Install Log Analytics agent on Linux computers

  • Article
  • 10 minutes to read

The Log Analytics agents are on a deprecation path and will no longer be supported later on August 31, 2024. If you use the Log Analytics agents to ingest data to Azure Monitor, brand certain to migrate to the new Azure Monitor amanuensis prior to that engagement.

This article provides details on installing the Log Analytics amanuensis on Linux computers using the following methods:

  • Install the agent for Linux using a wrapper-script hosted on GitHub. This is the recommended method to install and upgrade the agent when the computer has connectivity with the Internet, directly or through a proxy server.
  • Manually download and install the amanuensis. This is required when the Linux computer does not have access to the Internet and will exist communicating with Azure Monitor or Azure Automation through the Log Analytics gateway.

Important

The installation methods described in this article are typically used for virtual machines on-premises or in other clouds. See Installation options for more efficient options yous can use for Azure virtual machines.

Supported operating systems

Come across Overview of Azure Monitor agents for a list of Linux distributions supported by the Log Analytics agent.

Note

OpenSSL 1.1.0 is just supported on x86_x64 platforms (64-fleck) and OpenSSL earlier than 1.x is not supported on whatever platform.

Starting with versions released after August 2022, we are making the following changes to our support model:

  • Only the server versions are supported, not client.
  • Focus back up on whatever of the Azure Linux Endorsed distros. Annotation that in that location may exist some delay betwixt a new distro/version being Azure Linux Endorsed and it beingness supported for the Log Analytics Linux agent.
  • All small releases are supported for each major version listed.
  • Versions that accept passed their manufacturer's end-of-back up appointment are not supported.
  • Only support VM images; containers, fifty-fifty those derived from official distro publishers' images, are not supported.
  • New versions of AMI are not supported.
  • Only versions that run OpenSSL 1.10 past default are supported.

Note

If yous are using a distro or version that is not currently supported and doesn't align to our support model, we recommend that you lot fork this repo, acknowledging that Microsoft support volition not provide assistance with forked agent versions.

Python requirement

Starting from Amanuensis version 1.13.27, the Linux Agent will support both Python two and three. We always recommend using the latest amanuensis.

If yous are using an older version of the agent, you must take the Virtual Automobile employ Python ii by default. If your virtual machine is using a distro that doesn't include Python 2 past default and then you lot must install information technology. The following sample commands will install Python 2 on different distros.

  • Red Chapeau, CentOS, Oracle: yum install -y python2
  • Ubuntu, Debian: apt-get install -y python2
  • SUSE: zypper install -y python2

Once more, only if you are using an older version of the agent, the python2 executable must be aliased to python. Following is one method that you can utilise to ready this alias:

  1. Run the following command to remove any existing aliases.

                      sudo update-alternatives --remove-all python

  2. Run the following control to create the allonym.

                      sudo update-alternatives --install /usr/bin/python python /usr/bin/python2 1

Supported Linux hardening

The OMS Amanuensis has limited customization and hardening support for Linux.

The following are currently supported:

  • FIPS
  • SELinux (Marketplace images for CentOS and RHEL with their default settings)

The following are not supported:

  • CIS
  • SELinux (custom hardening like MLS)

CIS and SELinux hardening back up is planned for Azure Monitoring Agent. Further hardening and customization methods are not supported nor planned for OMS Agent. For case, OS images similar Github Enterprise Server which include customizations such every bit limitations to user account privileges are non supported.

Agent prerequisites

The following table highlights the packages required for supported Linux distros that the agent volition be installed on.

Required package Description Minimum version
Glibc GNU C Library 2.five-12
Openssl OpenSSL Libraries 1.0.x or 1.1.x
Curl cURL spider web customer 7.15.5
Python two.7 or three.6+
Python-ctypes
PAM Pluggable Authentication Modules

Note

Either rsyslog or syslog-ng are required to collect syslog messages. The default syslog daemon on version 5 of Ruddy Hat Enterprise Linux, CentOS, and Oracle Linux version (sysklog) is non supported for syslog event collection. To collect syslog data from this version of these distributions, the rsyslog daemon should be installed and configured to supervene upon sysklog.

