0

At my company, we have a dashboard showing all Virtual Machines on Azure, highlighting any missing Windows or Linux Patches, then marking VMs with missing patches over 30 days old as non-compliant, to alert teams to patch the VM (auto patching is not always an option due to the downtime). We now want to add VM ScaleSet VMs to this wallboard, but I cannot see how. The Microsoft Monitoring agent doesn't seem to be installed on any of the ScaleSet VMs, so I cannot see how to query them. Currently with the standard VMs I query using log analytics queries.

Is there any solution to this without having to ask the dev teams to install the monitoring agent on all the scalesets VMs (if that's even possible).

Andy in the UK
  • 3
  • 3

1 Answers1

0

First of all without the agent installed, you will not be able to collect any logs from within that machine. It's definitely possible to install the Log Analytics Agent (Will be replaced by the Azure Monitor Agent, that's currently in preview) on Scale Sets. You can get your dev team to do it but we've encountered a lot of issues with that.

We build images via pipelines and not all our images are rebuilt frequently and we noticed we started facing issues with the MMA certificate getting expired for some reason. We barely had time to investigate as Policies were already being rolled out.

The best practice to deploy MMA to Scale Sets is to use an Azure Policy - it also ensures compliance. Any machine built automatically gets it and you can be confident it will be installed. It will DeployIfNotExists. The two links below will redirect you to the Azure Policy in your own Azure Portal.

  1. Windows VMSS Policy for Log Analytics Agent
  2. Linux VMSS Policy for Log Analytics Agent

One thing you should be aware is that if the upgrade mode on your Scale Set is Manual instead of Rolling/Automatic then you'll need to manually upgrade them for the agent installation to take effect.

Ked Mardemootoo
  • 1,480
  • 1
  • 5
  • 19
  • Thank you. That's a perfect answer for what I need. I'll discuss internally the policy suggestion. We already have a policy for normal VMs to install this and point at a set WS, so this is just adding more policies but to handle VMSS instead. – Andy in the UK Jun 03 '21 at 15:46