | Description | Minimum version |
|---|---|---|
| Glibc | GNU C Library | 2.5-12 |
| Openssl | OpenSSL Libraries | 1.0.x or 1.1.x |
| Curl | cURL web client | 7.15.5 |
| Python | 2.7 or 3.6+ | |
| Python-ctypes | ||
| PAM | Pluggable Authentication Modules |
Note
Either rsyslog or syslog-ng are required to collect syslog messages. The default syslog daemon on version 5 of Red Hat Enterprise Linux, CentOS, and Oracle Linux version (sysklog) is not supported for syslog event collection. To collect syslog data from this version of these distributions, the rsyslog daemon should be installed and configured to replace sysklog.
Network requirements
See Log Analytics agent overview for the network requirements for the Linux agent.
Workspace ID and key
Regardless of the installation method used, you'll require the workspace ID and key for the Log Analytics workspace that the agent will connect to. Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section.
Agent install package
The Log Analytics agent for Linux is composed of multiple packages. The release file contains the following packages, which are available by running the shell bundle with the --extract parameter:
| Package | Version | Description |
|---|---|---|
| omsagent | 1.14.19 | The Log Analytics Agent for Linux |
| omsconfig | 1.1.1 | Configuration agent for the Log Analytics agent |
| omi | 1.6.9 | Open Management Infrastructure (OMI) -- a lightweight CIM Server. Note that OMI requires root access to run a cron job necessary for the functioning of the service |
| scx | 1.6.9 | OMI CIM Providers for operating system performance metrics |
| apache-cimprov | 1.0.1 | Apache HTTP Server performance monitoring provider for OMI. Only installed if Apache HTTP Server is detected. |
| mysql-cimprov | 1.0.1 | MySQL Server performance monitoring provider for OMI. Only installed if MySQL/MariaDB server is detected. |
| docker-cimprov | 1.0.0 | Docker provider for OMI. Only installed if Docker is detected. |
Agent installation details
Important
The legacy Log Analytics agent will be deprecated by August 2024. Migrate to Azure Monitor agent before August 2024 to continue ingesting data.
Installing the Log Analytics agent for Linux packages also applies the system-wide configuration changes below. Uninstalling the omsagent package removes these artifacts.
- A non-privileged user named:
omsagentis created. The daemon runs under this credential. - A sudoers include file is created in
/etc/sudoers.d/omsagent. This authorizesomsagentto restart the syslog and omsagent daemons. If sudo include directives aren't supported in the installed version of sudo, these entries will be written to/etc/sudoers. - The syslog configuration is modified to forward a subset of events to the agent. For more information, see Configure Syslog data collection.
On a monitored Linux computer, the agent is listed as omsagent. omsconfig is the Log Analytics agent for Linux configuration agent that looks for new portal side configuration every 5 minutes. The new and updated configuration is applied to the agent configuration files located at /etc/opt/microsoft/omsagent/conf/omsagent.conf.
Install the agent
Important
The legacy Log Analytics agent will be deprecated by August 2024. Migrate to Azure Monitor agent before August 2024 to continue ingesting data.
- Wrapper script
- Shell
The following steps configure setup of the agent for Log Analytics in Azure and Azure Government cloud using the wrapper script for Linux computers that can communicate directly or through a proxy server to download the agent hosted on GitHub and install the agent.
If your Linux computer needs to communicate through a proxy server to Log Analytics, this configuration can be specified on the command line by including -p [protocol://][user:password@]proxyhost[:port]. The protocol property accepts http or https, and the proxyhost property accepts a fully qualified domain name or IP address of the proxy server.
For example: https://proxy01.contoso.com:30443
If authentication is required in either case, you need to specify the username and password. For example: https://user01:password@proxy01.contoso.com:30443
To configure the Linux computer to connect to a Log Analytics workspace, run the following command providing the workspace ID and primary key. The following command downloads the agent, validates its checksum, and installs it.
wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -w <YOUR WORKSPACE ID> -s <YOUR WORKSPACE PRIMARY KEY>The following command includes the
-pproxy parameter and example syntax when authentication is required by your proxy server:wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -p [protocol://]<proxy user>:<proxy password>@<proxyhost>[:port] -w <YOUR WORKSPACE ID> -s <YOUR WORKSPACE PRIMARY KEY>To configure the Linux computer to connect to Log Analytics workspace in Azure Government cloud, run the following command providing the workspace ID and primary key copied earlier. The following command downloads the agent, validates its checksum, and installs it.
