How to remove log analytics agent from azure vm to minimise the duplicate costs incurred by azure monitor agent and log analytics agent

Ishan Saxena 40

As Azure is depreciating log analytics agent, we have configured azure monitor agent as well due to which we got message displaying - The virtual machine is onboarded via Microsoft monitoring agent as well as azure monitoring agent resulting in duplication of data and increases cost.

How can we remove log analytics agent so double costing is not incurred.

tbgangav-MSFT 10,421 Reputation points

2023-10-30T04:37:14.71+00:00

Hi @Ishan Saxena ,

Just checking in to see if you got chance to look at the below response. If yes, do you have any follow-up questions as it is still not accepted?

1 answer

tbgangav-MSFT 10,421 Reputation points

2023-10-12T16:31:17.1833333+00:00
Hi @Ishan Saxena ,

To remove the Log Analytics agent from an Azure VM, you can follow these steps:

Sign in to the Azure portal.

In the Azure portal, select Virtual Machines.

From the list, select the VM that has the Log Analytics agent installed.

On the left, select Extensions. On the Extensions page, select the Log Analytics agent extension.

On the extension properties page, select Uninstall.

After you have uninstalled the Log Analytics agent, you should verify that no Log Analytics agents are still connected to your Log Analytics workspace. To do this, you can run a log query in Log Analytics. This query will show the last heartbeat for each computer. If a computer has both agents, it will return two records, each with a different category. The Azure Monitor agent will have a category of Azure Monitor Agent. The Log Analytics agent will have a category of Direct Agent. If you find that there are still machines with both agents sending data to your Log Analytics workspace, you should remove the Log Analytics agent from those machines to avoid duplicate data and extra ingestion costs.

References:

Manage and maintain the Log Analytics agent for Windows and Linux

Migrate from Log Analytics agent to Azure Monitor Agent
Please sign in to rate this answer.
Ishan Saxena 40 Reputation points

2023-10-31T07:38:42.47+00:00

Hi @tbgangav-MSFT,

I configured azure monitor agent on existing log analytics configured vm, now it has 3 extensions -

AzureMonitorWindowsAgent

DependencyAgentWindows

MicrosoftMonitorinAgent

I guess i have to uninstall Dependency and MicrosoftMonitoring agent to delete the log analytics data being generated.

Could you please confirm or there is some other step that also has to be performed.

tbgangav-MSFT 10,421 Reputation points

2023-10-31T14:05:07.13+00:00

Hi @Ishan Saxena ,

Yes, you could uninstall MicrosoftMonitorinAgent. If your DependencyAgentWindows extension i.e., Windows Dependency Agent is installed by enabling AMA in its settings then you need not uninstall DependencyAgentWindows. Otherwise, Dependency Agent sends data to Log Analytics agent so you could uninstall it in that case. For more information with regards to it, refer this this Azure document.

Ishan Saxena 40 Reputation points

2023-11-03T21:03:13.5266667+00:00

Thanks for the information. Could you please confirm how can we check that the data is not duplicating by stored by both Azure monitor agent and log analytics agent?

tbgangav-MSFT 10,421 Reputation points

2023-11-06T03:51:56.2666667+00:00

Hi @Ishan Saxena ,

You could run a log query, may be to show the last heartbeat for each computer. If a computer has both agents, it will return two records, each with a different category.

Muthu Kugan Muthusivakumar (INFOSYS LIMITED) 0 Reputation points Microsoft Vendor

2024-12-26T08:51:51.4933333+00:00

Hi Team,

we have created a DCR and we have added the Virtual machines to it. In the logs I could see category with Direct agent with two different versions. In this thread it is mentioned that category would be direct agent for log analytics agent and Azure monitor agent for Azure Monitor Agent.

I would like to know whether the Azure Monitor Agent also will show as Direct Agent or the Mutiple log analytics agent could have been installed and I wonder whether it could be possible. Please assist.

Muthu Kugan Muthusivakumar (INFOSYS LIMITED) 0 Reputation points Microsoft Vendor

2024-12-26T08:56:39.2433333+00:00

Hi Team,

I could see both the agents with same category as Direct agent. What does that it meant? Is it possible to have multiple log analytics agent could be installed in the server?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to remove log analytics agent from azure vm to minimise the duplicate costs incurred by azure monitor agent and log analytics agent

1 answer

Your answer