Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure Monitor Agent (AMA) replaces the Log Analytics agent, also known as Microsoft Monitor Agent (MMA) and OMS, for Windows and Linux machines, in Azure and non-Azure environments, on-premises and other clouds. The agent introduces a simplified, flexible method of configuring data collection using Data Collection Rules (DCRs). This article describes the data fields that change when collected by AMA, critical information for migrating your LAW queries.
Each data change was carefully considered, and the table provides the rational. If you encounter a data field that isn't in the tables file a support request. Your help keeping the tables current and complete is appreciated.
Log analytics workspace tables
W3CIISLog table for Internet Information Services (IIS)
This table collects log data from IIS on Window systems.
| LAW Field | Difference | Reason | Additional Information |
|---|---|---|---|
| sSiteName | Not be populated | depends on customer data collection configuration | The MMA agent could turn on collection by default, but by principle is restricted from making configuration changes in other services. Enable the |
| Fileuri | No longer populated | not required for MMA parity | MMA doesn't collect this field; it was only populated for IIS logs from Azure Cloud Services through the Azure Diagnostics Extension. |
Windows event table
This table collects Events from the Windows Event log. Two other tables, SecurityEvent and Event, also store Windows events.
| LAW Field | Difference | Reason | Additional Information |
|---|---|---|---|
| UserName | MMA enriches the event with the username before ingestion; AMA doesn't perform this enrichment. | The AMA enrichment isn't implemented yet. | AMA principles dictate that the event data should remain unchanged by default. Adding and enriched field adds possible processing errors and extra costs for storage. In this case, the customer demand for the field is very high and work is underway to add the username. |
Perf table for performance counters
The perf table collects performance counters from Windows and Linux agents. It offers insights into the performance of hardware components, operating systems, and applications. The following table shows key differences in how data is reported between OMS and AMA.
| LAW Field | Difference | Reason | Additional Information |
|---|---|---|---|
| InstanceName | Reported as _Total by OMS Reported as total by AMA |
Where ObjectName is "Logical Disk" and CounterName is "% Used Space", the InstanceName value is reported as _Total for records ingested by the OMS agent, and as total for records ingested by the Azure Monitor Agent (AMA).* |
|
| CounterValue | Is rounded to the nearest whole number by OMS but not rounded by AMA | Where ObjectName is "Logical Disk" and CounterName is "% Used Space", the CounterValue value is rounded to the nearest whole number for records ingested by the OMS agent but not rounded for records ingested by the Azure Monitor Agent (AMA).* |
* Doesn't apply to records ingested by the Microsoft Monitoring Agent (MMA) on Windows.