(Video) Install Azure Monitor Agent via Policywget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -w <YOUR WORKSPACE ID> -s <YOUR WORKSPACE PRIMARY KEY> -d opinsights.azure.usThe following command includes the
-pproxy parameter and example syntax when authentication is required by your proxy server:wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -p [protocol://]<proxy user>:<proxy password>@<proxyhost>[:port] -w <YOUR WORKSPACE ID> -s <YOUR WORKSPACE PRIMARY KEY> -d opinsights.azure.usRestart the agent by running the following command:
sudo /opt/microsoft/omsagent/bin/service_control restart [<workspace id>]
Upgrade from a previous release
Upgrading from a previous version, starting with version 1.0.0-47, is supported in each release. Perform the installation with the --upgrade parameter to upgrade all components of the agent to the latest version.
Note
There will be a warning message during the upgrade "docker provider package installation skipped" since --skip-docker-provider-install flag is set. If you are installing over an existing omsagent install and wish to remove the docker provider, you should first purge the existing installation and then install using the --skip-docker-provider-install flag.
Cache information
Data from the Log Analytics agent for Linux is cached on the local machine at %STATE_DIR_WS%/out_oms_common.buffer* before it's sent to Azure Monitor. Custom log data is buffered in %STATE_DIR_WS%/out_oms_blob.buffer*. The path may be different for some solutions and data types.
The agent attempts to upload every 20 seconds. If it fails, it waits an exponentially increasing length of time until it succeeds: 30 seconds before the second attempt, 60 seconds before the third, 120 seconds, and so on, up to a maximum of 16 minutes between retries until it successfully connects again. The agent retries up to 6 times for a given chunk of data before discarding and moving to the next one. This continues until the agent can successfully upload again. This means that data may be buffered up to approximately 30 minutes before being discarded.
The default cache size is 10 MB but can be modified in the omsagent.conf file.
Next steps
Review Managing and maintaining the Log Analytics agent for Windows and Linux to learn about how to reconfigure, upgrade, or remove the agent from the virtual machine.
Review Troubleshooting the Linux agent if you encounter issues while installing or managing the agent.
Review Agent Data Sources to learn about data source configuration.
FAQs
How to install Log Analytics agent in Azure Linux VM? ›
Install the agent for Linux by using a wrapper-script hosted on GitHub. We recommend this method to install and upgrade the agent when the computer has connectivity with the internet, either directly or through a proxy server. Manually download and install the agent.
How do I install Azure agent on Linux? ›- wget https://github.com/Azure/WALinuxAgent/archive/refs/tags/v2.2.53.zip. ...
- unzip v2.2.53.zip. ...
- cd WALinuxAgent-2.53 sudo python setup.py install. ...
- systemctl status waagent. ...
- sudo systemctl restart waagent.
In the Azure portal, enter Log Analytics in the search box. As you begin typing, the list filters based on your input. Select Log Analytics workspaces. Select Add.
How to install OMS agent on Linux VM? ›- Connect to the Linux computer, and then open a terminal session.
- Run sudo sh onboard_agent.sh --purge . ...
- Remove the /etc/opt/microsoft/omsagent and /var/opt/microsoft/omsagent folders.
- Run the following command:
- Download Linux Agent installation package. On the N-sight RMM Dashboard, go to Agent > Download Agent > Download Linux Agent. ...
- Install the Agent. Run the following commands as root to install the Agent on the target operating system. ...
- Register the Linux Agent.
- Transfer the agent ( scx-<version>. universalr. <version>. <arch>. sh ) to the Linux server. ...
- To install the package, enter: sh ./scx-<version>.universalr.<version>.<arch>.sh --install.
- To verify that the package is installed, enter:
If you need to know what version of the Linux Agent is installed on a given Linux device, access /opt/adb-agent and type a tail command for the version file to show the agent version. For example: /opt/adb-agent.
How do I check Azure agent status in Linux? ›Check the service status of the Azure Linux Agent to make sure it's running. The service name might be walinuxagent or waagent. If the service is running, restart it to resolve the issue. If the service is stopped, start it, wait a few minutes, and then check the status again.
