Identifying and Removing Duplicate Monitoring Agents from Azure Virtual Machines

Prerequisites

To effectively perform this work, you must have access to Azure subscription(s) which have Virtual Machine(s) running.

Who needs to be involved?

• Inform – Subscription owners / Business / Engineering teams responsible for their respective cloud costs review FinOps showback reports to analyze the cloud spend incurred by duplicated VM monitoring agents
• Optimize – Engineers / Application Architects review the list of VMs with duplicated monitoring agents and depending on their application requirements mandate the next optimization steps – delete Log Analytics Agent or keep
• Operate – Engineers implement the actions: to delete or keep duplicated agents

Information and Resources Required

Information

• An understanding of Azure Monitor
• An understanding of Azure Monitor Virtual Machine Best Practices

Access Requirements

• Reader level access to Subscription(s) to identify and report on duplicated monitoring agents
• Contributor access, granted at either Subscription(s) or Resource Group(s) or VM(s) scope, to implement optimization strategies for duplicated monitoring agents

Tools, Utilities, and Templates

• Azure Resource Graph Explorer

Instructions for Running This Playbook

1. Identify and List monitoring agents installed on VMs (5 mins)

In the Azure Portal, go to Azure Resource Graph Explorer and run the following query. This will return a list of all VMs that you have reader access to and the status of monitoring agents on each VM.

Resources
 | where type == "microsoft.compute/virtualmachines"
 | extend vmName = name
 | project vmName, resourceGroup, subscriptionId
 | join kind=leftouter (
 	Resources
 	| where type == "microsoft.compute/virtualmachines/extensions"
 	| extend vmName = tostring(split(id, "/")[8])
 	| extend extType = tostring(properties.type)
 	| summarize agents = make_set(extType) by tostring(vmName), resourceGroup, subscriptionId
 ) on vmName, resourceGroup, subscriptionId
 | extend HasAMA = array_index_of(agents, "AzureMonitorWindowsAgent") != -1 or array_index_of(agents, "AzureMonitorLinuxAgent") != -1
 | extend HasMMA = array_index_of(agents, "MicrosoftMonitoringAgent") != -1 or array_index_of(agents, "OmsAgentForLinux") != -1
 | extend AgentStatus = case(
 	HasAMA and HasMMA, "Both AMA & MMA",
 	HasAMA, "Only AMA",
 	HasMMA, "Only MMA",
 	array_length(agents) == 0, "No Agents",
 	"Other"
 )
 | project vmName, AgentStatus, agents

The output of the query is a table with the following columns, which can be downloaded as a CSV if required for further analysis:

• vmName: the name of the VM
• AgentStatus: shows whether the VM has both AMA and MMA, only one, or no agents installed
• Agents: lists which agents are installed on each VM

2. Validate Monitoring Agents on VMs (15 mins)

The list of VMs generated in step 1 should be examined by Engineers to determine any action required.

• If both AMA and MMA are installed on VMs, determine whether MMA can be uninstalled to eliminate duplicate telemetry collection and reduce cost (Go to Step 3)
• If only MMA is installed, consider migrating to AMA for more comprehensive monitoring (Go to Step 4)
• If neither agent is installed, consider whether the VMs should have AMA installed to gather metrics to assist in workload optimization (Go to Step 5)

3. Use the Azure MMA Discovery and Removal Tool (30 mins)

MMA/OMS Discovery and Removal Utility

4. Migrate from MMA to AMA (30 mins)

Migrate to Azure Monitor Agent from Log Analytics Agent

5. Install AMA on VMs (30 mins)

Install and Manage the Azure Monitor Agent

Outcomes and Indicators of Success

Primary Outcomes

• Total number of duplicated monitoring agents and corresponding costs are reduced
• VMs which should have monitoring agents installed have AMA installed

Indicators of Success

• Running the Azure Resource Graph query from this playbook shows zero VMs listed with ‘Both AMA & MMA’.

Exceptions and Considerations

• It is possible that Engineers determine that certain VMs should retain duplicate monitoring agents. In this scenario, informed ignore can be documented by the FinOps team.