A high-level comparison of monitoring Windows OS with SCOM / OMS and Azure

Core OS Monitoring Comparison 

• Monitors based on Availability, Performance, Configuration, Security

• Azure Resource Health: https://docs.microsoft.com/en-us/azure/service-health/resource-health-overview
• SCOM vs OMS Log Analytics: https://docs.microsoft.com/en-us/azure/operations-management-suite/operations-management-suite-monitoring-product-comparison
• OMS offers a wide variety of other solutions and assessments, including Service Map, and other features beyond the scope of OS monitoring

• Collects:
  • performance counters,
  • event logs,
  • probe/script-based rules

• Use Azure Monitor for host-level monitoring: https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-metrics
• Use Azure Diagnostics or OMS for guest VM operating system monitoring
• Azure Diagnostics can collect:
  • Performance data
  • Application logs
  • Windows Event logs
  • Custom error logs created by app or service
  • .NET Event source
  • IIS logs
  • ETW traces
  • Crash dumps
  • Azure diagnostics infrastructure logs
• OMS can collect:
  • Performance data
  • Windows event logs
  • Custom logs
  • IIS logs
  • Syslog events

• Monitor-based alerts
• Event-based alerts
• Performance (metric)-based alerts
• Typically <1 minute alerting latency

• Metric Alerts (new) by Azure Monitor:
  • includes OMS logs
  • https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-unified-alerts
  • https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-near-real-time-metric-alerts
  • 1-5 minute current latency
• Azure Monitor classic alerts
  • https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/insights-alerts-portal
• OMS:
  • Includes routed Diagnostics logs
  • https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-alerts
  • SLA of 6hrs; usually 10-15 min latency
  • Log Analytics alerts will automatically be extended into the new unifed alerts (see above) on May 14, 2018 https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-alerts-extend

• Use the SCOM console or web console
• Built-in dasbhoards, views, reports
• Ability to custom author dashboards, views, reports
• Queries OpsMgr database and datawarehouse

• Azure Monitor:
  • Azure portal
  • Ability to custom author views, charts
  • Azure Monitor Metrics Explorer (preview)
• OMS:
  • Log Analytics
  • View Designer
  • PowerBI
  • Service Map
• Azure Diagnostics:
  • Route data to Azure Application Insights
  • Route data to Microsoft PowerBI
  • Route the data to a third-party visualization tool using either live streaming or by having the tool read from an archive in Azure storage

• Installing and tuning the management pack
  • With both SCOM and Azure, a key part of monitoring is knowing what you want to monitor/collect

• Enabling Azure Diagnostics
  • Add the extension to the VM Resource Manager template: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-diagnostics-template?toc=%2fazure%2fvirtual-machines%2fwindows%2ftoc.json
  • Use PowerShell to enable the extension: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/ps-extensions-diagnostics
  • Use Visual Studio to enable the extension: https://docs.microsoft.com/en-us/azure/vs-azure-tools-diagnostics-for-cloud-services-and-virtual-machines#turn-on-diagnostics-on-azure-virtual-machines
• Enabling OMS
  • For Windows VMs, add the extension to the VM Resource Manager template or use PowerShell: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-oms
  • For Linux VMs, add the extension to the VM Resource Manager template or use Azure CLI: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/extensions-oms
  • Configure data sources from the Data menu in Log Analytics Advanced Settings (any configuration is delivered to all connected sources in your workspace)

• Two databases: OpsMgr database and Data Warehouse
• OpsMgr database holds 7 days by default
• Data Warehouse holds 400 days by default

• Archive Azure Diagnostics Logs or Azure Monitor data to storage account to retain forever (or specify retention age)
• Log Analytics has a retention age of 31 to 730 days