How do I start an agent service in Linux? ›Type: cd /etc/bkupexec (default location of the UNIX or LINUX agent, unless specified otherwise during install). Then type: ./agent.be & ( This will restart the service, the "&" sign is to specify the agent to run in the background).
What is the difference between Azure Monitor and Log Analytics? ›Monitor is the brand, and Log Analytics is one of the solutions. Log Analytics and Application Insights have been consolidated into Azure Monitor to provide a single integrated experience for monitoring Azure resources and hybrid environments.
How do I install monitoring agent on Azure VM? ›
- Run Setup to install the agent.
- On the Welcome page, select Next.
- On the License Terms page, read the license and then select I Agree.
- On the begin Upgrade page, select Upgrade.
- On the Completion page, select Finish.
- Once the agent installation completed, go to the Control Panel.
- Establish connectivity to Azure Log Analytics.
- Disconnected environment.
- Link a Services Hub workspace to an Azure Log Analytics workspace.
- Set up and configure Azure Log Analytics in System Center Operations Manager.
- Install the Log Analytics Gateway for Azure Monitor setup.
The agent should be restarted by running the following command: /opt/microsoft/omsagent/bin/service_control restart .
What is OMS agent Linux? ›The agent for Linux enables rich and real-time analytics for operational data (Syslog, performance, alerts, inventory) from Linux servers, Docker containers and monitoring tools like Nagios, Zabbix and System Center.
How do I know if SCOM agent is installed Linux? ›- Transfer the agent (scx-<version>-<os>-<arch>. ...
- To install the package, type: rpm -i scx-<version>-<os>-<arch>.rpm.
- To verify that the package is installed, type: rpm -q scx.
- To verify that the Microsoft SCX CIM Server is running, type: service omiserver status.
Linux install command is used to copy files to a specified destination and set attributes. It copies files to a specified destination. It is not used to install programs as its name specifies. To download and install a program, we have to use apt-get, apt, yum, and more utilities, depending on the type of distribution.
How do I install an azure agent? ›- Navigate to the Agent pools tab: Choose Azure DevOps, Organization settings. ...
- Click the pool that contains the agent.
- Make sure the agent is enabled.
- Navigate to the capabilities tab: ...
- Look for the Agent. ...
- Each agent automatically updates itself when it runs a task that requires a newer version of the agent.
- Log on to the machine using the account for which you've prepared permissions as explained above.
- In your web browser, sign in to Azure DevOps Server 2019, and navigate to the Agent pools tab: ...
- Click Download agent.
- On the Get agent dialog box, click Linux.
In the Operations console, select Administration. Select Pending Management. In the Pending Management pane, select computers in Type: Manual Agent Install. Right-click the computers, and then select Approve.
How to install agent in Linux Desktop Central? ›- Configure the linux agent settings before downloading the agent. ...
- Click the Admin tab. ...
- Click Download Agent.
- Click on the name of the remote office in which you want to install an agent. ...
- It is mandatory to have a Windows system that has SSH access to the systems in which the agent needs to be installed.
How to install Deep Security Agent in Linux? ›
- From the Deep Security Manager, go to Administration > Updates > Software > Download Center. ...
- Select your agent software package from the list.
- Click Import to download the software from the Trend Micro Download Center to the Deep Security Manager.
Another way is to use the dpkg-query tool. This tool queries the dpkg database. The -l option lists all the packages installed on our system.
How do you check if a package is installed properly in Linux? ›The dpkg-query command can be used to show if a specific package is installed in your system. To do it, run dpkg-query followed by the -l flag and the name of the package you want information about.
How do you check services are running in Linux? ›Type the ps aux to see all running process in Linux. Alternatively, you can issue the top command or htop command to view running process in Linux.
How do I monitor Linux services in Azure? ›- Step 1: Create a Workspace. In the Azure portal, click All Services and filter for Log Analytics workspaces. ...
- Step 2: Enable the Log Analytics VM Extension. Log Analytics can be enabled on existing Azure Linux and Windows VMs using the Log Analytics agent. ...
- Step 3: Collect performance data.
