|
1 | 1 | --- |
2 | | -title: Configure proxy and firewall settings in Azure Log Analytics | Microsoft Docs |
3 | | -description: Configure proxy and firewall settings when your agents or OMS services need to use specific ports. |
4 | | -services: log-analytics |
5 | | -documentationcenter: '' |
6 | | -author: bandersmsft |
7 | | -manager: carmonm |
8 | | -editor: '' |
9 | | -ms.assetid: b55ebd80-efd4-4220-971b-c18aea1b1ab2 |
10 | | -ms.service: log-analytics |
11 | | -ms.workload: na |
12 | | -ms.tgt_pltfrm: na |
13 | | -ms.devlang: na |
14 | | -ms.topic: get-started-article |
15 | | -ms.date: 04/12/2017 |
16 | | -ms.author: banders;magoedte |
17 | | - |
| 2 | +redirect_url: /azure/log-analytics/log-analytics-windows-agents |
18 | 3 | --- |
19 | | -# Configure proxy and firewall settings in Log Analytics |
20 | | -Actions needed to configure proxy and firewall settings for Log Analytics differ for the type of agents that you are using. Review the following sections for the type of agent that you use. |
21 | | - |
22 | | -## Settings for the OMS Gateway |
23 | | - |
24 | | -If your agents do not have Internet access, they can instead send their data using your own network resources to the OMS Gateway. The Gateway collects their data and sends it to the OMS service on their behalf. |
25 | | - |
26 | | -Configure agents that communicate with the OMS Gateway using its fully qualified domain name and custom port number. |
27 | | - |
28 | | -The OMS Gateway needs Internet access. Use the same proxy server or firewall settings for the OMS Gateway that you would for the type of agents you have. For more information about the OMS Gateway, see [Connect computers and devices to OMS using the OMS Gateway](log-analytics-oms-gateway.md). |
29 | | - |
30 | | -## Configure settings with the Microsoft Monitoring Agent |
31 | | -For the Microsoft Monitoring Agent to connect to and register with the OMS service, it must have access to the port number of your domains and the URLs. If you use a proxy server for communication between the agent and the OMS service, you’ll need to ensure that the appropriate resources are accessible. If you use a firewall to restrict access to the Internet, you need to configure your firewall to permit access to OMS. The following tables list the ports that OMS needs. |
32 | | - |
33 | | -| **Agent Resource** | **Ports** | **Bypass HTTPS inspection** | |
34 | | -| --- | --- | --- | |
35 | | -| \*.ods.opinsights.azure.com |443 |Yes | |
36 | | -| \*.oms.opinsights.azure.com |443 |Yes | |
37 | | -| \*.blob.core.windows.net |443 |Yes | |
38 | | -| \*.azure-automation.net |443 |Yes | |
39 | | - |
40 | | -You can use the following procedure to configure proxy settings for the Microsoft Monitoring Agent using Control Panel. You'll need to use the procedure for each server. If you have many servers that you need to configure, you might find it easier to use a script to automate this process. If so, see the next procedure [To configure proxy settings for the Microsoft Monitoring Agent using a script](#to-configure-proxy-settings-for-the-microsoft-monitoring-agent-using-a-script). |
41 | | - |
42 | | -### To configure proxy settings for the Microsoft Monitoring Agent using Control Panel |
43 | | -1. Open **Control Panel**. |
44 | | -2. Open **Microsoft Monitoring Agent**. |
45 | | -3. Click the **Proxy Settings** tab.<br> |
46 | | -  |
47 | | -4. Select **Use a proxy server** and type the URL and port number, if one is needed, similar to the example shown. If your proxy server requires authentication, type the username and password to access the proxy server. |
48 | | - |
49 | | -Use the following procedure to create a PowerShell script that you can run to set the proxy settings for each agent that connects directly to servers. |
50 | | - |
51 | | -### To configure proxy settings for the Microsoft Monitoring Agent using a script |
52 | | -Copy the following sample, update it with information specific to your environment, save it with a PS1 file name extension, and then run the script on each computer that connects directly to the OMS service. |
53 | | - |
54 | | - param($ProxyDomainName="http://proxy.contoso.com:80", $cred=(Get-Credential)) |
55 | | - |
56 | | - # First we get the Health Service configuration object. We need to determine if we |
