Resource Manager template samples for agents in Azure Monitor
This article includes sample Azure Resource Manager templates to deploy and configure the Azure Monitor agent, the legacy Log Analytics agent and diagnostic extension for virtual machines in Azure Monitor. Each sample includes a template file and a parameters file with sample values to provide to the template.
Note
See Azure Resource Manager samples for Azure Monitor for a list of samples that are available and guidance on deploying them in your Azure subscription.
Azure Monitor agent
The samples in this section install the Azure Monitor agent on Windows and Linux virtual machines and Azure Arc-enabled servers.
Prerequisites
To use the templates below, you'll need:
- To create a user-assigned managed identity and assign the user-assigned managed identity, or enable a system-assigned managed identity. A managed identity is required for Azure Monitor agent to collect and publish data. User-assigned managed identities are strongly recommended over system-assigned managed identities due to their ease of management at scale.
- To configure data collection for Azure Monitor Agent, you must also deploy Resource Manager template data collection rules and associations.
Permissions required
| Built-in Role | Scope(s) | Reason |
|---|---|---|
|
To deploy agent extension | |
| Any role that includes the action Microsoft.Resources/deployments/* |
|
To deploy ARM templates |
Azure Windows virtual machine
The following sample installs the Azure Monitor agent on an Azure Windows virtual machine. Use the appropriate template below based on your chosen authentication method.
User-assigned managed identity (recommended)
param vmName string
param location string
param userAssignedManagedIdentity string
resource windowsAgent 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
name: '${vmName}/AzureMonitorWindowsAgent'
location: location
properties: {
publisher: 'Microsoft.Azure.Monitor'
type: 'AzureMonitorWindowsAgent'
typeHandlerVersion: '1.0'
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
settings: {
authentication: {
managedIdentity: {
'identifier-name': 'mi_res_id'
'identifier-value': userAssignedManagedIdentity
}
}
}
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-windows-vm"
},
"location": {
"value": "eastus"
},
"userAssignedManagedIdentity": {
"value": "/subscriptions/<my-subscription-id>/resourceGroups/<my-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<my-user-assigned-identity>"
}
}
}
System-assigned managed identity
Template file
param vmName string
param location string
resource windowsAgent 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
name: '${vmName}/AzureMonitorWindowsAgent'
location: location
properties: {
publisher: 'Microsoft.Azure.Monitor'
type: 'AzureMonitorWindowsAgent'
typeHandlerVersion: '1.0'
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-windows-vm"
},
"location": {
"value": "eastus"
}
}
}
Azure Linux virtual machine
The following sample installs the Azure Monitor agent on an Azure Linux virtual machine. Use the appropriate template below based on your chosen authentication method.
User-assigned managed identity (recommended)
Template file
param vmName string
param location string
param userAssignedManagedIdentity string
resource linuxAgent 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
name: '${vmName}/AzureMonitorLinuxAgent'
location: location
properties: {
publisher: 'Microsoft.Azure.Monitor'
type: 'AzureMonitorLinuxAgent'
typeHandlerVersion: '1.21'
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
settings: {
authentication: {
managedIdentity: {
'identifier-name': 'mi_res_id'
'identifier-value': userAssignedManagedIdentity
}
}
}
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-linux-vm"
},
"location": {
"value": "eastus"
},
"userAssignedManagedIdentity": {
"value": "/subscriptions/<my-subscription-id>/resourceGroups/<my-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<my-user-assigned-identity>"
}
}
}
System-assigned managed identity
Template file
param vmName string
param location string
resource linuxAgent 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
name: '${vmName}/AzureMonitorLinuxAgent'
location: location
properties: {
publisher: 'Microsoft.Azure.Monitor'
type: 'AzureMonitorLinuxAgent'
typeHandlerVersion: '1.21'
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-linux-vm"
},
"location": {
"value": "eastus"
}
}
}
Azure Arc-enabled Windows server
The following sample installs the Azure Monitor agent on an Azure Arc-enabled Windows server.