The Microsoft Azure Linux Agent (waagent) manages both Linux & FreeBSD provisioning, and virtual machine (VM) interaction with the Azure Fabric Controller. Besides the Linux Agent providing provisioning functionality, Azure also provides the option of using cloud-init for some Linux operating systems.
How do I update my Azure VM agent in Linux? ›- Download the latest version. Open the release of Azure Linux Agent in GitHub in a web page, and find out the latest version number. ...
- Install the Azure Linux Agent. ...
- Restart the waagent service. ...
- Confirm the Azure Linux Agent version.
- Log on on the respective server as <smd>adm.
- Execute the following command (Note: Instance number is always 99. This is not an example!) : on UNIX: /usr/sap/hostctrl/exe/sapcontrol -nr 99 -user "" "" -function ConfigureLogFileList add /tmp.
- Change to the agent installation directory.
- Enter one of the following commands: To verify the status of a single agent, enter the following command: # ps -ef | grep. PID. To verify the status of multiple agents, enter the following command: # ps -ef | grep cybAgent.
- Create a script to monitor file system space. ...
- Make the file executable by running the following command. ...
- Make a service for running the script. ...
- Save the file and start the service using the systemctl command: ...
- Verify that your script and check log file:
What are the three main functions of Azure monitor? ›
Microsoft combined three unique services—Azure Monitor, Log Analytics, and Application Insights—under the umbrella of Azure Monitor to provide powerful end-to-end monitoring of your applications and the components they rely on. Log Analytics and Application Insights are now features of Azure Monitor.
What can be monitored using Azure monitor? ›- Applications.
- Virtual machines.
- Guest operating systems.
- Containers.
- Databases.
- Security events in combination with Azure Sentinel.
- Networking events and health in combination with Network Watcher.
Log Analytics is a tool in the Azure portal that's used to edit and run log queries against data in the Azure Monitor Logs store. You might write a simple query that returns a set of records and then use features of Log Analytics to sort, filter, and analyze them.
How to install log analytics agent in VM? ›...
Install OMS Agents on VMs
- Sign into the Azure Portal.
- In the search bar of the portal, type Log Analytics Workspaces and select it.
- In your list of Log Analytics workspaces, select the one that you want to use with the Azure VM.
- Compute Engine instances. The Monitoring agent sends monitoring information to each instance's associated project. ...
- Amazon Web Services Elastic Compute Cloud (AWS EC2) instances.
- In the Google Cloud console, select your Google Cloud project. ...
- In the navigation pane, select Monitoring.
- In the Monitoring navigation pane, select Dashboards.
- In the table of dashboards, locate the VM Instances entry, and then click on the name.
Sign in to the Azure portal. Select Azure Active Directory, and then select Logs from the Monitoring section to open your Log Analytics workspace. The workspace will open with a default query.
How do I send application Logs to Azure Monitor? ›- Go to the Log Analytics workspaces menu in the Azure portal and select Tables. ...
- Specify a name for the table. ...
- Select Create a new data collection rule to create the DCR that will be used to send data to this table. ...
- Select the DCE that you created, and then select Next.
Azure Monitor Logs is based on Azure Data Explorer, and log queries are written by using the same Kusto Query Language (KQL). This rich language is designed to be easy to read and author, so you should be able to start writing queries with some basic guidance.
How do I know if my OEM agent is running? ›- Change directory to the following location in the AGENT_HOME directory: AGENT_HOME/bin.
- Enter the following emctl command to check status of the Management Agent: $PROMPT> ./emctl status agent.
How do I start Arcserve agent in Linux? ›
...
Restart the d2dserver using the following command: #/opt/Arcserve/d2dserver/bin/d2dserver restart.
- Type Y and press Enter to confirm the installation. ...
- Type Y and press Enter to accept the licensing agreement.
- Click Start > Programs > IBM Tivoli Monitoring > Tivoli Enterprise Portal desktop.
- Enter your user ID and password on the logon window. The default user ID is sysadmin .
- Click OK.
To check the status of OMS, we can login to em server. To get more details about port and URL, then we can use -details in status command.
What is log analytics virtual machine extension for Linux? ›The Log Analytics virtual machine extension for Linux is published and supported by Microsoft. The extension installs the Log Analytics agent on Azure virtual machines, and enrolls virtual machines into an existing Log Analytics workspace.
What is machine agent in Linux? ›The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers.