57 | | - #have the right update rollup with the API we need. If not, no need to run the rest of the script. |
58 | | - $healthServiceSettings = New-Object -ComObject 'AgentConfigManager.MgmtSvcCfg' |
59 | | - |
60 | | - $proxyMethod = $healthServiceSettings | Get-Member -Name 'SetProxyInfo' |
61 | | - |
62 | | - if (!$proxyMethod) |
63 | | - { |
64 | | - Write-Output 'Health Service proxy API not present, will not update settings.' |
65 | | - return |
66 | | - } |
67 | | - |
68 | | - Write-Output "Clearing proxy settings." |
69 | | - $healthServiceSettings.SetProxyInfo('', '', '') |
70 | | - |
71 | | - $ProxyUserName = $cred.username |
72 | | - |
73 | | - Write-Output "Setting proxy to $ProxyDomainName with proxy username $ProxyUserName." |
74 | | - $healthServiceSettings.SetProxyInfo($ProxyDomainName, $ProxyUserName, $cred.GetNetworkCredential().password) |
75 | | - |
76 | | - |
77 | | -## Configure settings with Operations Manager |
78 | | -For an Operations Manager management group to connect to and register with the OMS service, it must have access to the port numbers of your domains and URLs. If you use a proxy server for communication between the Operations Manager management server and the OMS service, you’ll need to ensure that the appropriate resources are accessible. If you use a firewall to restrict access to the Internet, you need to configure your firewall to permit access to OMS. Even if an Operations Manager management server is not behind a proxy server, its agents might be. In this case, the proxy server should be configured in the same manner as agents are in order to enable and allow Security and Log Management solution data to get sent to the OMS web service. |
79 | | - |
80 | | -In order for Operations Manager agents to communicate with the OMS service, your Operations Manager infrastructure (including agents) should have the correct proxy settings and version. The proxy setting for agents is specified in the Operations Manager console. Your version should be one of the following: |
81 | | - |
82 | | -* Operations Manager 2012 SP1 Update Rollup 7 or later |
83 | | -* Operations Manager 2012 R2 Update Rollup 3 or later |
84 | | - |
85 | | -The following tables list the ports related to these tasks. |
86 | | - |
87 | | -> [!NOTE] |
88 | | -> Some of the following resources mention Advisor and Operational Insights, both were previous versions of OMS. However, the listed resources will change in the future. |
89 | | -> |
90 | | -> |
91 | | -
|
92 | | -Here's a list of agent resources and ports:<br> |
93 | | - |
94 | | -| **Agent resource** | **Ports** | |
95 | | -| --- | --- | |
96 | | -| \*.ods.opinsights.azure.com |443 | |
97 | | -| \*.oms.opinsights.azure.com |443 | |
98 | | -| \*.blob.core.windows.net/\* |443 | |
99 | | - |
100 | | -<br> |
101 | | -Here's a list of management server resources and ports:<br> |
102 | | - |
103 | | -| **Management server resource** | **Ports** | **Bypass HTTPS inspection** | |
104 | | -| --- | --- | --- | |
105 | | -| service.systemcenteradvisor.com |443 | | |
106 | | -| \*.service.opinsights.azure.com |443 | | |
107 | | -| \*.blob.core.windows.net |443 |Yes | |
108 | | -| \*.ods.opinsights.azure.com |443 |Yes | |
109 | | -| \*.azure-automation.net |443 |Yes | |
110 | | - |
111 | | -<br> |
112 | | -Here's a list of OMS and Operations Manager console resources and ports.<br> |
113 | | - |
114 | | -| **OMS and Operations Manager console resource** | **Ports** | |
115 | | -| --- | --- | |
116 | | -| service.systemcenteradvisor.com |443 | |
117 | | -| \*.service.opinsights.azure.com |443 | |
118 | | -| \*.live.com |Port 80 and 443 | |
119 | | -| \*.microsoft.com |Port 80 and 443 | |
120 | | -| \*.microsoftonline.com |Port 80 and 443 | |
121 | | -| \*.mms.microsoft.com |Port 80 and 443 | |
122 | | -| login.windows.net |Port 80 and 443 | |
123 | | - |
124 | | -<br> |
125 | | - |
126 | | -Use the following procedures to register your Operations Manager management group with the OMS service. If you are having communication problems between the management group and the OMS service, use the validation procedures to troubleshoot data transmission to the OMS service. |
127 | | - |
128 | | -### To request exceptions for the OMS service endpoints |