Network requirements

See Log Analytics amanuensis overview for the network requirements for the Linux amanuensis.

Workspace ID and key

Regardless of the installation method used, you will require the workspace ID and key for the Log Analytics workspace that the agent volition connect to. Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section.

Workspace details

Amanuensis install package

The Log Analytics agent for Linux is equanimous of multiple packages. The release file contains the following packages, which are available by running the shell bundle with the --extract parameter:

Package Version Description
omsagent 1.13.9 The Log Analytics Agent for Linux
omsconfig 1.ane.1 Configuration agent for the Log Analytics amanuensis
omi 1.half dozen.4 Open Management Infrastructure (OMI) -- a lightweight CIM Server. Note that OMI requires root access to run a cron job necessary for the performance of the service
scx 1.6.four OMI CIM Providers for operating system functioning metrics
apache-cimprov 1.0.1 Apache HTTP Server performance monitoring provider for OMI. Just installed if Apache HTTP Server is detected.
mysql-cimprov 1.0.1 MySQL Server performance monitoring provider for OMI. Merely installed if MySQL/MariaDB server is detected.
docker-cimprov one.0.0 Docker provider for OMI. Only installed if Docker is detected.

Agent installation details

After installing the Log Analytics agent for Linux packages, the following additional arrangement-wide configuration changes are applied. These artifacts are removed when the omsagent parcel is uninstalled.

  • A non-privileged user named: omsagent is created. The daemon runs under this credential.
  • A sudoers include file is created in /etc/sudoers.d/omsagent. This authorizes omsagent to restart the syslog and omsagent daemons. If sudo include directives are not supported in the installed version of sudo, these entries will be written to /etc/sudoers.
  • The syslog configuration is modified to frontward a subset of events to the agent. For more information, see Configure Syslog data drove.

On a monitored Linux calculator, the agent is listed every bit omsagent. omsconfig is the Log Analytics agent for Linux configuration agent that looks for new portal side configuration every v minutes. The new and updated configuration is applied to the amanuensis configuration files located at /etc/opt/microsoft/omsagent/conf/omsagent.conf.

Install the agent using wrapper script

The post-obit steps configure setup of the amanuensis for Log Analytics in Azure and Azure Government deject using the wrapper script for Linux computers that can communicate directly or through a proxy server to download the agent hosted on GitHub and install the agent.

If your Linux reckoner needs to communicate through a proxy server to Log Analytics, this configuration tin be specified on the control line past including -p [protocol://][user:countersign@]proxyhost[:port]. The protocol property accepts http or https, and the proxyhost property accepts a fully qualified domain proper noun or IP address of the proxy server.

For instance: https://proxy01.contoso.com:30443

If authentication is required in either instance, you need to specify the username and password. For example: https://user01:countersign@proxy01.contoso.com:30443

  1. To configure the Linux computer to connect to a Log Analytics workspace, run the following command providing the workspace ID and principal cardinal. The post-obit command downloads the agent, validates its checksum, and installs it.

                      wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -w <YOUR WORKSPACE ID> -south <YOUR WORKSPACE PRIMARY Fundamental>

    The following command includes the -p proxy parameter and example syntax when hallmark is required by your proxy server:

                                          wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -p [protocol://]<proxy user>:<proxy password>@<proxyhost>[:port] -w <YOUR WORKSPACE ID> -s <YOUR WORKSPACE PRIMARY KEY>

  2. To configure the Linux computer to connect to Log Analytics workspace in Azure Government cloud, run the following command providing the workspace ID and main key copied before. The post-obit control downloads the agent, validates its checksum, and installs it.

                      wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -w <YOUR WORKSPACE ID> -southward <YOUR WORKSPACE Principal Key> -d opinsights.azure.the states

    The following control includes the -p proxy parameter and instance syntax when authentication is required by your proxy server:

                                          wget https://raw.githubusercontent.com/Microsoft/OMS-Amanuensis-for-Linux/main/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -p [protocol://]<proxy user>:<proxy password>@<proxyhost>[:port] -w <YOUR WORKSPACE ID> -s <YOUR WORKSPACE PRIMARY KEY> -d opinsights.azure.us

  3. Restart the agent by running the following command:

                      sudo /opt/microsoft/omsagent/bin/service_control restart [<workspace id>]

Install the amanuensis manually

The Log Analytics agent for Linux is provided in a self-extracting and installable shell script packet. This bundle contains Debian and RPM packages for each of the agent components and can be installed directly or extracted to remember the individual packages. One parcel is provided for x64 and 1 for x86 architectures.

  1. Download and transfer the appropriate bundle (x64 or x86) to your Linux VM or physical computer, using scp/sftp.

  2. Install the packet by using the --install argument. To onboard to a Log Analytics workspace during installation, provide the -w <WorkspaceID> and -due south <workspaceKey> parameters copied earlier.

    Note

    You need to use the --upgrade statement if any dependent packages such every bit omi, scx, omsconfig or their older versions are installed, as would exist the case if the system Center Operations Director agent for Linux is already installed.

                      sudo sh ./omsagent-*.universal.x64.sh --install -w <workspace id> -due south <shared key>

  3. To configure the Linux agent to install and connect to a Log Analytics workspace through a Log Analytics gateway, run the following control providing the proxy, workspace ID, and workspace cardinal parameters. This configuration tin can be specified on the command line by including -p [protocol://][user:password@]proxyhost[:port]. The proxyhost property accepts a fully qualified domain name or IP address of the Log Analytics gateway server.

                      sudo sh ./omsagent-*.universal.x64.sh --upgrade -p https://<proxy address>:<proxy port> -w <workspace id> -due south <shared fundamental>

    If authentication is required, y'all need to specify the username and password. For example:

                      sudo sh ./omsagent-*.universal.x64.sh --upgrade -p https://<proxy user>:<proxy password>@<proxy address>:<proxy port> -due west <workspace id> -s <shared key>

  4. To configure the Linux figurer to connect to a Log Analytics workspace in Azure Government deject, run the following command providing the workspace ID and primary cardinal copied before.

                      sudo sh ./omsagent-*.universal.x64.sh --upgrade -w <workspace id> -s <shared key> -d opinsights.azure.us

If you want to install the amanuensis packages and configure information technology to study to a specific Log Analytics workspace at a later time, run the following control:

              sudo sh ./omsagent-*.universal.x64.sh --upgrade

If you want to extract the agent packages from the bundle without installing the amanuensis, run the following command:

              sudo sh ./omsagent-*.universal.x64.sh --extract

Upgrade from a previous release

Upgrading from a previous version, starting with version i.0.0-47, is supported in each release. Perform the installation with the --upgrade parameter to upgrade all components of the agent to the latest version.

Cache information

Information from the Log Analytics agent for Linux is cached on the local car at %STATE_DIR_WS%/out_oms_common.buffer* earlier information technology's sent to Azure Monitor. Custom log data is buffered in %STATE_DIR_WS%/out_oms_blob.buffer*. The path may be dissimilar for some solutions and data types.

The amanuensis attempts to upload every xx seconds. If it fails, it will expect an exponentially increasing length of time until it succeeds: 30 seconds before the second attempt, 60 seconds earlier the third, 120 seconds ... and and then on up to a maximum of xvi minutes between retries until it successfully connects again. The agent will retry up to half-dozen times for a given chunk of data before discarding and moving to the side by side 1. This continues until the agent tin can successfully upload again. This means that information may be buffered up to approximately xxx minutes before existence discarded.

The default cache size is 10 MB just can exist modified in the omsagent.conf file.

Next steps

  • Review Managing and maintaining the Log Analytics amanuensis for Windows and Linux to learn about how to reconfigure, upgrade, or remove the amanuensis from the virtual car.

  • Review Troubleshooting the Linux agent if you encounter issues while installing or managing the amanuensis.

  • Review Agent Information Sources to learn well-nigh data source configuration.