Template file
param vmName string
param location string
resource windowsAgent 'Microsoft.HybridCompute/machines/extensions@2021-12-10-preview' = {
name: '${vmName}/AzureMonitorWindowsAgent'
location: location
properties: {
publisher: 'Microsoft.Azure.Monitor'
type: 'AzureMonitorWindowsAgent'
autoUpgradeMinorVersion: true
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-windows-vm"
},
"location": {
"value": "eastus"
}
}
}
Azure Arc-enabled Linux server
The following sample installs the Azure Monitor agent on an Azure Arc-enabled Linux server.
Template file
param vmName string
param location string
resource linuxAgent 'Microsoft.HybridCompute/machines/extensions@2021-12-10-preview'= {
name: '${vmName}/AzureMonitorLinuxAgent'
location: location
properties: {
publisher: 'Microsoft.Azure.Monitor'
type: 'AzureMonitorLinuxAgent'
autoUpgradeMinorVersion: true
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-linux-vm"
},
"location": {
"value": "eastus"
}
}
}
Log Analytics agent
The samples in this section install the legacy Log Analytics agent on Windows and Linux virtual machines in Azure and connect it to a Log Analytics workspace.
Windows
The following sample installs the Log Analytics agent on an Azure virtual machine. This is done by enabling the Log Analytics virtual machine extension for Windows.
Template file
@description('Name of the virtual machine.')
param vmName string
@description('Location of the virtual machine')
param location string = resourceGroup().location
@description('Id of the workspace.')
param workspaceId string
@description('Primary or secondary workspace key.')
param workspaceKey string
resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = {
name: vmName
location: location
properties:{}
}
resource logAnalyticsAgent 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
parent: vm
name: 'Microsoft.Insights.LogAnalyticsAgent'
location: location
properties: {
publisher: 'Microsoft.EnterpriseCloud.Monitoring'
type: 'MicrosoftMonitoringAgent'
typeHandlerVersion: '1.0'
autoUpgradeMinorVersion: true
settings: {
workspaceId: workspaceId
}
protectedSettings: {
workspaceKey: workspaceKey
}
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-windows-vm"
},
"location": {
"value": "westus"
},
"workspaceId": {
"value": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
"workspaceKey": {
"value": "Tse-gj9CemT6A80urYa2hwtjvA5axv1xobXgKR17kbVdtacU6cEf+SNo2TdHGVKTsZHZd1W9QKRXfh+$fVY9dA=="
}
}
}
Linux
The following sample installs the Log Analytics agent on a Linux Azure virtual machine. This is done by enabling the Log Analytics virtual machine extension for Linux.
Template file
@description('Name of the virtual machine.')
param vmName string
@description('Location of the virtual machine')
param location string = resourceGroup().location
@description('Id of the workspace.')
param workspaceId string
@description('Primary or secondary workspace key.')
param workspaceKey string
resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = {
name: vmName
location: location
}
resource logAnalyticsAgent 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
parent: vm
name: 'Microsoft.Insights.LogAnalyticsAgent'
location: location
properties: {
publisher: 'Microsoft.EnterpriseCloud.Monitoring'
type: 'OmsAgentForLinux'
typeHandlerVersion: '1.7'
autoUpgradeMinorVersion: true
settings: {
workspaceId: workspaceId
}
protectedSettings: {
workspaceKey: workspaceKey
}
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-linux-vm"
},
"location": {
"value": "westus"
},
"workspaceId": {
"value": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
"workspaceKey": {
"value": "Tse-gj9CemT6A80urYa2hwtjvA5axv1xobXgKR17kbVdtacU6cEf+SNo2TdHGVKTsZHZd1W9QKRXfh+$fVY9dA=="
}
}
}
Diagnostic extension
The samples in this section install the diagnostic extension on Windows and Linux virtual machines in Azure and configure it for data collection.