How to monitor Linux server in SCOM? ›- Import Management Packs.
- Create a resource pool for monitoring Unix/Linux servers.
- Configure the Xplat certificates (export/import) for each management server in the pool.
- Create and Configure Run As accounts for Unix/Linux.
- Configure the sudoers file.
- Discover and deploy the agents.
- Operating System: See Server Operating System requirements.
- Windows PowerShell version: Windows PowerShell version 2.0, or Windows PowerShell version 3.0.
- Windows Remote Management: Windows Remote Management must be enabled for the management server.
- . NET Framework 4.7. 2 or .
You can install the SCOM agent manually without APM by using the "NOAPM = 1" switch using the Command Line or by using -NoAPM switch by using PowerShell .
How do I install Azure monitoring agent on Azure VM? ›- In the Azure portal, go to Log Analytics, select your workspace, and select the Advanced Settings Icon.
- Select Connected Sources, and then select Windows Servers.
- Download the WIndowsAzureVmAgent msi file. For my Windows 2019 Server I am selecting the amd64 version.
- Run the msi file 'as Administrator'. ...
- Click Next, accept the agreement and Finish.
How do I enable Log Analytics in Azure VM? ›
- From the Monitor menu in the Azure portal, select Virtual Machines > Overview > Not Monitored.
- Select Enable next to any machine that you want to enable. ...
- On the Insights Onboarding page, select Enable.
- On the Monitoring configuration page, select Log Analytics agent.
- Step 1: Attach the OS disk of the VM to another VM as a data disk. Take a snapshot for the OS disk of the affected VM, create a disk from the snapshot, and then attach the disk to a troubleshoot VM. ...
- Step 2: Modify the OS disk to install the Azure VM Agent.
The agent should be restarted by running the following command: /opt/microsoft/omsagent/bin/service_control restart .
What is the difference between Azure monitoring agent and log analytics agent? ›Azure monitor is a monitoring service that provides data and insights about the health and performance of Azure resources. Log analytics is a service that helps you collect, search, and analyze data to gain insights into your application and business.
What is Azure Linux agent? ›The Microsoft Azure Linux Agent (waagent) manages Linux & FreeBSD provisioning, and VM interaction with the Azure Fabric Controller. In addition to the Linux Agent providing provisioning functionality, Azure also provides the option of using cloud-init for some Linux OSes.
How do I update the Azure Linux agent on my VM? ›- Download the latest version. Open the release of Azure Linux Agent in GitHub in a web page, and find out the latest version number. ...
- Install the Azure Linux Agent. ...
- Restart the waagent service. ...
- Confirm the Azure Linux Agent version.
- Navigate to the Agent pools tab: Choose Azure DevOps, Organization settings. Choose Agent pools. ...
- Click the pool that contains the agent.
- Make sure the agent is enabled.
- Navigate to the capabilities tab: From the Agent pools tab, select the desired agent pool. Select Agents and choose the desired agent.
- You need an SSH key pair. If you don't already have one, Azure will create a key pair during the deployment process. ...
- You need an existing Network Security Group (NSG). ...
- To connect to a Linux VM, you need the appropriate port open. ...
- Your VM must have a public IP address. ...
- Verify your VM is running.
Log Analytics is a tool in the Azure portal that's used to edit and run log queries against data in the Azure Monitor Logs store. You might write a simple query that returns a set of records and then use features of Log Analytics to sort, filter, and analyze them.
How do I know if Azure VM Agent is installed? ›To check for the Azure VM Agent, open Task Manager, click the Details tab, and look for a process name WindowsAzureGuestAgent.exe. The presence of this process indicates that the VM agent is installed.
How to enable automatic provisioning of the monitoring agent? ›
- From Azure Console.
- Go to Security Center.
- Click on Pricing & Settings.
- Click on a subscription.
- Click on Data Collection.
- Set Automatic provisioning to On.
- Click save.
- Repeat the above for any additional subscriptions. Using Azure Command Line Interface 2.0.
The Azure Virtual Desktop agent is initially installed in one of two ways. If you provision virtual machines (VMs) in the Azure portal and Azure Marketplace, the agent and agent bootloader are automatically installed. If you provision VMs using PowerShell, you must manually download the agent and agent bootloader .