129 | | -1. Use the information from the first table presented previously to ensure that the resources needed for the Operations Manager management server are accessible through any firewalls you might have. |
130 | | -2. Use the information from the second table presented previously to ensure that the resources needed for the Operations console in Operations Manager and OMS are accessible through any firewalls you might have. |
131 | | -3. If you use a proxy server with Internet Explorer, ensure that it is configured and works correctly. To verify, you can open a secure web connection (HTTPS), for example [https://bing.com](https://bing.com). If the secure web connection doesn’t work in a browser, it probably won’t work in the Operations Manager management console with web services in the cloud. |
132 | | - |
133 | | -### To configure the proxy server in the Operations Manager console |
134 | | -1. Open the Operations Manager console and select the **Administration** workspace. |
135 | | -2. Expand **Operational Insights**, and then select **Operational Insights Connection**.<br> |
136 | | -  |
137 | | -3. In the OMS Connection view, click **Configure Proxy Server**.<br> |
138 | | -  |
139 | | -4. In Operational Insights Settings Wizard: Proxy Server, select **Use a proxy server to access the Operational Insights Web Service**, and then type the URL with the port number, for example, **http://myproxy:80**.<br> |
140 | | -  |
141 | | - |
142 | | -### To specify credentials if the proxy server requires authentication |
143 | | - Proxy server credentials and settings need to propagate to managed computers that will report to OMS. Those servers should be in the *Microsoft System Center Advisor Monitoring Server Group*. Credentials are encrypted in the registry of each server in the group. |
144 | | - |
145 | | -1. Open the Operations Manager console and select the **Administration** workspace. |
146 | | -2. Under **RunAs Configuration**, select **Profiles**. |
147 | | -3. Open the **System Center Advisor Run As Profile Proxy** profile.<br> |
148 | | -  |
149 | | -4. In the Run As Profile Wizard, click **Add** to use a Run As account. You can create a new Run As account or use an existing account. This account needs to have sufficient permissions to pass through the proxy server.<br> |
150 | | -  |
151 | | -5. To set the account to manage, choose **A selected class, group, or object** to open the Object Search box.<br> |
152 | | -  |
153 | | -6. Search for then select **Microsoft System Center Advisor Monitoring Server Group**.<br> |
154 | | -  |
155 | | -7. Click **OK** to close the Add a Run As account box.<br> |
156 | | -  |
157 | | -8. Complete the wizard and save the changes.<br> |
158 | | -  |
159 | | - |
160 | | -### To validate that OMS management packs are downloaded |
161 | | -If you've added solutions to OMS, you can view them in the Operations Manager console as management packs under **Administration**. Search for *System Center Advisor* to quickly find them.<br> |
162 | | -  <br> |
163 | | -Or, you can also check for OMS management packs by using the following Windows PowerShell command in the Operations Manager management server: |
164 | | - |
165 | | - ``` |
166 | | - Get-ScomManagementPack | where {$_.DisplayName -match 'Advisor'} | select Name,DisplayName,Version,KeyToken |
167 | | - ``` |
168 | | - |
169 | | -### To validate that Operations Manager is sending data to the OMS service |
170 | | -1. In the Operations Manager management server, open Performance Monitor (perfmon.exe), and select **Performance Monitor**. |
171 | | -2. Click **Add**, and then select **Health Service Management Groups**. |
172 | | -3. Add all the counters that start with **HTTP**.<br> |
173 | | -  |
174 | | -4. If your Operations Manager configuration is good, you will see activity for Health Service Management counters for events and other data items, based on the management packs that you added in OMS and the configured log collection policy.<br> |
175 | | -  |
176 | | - |
177 | | -## Next steps |
178 | | -* [Add Log Analytics solutions from the Solutions Gallery](log-analytics-add-solutions.md) to add functionality and gather data. |
179 | | -* Get familiar with [log searches](log-analytics-log-searches.md) to view detailed information gathered by solutions. |
0 commit comments