A high-level comparison of monitoring Windows OS with SCOM / OMS and Azure

Article
05/11/2018

A customer wants to move their core OS monitoring off of SCOM and over to OMS or another Azure-based solution. I wrote up this comparison to highlight the key capabilities and differences in each. It's not intended to be an exhaustive list, but as a way to start the conversation.

Note that all the info here is current as of April 2018. Things change all the time, so take that into consideration!

Core OS Monitoring Comparison
	System Center Operations Manager	Azure-based solutions (Azure Monitor, Azure Diagnostics, OMS Log Analytics)
Windows Computer Health State	Monitors based on Availability, Performance, Configuration, Security	Azure Resource Health: https://docs.microsoft.com/en-us/azure/service-health/resource-health-overview SCOM vs OMS Log Analytics: https://docs.microsoft.com/en-us/azure/operations-management-suite/operations-management-suite-monitoring-product-comparison OMS offers a wide variety of other solutions and assessments, including Service Map, and other features beyond the scope of OS monitoring
Data collection	Collects: performance counters, event logs, probe/script-based rules	Use Azure Monitor for host-level monitoring: https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-metrics Use Azure Diagnostics or OMS for guest VM operating system monitoring Azure Diagnostics can collect: Performance data Application logs Windows Event logs Custom error logs created by app or service .NET Event source IIS logs ETW traces Crash dumps Azure diagnostics infrastructure logs OMS can collect: Performance data Windows event logs Custom logs IIS logs Syslog events
Alerting	Monitor-based alerts Event-based alerts Performance (metric)-based alerts Typically <1 minute alerting latency	Metric Alerts (new) by Azure Monitor: includes OMS logs https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-unified-alerts https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-near-real-time-metric-alerts 1-5 minute current latency Azure Monitor classic alerts https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/insights-alerts-portal OMS: Includes routed Diagnostics logs https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-alerts SLA of 6hrs; usually 10-15 min latency Log Analytics alerts will automatically be extended into the new unifed alerts (see above) on May 14, 2018 https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-alerts-extend
Data visualization	Use the SCOM console or web console Built-in dasbhoards, views, reports Ability to custom author dashboards, views, reports Queries OpsMgr database and datawarehouse	Azure Monitor: Azure portal Ability to custom author views, charts Azure Monitor Metrics Explorer (preview) OMS: Log Analytics View Designer PowerBI Service Map Azure Diagnostics: Route data to Azure Application Insights Route data to Microsoft PowerBI Route the data to a third-party visualization tool using either live streaming or by having the tool read from an archive in Azure storage
Administrative effort	Installing and tuning the management pack With both SCOM and Azure, a key part of monitoring is knowing what you want to monitor/collect	Enabling Azure Diagnostics Add the extension to the VM Resource Manager template: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-diagnostics-template?toc=%2fazure%2fvirtual-machines%2fwindows%2ftoc.json Use PowerShell to enable the extension: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/ps-extensions-diagnostics Use Visual Studio to enable the extension: https://docs.microsoft.com/en-us/azure/vs-azure-tools-diagnostics-for-cloud-services-and-virtual-machines#turn-on-diagnostics-on-azure-virtual-machines Enabling OMS For Windows VMs, add the extension to the VM Resource Manager template or use PowerShell: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-oms For Linux VMs, add the extension to the VM Resource Manager template or use Azure CLI: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/extensions-oms Configure data sources from the Data menu in Log Analytics Advanced Settings (any configuration is delivered to all connected sources in your workspace)
Data retention	Two databases: OpsMgr database and Data Warehouse OpsMgr database holds 7 days by default Data Warehouse holds 400 days by default	Archive Azure Diagnostics Logs or Azure Monitor data to storage account to retain forever (or specify retention age) Log Analytics has a retention age of 31 to 730 days

A high-level comparison of monitoring Windows OS with SCOM / OMS and Azure

Additional resources