Windows
The following sample enables and configures the diagnostic extension on an Azure virtual machine. For details on the configuration, see Windows diagnostics extension schema.
Template file
@description('Name of the virtual machine.')
param vmName string
@description('Location for the virtual machine.')
param location string = resourceGroup().location
@description('Name of the storage account.')
param storageAccountName string
@description('Resource ID of the storage account.')
param storageAccountId string
@description('Resource ID of the workspace.')
param workspaceResourceId string
resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = {
name: vmName
location: location
}
resource vmDiagnosticsSettings 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
parent: vm
name: 'Microsoft.Insights.VMDiagnosticsSettings'
location: location
properties: {
publisher: 'Microsoft.Azure.Diagnostics'
type: 'IaaSDiagnostics'
typeHandlerVersion: '1.5'
autoUpgradeMinorVersion: true
settings: {
WadCfg: {
DiagnosticMonitorConfiguration: {
overallQuotaInMB: 10000
DiagnosticInfrastructureLogs: {
scheduledTransferLogLevelFilter: 'Error'
}
PerformanceCounters: {
scheduledTransferPeriod: 'PT1M'
sinks: 'AzureMonitorSink'
PerformanceCounterConfiguration: [
{
counterSpecifier: '\\Processor(_Total)\\% Processor Time'
sampleRate: 'PT1M'
unit: 'percent'
}
]
}
WindowsEventLog: {
scheduledTransferPeriod: 'PT5M'
DataSource: [
{
name: 'System!*[System[Provider[@Name=\'Microsoft Antimalware\']]]'
}
{
name: 'System!*[System[Provider[@Name=\'NTFS\'] and (EventID=55)]]'
}
{
name: 'System!*[System[Provider[@Name=\'disk\'] and (EventID=7 or EventID=52 or EventID=55)]]'
}
]
}
}
SinksConfig: {
Sink: [
{
name: 'AzureMonitorSink'
AzureMonitor: {
ResourceId: workspaceResourceId
}
}
]
}
}
storageAccount: storageAccountName
}
protectedSettings: {
storageAccountName: storageAccountName
storageAccountKey: listkeys(storageAccountId, '2021-08-01').key1
storageAccountEndPoint: 'https://${environment().suffixes.storage}'
}
}
}
resource managedIdentity 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
parent: vm
name: 'ManagedIdentityExtensionForWindows'
location: location
properties: {
publisher: 'Microsoft.ManagedIdentity'
type: 'ManagedIdentityExtensionForWindows'
typeHandlerVersion: '1.0'
autoUpgradeMinorVersion: true
settings: {
port: 50342
}
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-windows-vm"
},
"location": {
"value": "westus"
},
"storageAccountName": {
"value": "mystorageaccount"
},
"storageAccountId": {
"value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/my-resource-group/providers/Microsoft.Storage/storageAccounts/my-windows-vm"
},
"workspaceResourceId": {
"value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/my-resource-group/providers/microsoft.operationalinsights/workspaces/my-workspace"
}
}
}
Linux
The following sample enables and configures the diagnostic extension on a Linux Azure virtual machine. For details on the configuration, see Windows diagnostics extension schema.
Template file
@description('Name of the virtual machine.')
param vmName string
@description('Resource ID of the virtual machine.')
param vmId string
@description('Location for the virtual machine.')
param location string = resourceGroup().location
@description('Name of the storage account.')
param storageAccountName string
@description('Resource ID of the storage account.')
param storageSasToken string
@description('URL of the event hub.')
