Setting up the OMS Agent in Proxied Environments
When deploying the Log Analytics agent in proxied environments, we need to ensure that the installer and agent are configured to use the proxy for connectivity.
Configuring sudo with HTTP proxy support
The installer utilises sudo
to run a few commands which might fail if the proxy is not configured for sudo
.
If the proxy is configured via environment variables such as http_proxy
or https_proxy
, we’ll need to ensure that these variables and their respective values are inherited when using sudo
. When using sudo
, a new environment is instantiated so variables such as http_proxy
or https_proxy
may be unset.
To configure sudo
to preserve these environment variables, add the following to your /etc/sudoers
file.
Defaults env_keep += "http_proxy https_proxy"
Configuring the agent for use with an HTTP proxy server
There are a number ways to configure the agent to utilise a HTTP proxy server. The most common way to configure the proxy for the agent is during installation.
sudo sh ./omsagent-*.universal.x64.sh --upgrade -p http://<proxy user>:<proxy password>@<proxy address>:<proxy port> -w <workspace id> -s <shared key>
If the proxy doesn’t require credentials, just enter the proxy address and port
Post-Installation - If you installed the agent without passing the -p
parameter for the proxy, you can define a proxy configuration file post-installation in /etc/opt/microsoft/omsagent/proxy.conf
.
proxyconf="https://proxyuser:proxypassword@proxyserver01:8080"
sudo echo $proxyconf >>/etc/opt/microsoft/omsagent/proxy.conf
sudo chown omsagent:omiusers /etc/opt/microsoft/omsagent/proxy.conf
sudo chmod 600 /etc/opt/microsoft/omsagent/proxy.conf
sudo /opt/microsoft/omsagent/bin/service_control restart
Replace proxyconf
with the correct credentials and URL to your proxy.
Firewall requirements:
Agent Resource | Ports | Direction | Bypass HTTPS inspection |
---|---|---|---|
*.ods.opinsights.azure.com | Port 443 | Outbound | Yes |
*.oms.opinsights.azure.com | Port 443 | Outbound | Yes |
*.blob.core.windows.net | Port 443 | Outbound | Yes |
*.azure-automation.net | Port 443 | Outbound | Yes |