Log Analytics Agents Management

%3CLINGO-SUB%20id%3D%22lingo-sub-2696430%22%20slang%3D%22en-US%22%3ELog%20Analytics%20Agents%20Management%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2696430%22%20slang%3D%22en-US%22%3E%3CP%3EDear%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20deployed%20LA%20agents%20in%20my%20organization%20and%20when%20I%20checked%20the%20LA%20agents%20management%2C%20i%20saw%2075%20(windows%20-70%20and%20Linux%20-5)%20connected.%20But%20when%20I%20check%20with%20KQL%20Heart%20Beat%2C%20some%20computers%20are%20duplicated%20with%20different%20OS%20names%20and%20versions%20in%20the%20same%20host.%20I've%20attached%20the%20file%20for%20your%20reference.%20How%20can%20be%20possible%20and%20how%20can%20I%20solve%20these%20issues%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20all%2C%20Stay%20Safe.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2698152%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%20Agents%20Management%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2698152%22%20slang%3D%22en-US%22%3EIs%20it%20possible%20multiple%20entries%20as%20the%20agent%20updates%3F%20If%20you%20query%20for%20the%20latest%20record%20for%20each%20Computer%20-%3CBR%20%2F%3E%3CBR%20%2F%3EHeartbeat%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%3CBR%20%2F%3E%3CBR%20%2F%3EWhat%20do%20you%20see%3F%3C%2FLINGO-BODY%3E
Senior Member

Dear All,

 

I deployed LA agents in my organization and when I checked the LA agents management, i saw 75 (windows -70 and Linux -5) connected. But when I check with KQL Heart Beat, some computers are duplicated with different OS names and versions in the same host. I've attached the file for your reference. How can be possible and how can I solve these issues? 

 

Thanks all, Stay Safe.

2 Replies
Is it possible multiple entries as the agent updates? If you query for the latest record for each Computer -

Heartbeat
| summarize arg_max(TimeGenerated, *) by Computer

What do you see?
I was thinking the same.
A distinct on "Computer" should give better insights.