# How to Monitor Linux Servers using Microsoft Azure Log Analytics Agent
In hybrid cloud environments, administrators frequently manage a mix of Windows and Linux servers deployed across on-premises data centers and various public clouds. Maintaining visibility into the health and performance of these disparate systems is challenging.
Microsoft Azure offers a unified monitoring solution through Azure Monitor and Log Analytics workspaces. While native to Azure, this infrastructure can monitor external machines, including Linux distributions running on-premises, in AWS, or in Google Cloud, by deploying the Azure Log Analytics agent (formerly known as the OMS Agent).
This guide details the process of creating an Azure Log Analytics workspace and installing the agent on a Linux server to stream syslog data and performance metrics directly to Azure.
## Prerequisites
Before beginning, ensure you have:
1. An active Microsoft Azure subscription.
2. A Linux server (Ubuntu, CentOS, RHEL, or Debian) with outbound internet access.
3. Root or `sudo` privileges on the Linux server.
## Step 1: Create a Log Analytics Workspace in Azure
The Log Analytics workspace is the central repository where your Linux server will send its data.
1. Log in to the **Azure Portal** (portal.azure.com).
2. In the search bar at the top, type **Log Analytics workspaces** and select it from the results.
3. Click **+ Create**.
4. Select your **Subscription** and **Resource Group**.
5. Provide a globally unique **Name** for the workspace (e.g., `Linux-Monitoring-Workspace`).
6. Select the **Region** closest to your physical servers to minimize latency.
7. Click **Review + Create**, then click **Create**. The deployment will take a few moments.
## Step 2: Retrieve the Workspace ID and Primary Key
To connect the Linux agent to your specific Azure account, you need the unique credentials for the workspace you just created.
1. Once the deployment is complete, navigate to your new Log Analytics workspace.
2. In the left-hand navigation menu, scroll down to the **Settings** section and click on **Agents**.
3. Select the **Linux servers** tab.
4. Keep this window open. You will need the **Workspace ID** and the **Primary Key** to install the agent in the next step.
## Step 3: Install the Log Analytics Agent on Linux
Microsoft provides a convenient wrapper script that handles the downloading, installation, and configuration of the agent in a single command.
Connect to your Linux server via SSH.
Run the following command, replacing the placeholder values with your actual Workspace ID and Primary Key copied from the Azure Portal:
“`bash
wget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh && sh onboard_agent.sh -w
“`
### What the script does:
– Checks for dependencies (like python, ctypes, and systemd).
– Downloads the latest `.sh` package for the OMS agent.
– Installs the agent under `/opt/microsoft/omsagent/`.
– Configures the agent to communicate with your specific Azure workspace using the provided credentials.
– Starts the `omsagent` daemon.
## Step 4: Verify the Agent Installation
After the script completes, verify that the agent is running and communicating with Azure.
1. **Check the service status:**
“`bash
sudo /opt/microsoft/omsagent/bin/service_control status
“`
You should see output indicating that the `omsagent` is running.
2. **Check the agent logs for connection errors:**
“`bash
cat /var/opt/microsoft/omsagent/
“`
Look for lines indicating successful connection and data flushing to the Operational Insights endpoints.
3. **Verify in the Azure Portal:**
Return to your Log Analytics workspace in the Azure Portal. Under **Settings** > **Agents** > **Linux servers**, you should now see `1 Linux computers connected`. (This may take up to 10 minutes to update).
## Step 5: Configure Data Collection in Azure
By default, the installed agent does not send all possible data. You must configure Azure to tell the agent what logs and metrics to collect.
1. In your Log Analytics workspace, navigate to **Settings** > **Agents**.
2. Click on the **Syslog** tab.
3. Click **Add facility**. Add common Linux facilities such as `syslog`, `auth`, `authpriv`, and `daemon`.
4. For each facility, select the severity levels you want to collect (e.g., Info, Notice, Warning, Error, Critical).
5. Click **Apply**.
6. Switch to the **Linux Performance Counters** tab.
7. Click **Add performance counter** to track metrics like CPU usage (`% Processor Time`), Memory (`Available MBytes`), and Disk Space (`% Used Space`).
8. Click **Apply**.
Azure will now push this configuration down to the Linux agent. Within 5-10 minutes, the agent will begin streaming the requested telemetry.
## Step 6: Querying the Linux Data using KQL
Once the data is flowing, you can query it using the Kusto Query Language (KQL) in Azure Monitor.
1. In your Log Analytics workspace, click on **Logs** in the left navigation pane.
2. Close the default query template window.
3. To view the raw Syslog data coming from your Linux server, type the following query and click **Run**:
“`kusto
Syslog
| where TimeGenerated > ago(24h)
| limit 50
“`
4. To view CPU performance metrics:
“`kusto
Perf
| where ObjectName == “Processor” and CounterName == “% Processor Time”
| summarize AvgCpu = avg(CounterValue) by Computer, bin(TimeGenerated, 1h)
| render timechart
“`
## Conclusion
By deploying the Azure Log Analytics agent, you effectively bridge the gap between your Linux infrastructure and the Microsoft cloud ecosystem. This allows you to utilize Azure’s powerful Kusto Query Language, automated alerting, and dashboarding capabilities to monitor your Linux servers alongside your Windows infrastructure in a single pane of glass.