Microsoft Monitoring Agent (MMA)

What is Microsoft Monitoring Agent?

Microsoft Monitoring Agent (MMA) is a service used to watch and report on application and system health on a Windows computer. It collects and reports a variety of data, including performance metrics, trace information and event logs.

Software developers use MMA to check the performance of new builds. Systems administrators use it to oversee application functionality and performance for enterprise systems.

How is Microsoft Monitoring Agent used?

Administrators use MMA for infrastructure monitoring through System Center Operations Manager (SCOM). The agent watches and determines the health of monitored systems and sends a report to the management server. SCOM management packs can dictate the data collected, run tasks and other workflows for the agent.

MMA can also provide application performance monitoring (APM) through SCOM, letting developers and administrators monitor web applications and Windows services written with .NET framework. Similarly, MMA can operate in standalone mode and perform basic APM using IntelliTrace logs through a development platform, such as Microsoft Visual Studio.

The agent can perform continuous application monitoring, providing information about .NET framework application performance and potential disruptions that could affect application availability or user experience. When SCOM is deployed, the MMA supports continuous monitoring with System Center APM using the .NET Application Performance Monitoring template. SCOM receives the alerts about application performance problems and failures and then translates the alerts into IntelliTrace files that are usable through Visual Studio. Running in standalone mode, administrators can control the MMA for data collection and continuous monitoring with PowerShell cmdlets.

In actual operation, the MMA sends its collected data as well as information about the state and performance of the agent itself to a management server. The server records the collected data to a database.

Data is typically sent based on triggers. For example, data might only be sent from the MMA to a management server if the data sample differs by a specific amount -- such as 10% -- from the established norm. Using triggers in this way reduces network traffic and limits the size of the database. The only regular data sent from the MMA involves a data packet every 60 seconds called a heartbeat, intended to verify the communication between the MMA and management server.

What is the role of the Azure Monitor Agent?

Microsoft Azure Monitor Agent (AMA) performs many of the tasks associated with MMA. AMA collects monitoring data from the operating systems (OSes) of Azure virtual machines (VMs) and communicates the collected data to Azure Monitor. Other Azure services, such as Microsoft Sentinel and Microsoft Defender for Cloud, then use the data Azure Monitor collected.

AMAs can be installed in the following three situations:

• VMs can install them using VM extensions through the Azure extension framework.
• On-premises servers that are Azure Arc-enabled can install AMAs to Azure VMs using the extension framework once the Azure Arc agent is installed.
• Windows 10 and 11 desktops and laptops can install AMAs through the Windows MSI installer.

Once installed, AMAs can collect and exchange four major data types with Azure Monitor:

• Performance data about the OS and workloads can be sent to Azure Monitor Metrics.
• Windows event and Sysmon logs can be sent to Azure Log Analytics workspace.
• Syslog data can be sent to Log Analytics workspace.
• Text logs and Windows Information Internet Services logs can be sent to Log Analytics workspace.

AMA replaces older legacy Azure Monitor agent versions, including Log Analytics agent, Telegraf agent and Diagnostics extension. Systems with legacy Log Analytics agents should be upgraded to AMA, and legacy agents won't be supported after August 2024. It's worth noting that Azure Monitor Agent is free, but Azure users might incur Azure cloud data upload and storage costs.

What are the three MMA modes?

The Microsoft Monitoring Agent works in the following three modes:

• Monitor mode. This collects data and events, such as critical exceptions. It's the typical operating mode for MMAs.
• Trace mode. This uses the MMA to gather IntelliTrace data for analysis and reporting through Microsoft Visual Studio.
• Custom mode. This lets administrators change the data collection plan to customize monitoring according to the organization's unique needs.

How is MMA installed and uninstalled?

MMA can be installed and managed through one of three methods:

• Console. The SCOM console discovers and installs MMAs. This is the most common approach. It requires a management server with administrative access to the target computer, and the ability to connect to the target computer with remote procure call.
• Image. This involves installing the agent using a base image that is part of the computer's preparation or software pre-installation process. Active Directory support can also be added to automatically connect the newly configured computer to a management sever.
• Manual. The agent can be deployed manually using any software distribution tool or platform. Manual installation also requires that the agent is manually updated.

Most data centers and enterprise environments use a combination of these methods to ensure that all systems receive an appropriate management agent.

Installation isn't required or allowed on computers that host System Center Essentials, System Center Service Manager or other components of the management server architecture, such as the gateway server, operations console and operational database. These systems already have a native MMA version installed.

What are the benefits and challenges of MMA?

Microsoft Monitoring Agent is a proven tool in agent-based system monitoring schemes, but MMA users should consider some of the tradeoffs before implementing it. Some of the benefits in using MMA include the following:

• Insight. MMA provides broad and uniform insights into the performance and health of OSes and workloads. Each device runs the same agent, so the type and quality of monitoring data is well-understood, and all data is centrally collected and reported.
• Metrics. MMAs can access and collect a large range of metrics, letting administrators easily identify problems and disruptions.
• Versatility. MMAs operate across a range of Windows and Linux computer endpoints, servers, and VMs, so an organization can monitor a majority of vital systems and workloads.

However, agent-based monitoring such as MMAs aren't perfect or seamless across an IT infrastructure. Adopters should consider potential challenges:

• Scope. Ideally, MMA will operate on every system in the enterprise, letting administrators observe the entire environment. But any systems not running MMA or not within the monitoring schema, such as a computer that doesn't meet system requirements for the agent, will leave gaps in system monitoring. Consider whether the agent is fully compatible with every system that needs monitoring.
• Overhead. Agents communicate over and store data on the network. Ideally, this overhead is insignificant, but many monitored systems can impose measurable overhead on networks and storage. Consider the storage and network traffic demands of the monitoring environment.
• Time. Agents such as MMA report problems, but there may be a delay between an actual issue and the issue being communicated to the central monitoring server and the monitoring server issuing reports or alerts. Be sure that the monitoring platform can communicate problems to administrators in a timely manner that meets the organization's needs.
• Maintenance. Once agents are installed, they must be managed, patched and updated. Damaged or malfunctioning agents can be identified and corrected. Otherwise, aging agents may no longer communicate with newer management servers, and damaged agents may leave monitoring gaps. Consider how a fleet of agents should be managed across the infrastructure.

Find out about other application performance monitoring tools that might be helpful to your organization.