param eventHubUrl string
resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = {
name: vmName
location: location
}
resource vmDiagnosticsSettings 'Microsoft.Compute/virtualMachines/extensions@2021-11-01' = {
parent: vm
name: 'Microsoft.Insights.VMDiagnosticsSettings'
location: location
properties: {
publisher: 'Microsoft.Azure.Diagnostics'
type: 'LinuxDiagnostic'
typeHandlerVersion: '3.0'
autoUpgradeMinorVersion: true
settings: {
StorageAccount: storageAccountName
ladCfg: {
sampleRateInSeconds: 15
diagnosticMonitorConfiguration: {
performanceCounters: {
sinks: 'MyMetricEventHub,MyJsonMetricsBlob'
performanceCounterConfiguration: [
{
unit: 'Percent'
type: 'builtin'
counter: 'PercentProcessorTime'
counterSpecifier: '/builtin/Processor/PercentProcessorTime'
annotation: [
{
locale: 'en-us'
displayName: 'Aggregate CPU %utilization'
}
]
condition: 'IsAggregate=TRUE'
class: 'Processor'
}
{
unit: 'Bytes'
type: 'builtin'
counter: 'UsedSpace'
counterSpecifier: '/builtin/FileSystem/UsedSpace'
annotation: [
{
locale: 'en-us'
displayName: 'Used disk space on /'
}
]
condition: 'Name="/"'
class: 'Filesystem'
}
]
}
metrics: {
metricAggregation: [
{
scheduledTransferPeriod: 'PT1H'
}
{
scheduledTransferPeriod: 'PT1M'
}
]
resourceId: vmId
}
eventVolume: 'Large'
syslogEvents: {
sinks: 'MySyslogJsonBlob,MyLoggingEventHub'
syslogEventConfiguration: {
LOG_USER: 'LOG_INFO'
}
}
}
}
perfCfg: [
{
query: 'SELECT PercentProcessorTime, PercentIdleTime FROM SCX_ProcessorStatisticalInformation WHERE Name=\'_TOTAL\''
table: 'LinuxCpu'
frequency: 60
sinks: 'MyLinuxCpuJsonBlob,MyLinuxCpuEventHub'
}
]
fileLogs: [
{
file: '/var/log/myladtestlog'
table: 'MyLadTestLog'
sinks: 'MyFilelogJsonBlob,MyLoggingEventHub'
}
]
}
protectedSettings: {
storageAccountName: 'yourdiagstgacct'
storageAccountSasToken: storageSasToken
sinksConfig: {
sink: [
{
name: 'MySyslogJsonBlob'
type: 'JsonBlob'
}
{
name: 'MyFilelogJsonBlob'
type: 'JsonBlob'
}
{
name: 'MyLinuxCpuJsonBlob'
type: 'JsonBlob'
}
{
name: 'MyJsonMetricsBlob'
type: 'JsonBlob'
}
{
name: 'MyLinuxCpuEventHub'
type: 'EventHub'
sasURL: eventHubUrl
}
{
name: 'MyMetricEventHub'
type: 'EventHub'
sasURL: eventHubUrl
}
{
name: 'MyLoggingEventHub'
type: 'EventHub'
sasURL: eventHubUrl
}
]
}
}
}
}
Parameter file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"value": "my-linux-vm"
},
"vmId": {
"value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/my-resource-group/providers/Microsoft.Compute/virtualMachines/my-linux-vm"
},
"location": {
"value": "westus"
},
"storageAccountName": {
"value": "mystorageaccount"
},
"storageSasToken": {
"value": "?sv=2019-10-10&ss=bfqt&srt=sco&sp=rwdlacupx&se=2020-04-26T23:06:44Z&st=2020-04-26T15:06:44Z&spr=https&sig=1QpoTvrrEW6VN2taweUq1BsaGkhDMnFGTfWakucZl4%3D"
},
"eventHubUrl": {
"value": "https://my-eventhub-namespace.servicebus.windows.net/my-eventhub?sr=my-eventhub-namespace.servicebus.windows.net%2fmy-eventhub&sig=4VEGPTg8jxUAbTcyeF2kwOr8XZdfgTdMWEQWnVaMSqw=&skn=manage"
}
}
}
Next steps
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for