How to Find AMA Agent Installed on Azure Virtual Machines using KQL Query?

Azure Monitor Agent, simply known as AMA. It is a software agent that collects monitoring data from Windows and Linux machines, in Azure and non-Azure environments, including on-premises and third-party clouds. There are two types of AMA agents:

• Azure Monitor Agent for Windows installed for Azure Windows Servers. This collects data from Windows machines, such as event logs, performance counters, and system metrics.
• Azure Monitor Agent for Linux is installed for Azure Linux Servers. This Linux agent collects data from Linux machines, such as syslogs and performance counters.

Checking whether the Azure Monitor Agent (AMA) is installed or not is a difficult task when you have a lot many Azure virtual machines (VMs). To simplify the process, in this article, we will use the Azure Kusto Query Language (KQL) resource graph query to quickly check which Azure VMs are installed with the Azure Monitor Agent for Windows and the Azure Monitor Agent for Linux. Azure Portal Access and RBAC policy read access to play a major role in knowing more about RBAC policy read access to play a major role.

When to Use Azure Monitor Agent (AMA)?

AMA is useful when you want to collect logs and performance data from your Azure or on-premises servers. Here’s when you should use it:

1. For Security and Compliance

If you need to follow rules (like GDPR or HIPAA), AMA helps you track who is using your servers and what they are doing.

Example: You need to know who logged in to your server and when.

2. To Check Server Performance

Want to see if your server is running slow? AMA shows you things like CPU usage, memory, and disk space.

Example: If a website is slow, AMA can tell you if it’s due to high CPU usage.

3. To Collect All Logs in One Place

If you have many servers, checking each one for logs is hard. AMA sends all logs to one dashboard so it’s easy to search and analyze.

Example: Instead of logging into 10 servers, you check one dashboard for all logs.

4. For Hybrid Environments (Cloud + On-Premise)

Using both Azure and on-premise servers? AMA can monitor both, so you get a full view.

Example: You have one app in Azure and one on your local server AMA tracks both.

5. To Save Money on Monitoring

AMA lets you choose what data to collect. You can skip things you don’t need and reduce costs.

Example: Collect only security logs from production servers, not from test machines.

Steps to Find the AMA Agent Installed Azure Virtual Machines

You can easily find the AMA agent installed in an Azure virtual machine by following these steps:

Step 1: Log in to the Azure Portal

Step 2: Access the Azure Resource Graph Explorer from the global search

Step 3: Select the target scope, either subscription or management group

Step 4: Run the Query in Azure Resource Graph Explorer

For Windows Azure Virtual Machines: Copy and paste the below KQL Azure Resource Graph in Resource Graph Explorer to fetch the details of Azure Virtual machines installed with the Azure Monitoring Windows Agent.

resources
| where type == "microsoft.compute/virtualmachines/extensions"
| extend VMName = split(id, "/")
| where name has "AzureMonitorWindowsAgent"
| extend SubscriptionName=case(
subscriptionId =~ 'add subscription id', 'add subscription name',
subscriptionId)
| project VMName=VMName[-3], AgentName=name, SubscriptionName

For Linux Azure Virtual Machines: Copy paste the below KQL Azure Resource Graph in Resource Graph Explorer to fetch the details of Azure Virtual machines installed with Azure Monitoring Linux Agent.

resources
| where type == "microsoft.compute/virtualmachines/extensions"
| extend VMName = split(id, "/")
| where name has "AzureMonitorLinuxAgent"
| extend SubscriptionName=case(
subscriptionId =~ 'add subscription id', 'add subscription name',
subscriptionId)
| project VMName=VMName[-3], AgentName=name, SubscriptionName

Both Windows and Linux Azure Virtual Machines: Use this KQL query to fetch the details of both Azure Monitoring Windows Agent and Linux Agent.

resources
| where type == "microsoft.compute/virtualmachines/extensions"
| extend VMName = split(id, "/")
| where name has "AzureMonitorWindowsAgent" or name has "AzureMonitorLinuxAgent"
| extend SubscriptionName=case(
subscriptionId =~ 'add subscription id', 'add subscription name',
subscriptionId)
| project VMName=VMName[-3], AgentName=name, SubscriptionName

That it! I hope these Azure Kusto Query Language (KQL) resource graph query will helps you to quickly check the Azure VMs installed with the Azure Monitor Agent (AMA).

Benefits of Using the Azure Monitor Agent

The following are the benefits of using the Azure Monitor Agent:

• Single Agent for All Data Collection Needs: With Azure Monitor Agent you can collect data from any sources such as Azure virtual machines, on-premises servers, and cloud-based applications.
• Reduce Cost: Azure Monitor Agent uses data collection rules which enables targeted and granular data collection, which will help to reduce monitoring cost.
• Security and Performance: Azure Monitor Agent is designed to be secure and efficient. With log data you can monitor and secure your applications or improve performance.
• Simplified management: Azure Monitor Agent can be managed using Azure Policy, which makes it easy for you to enforce consistent configurations across your machines.

Conclusion

Azure Monitor Agent (AMA) helps you collect logs and performance data from Azure and non-Azure servers, whether they run on Windows or Linux. It’s useful for security, compliance, troubleshooting, and performance tracking. With easy KQL queries in Azure Resource Graph, you can quickly find which VMs have AMA installed. It supports hybrid environments, saves monitoring costs, and is simple to manage with Azure Policy. In short we can say that AMA makes server monitoring easier, smarter, and more efficient.