Rediger

Manage Network Watcher Agent virtual machine extension

The Network Watcher Agent virtual machine extension is a requirement for some of Azure Network Watcher features that capture network traffic to diagnose and monitor Azure virtual machines (VMs). For more information, see What is Azure Network Watcher?

In this article, you learn how to install, update, and uninstall Network Watcher Agent for Windows and Linux. Installation of the agent doesn't disrupt, or require a reboot of the virtual machine. If the virtual machine is deployed by an Azure service, check the documentation of the service to determine whether the service permits installing extensions in the virtual machine.

Note

Network Watcher Agent extension isn't supported on AKS clusters.

Prerequisites

  • An Azure virtual machine (VM) running a supported operating system. For more information, see Supported operating systems.

  • Outbound TCP connectivity to 169.254.169.254 over port 80 and 168.63.129.16 over port 8037. The agent uses these IP addresses to communicate with the Azure platform.

  • Internet connectivity: Network Watcher Agent requires internet connectivity for some features to work properly. For example, it requires connectivity to your storage account to upload packet captures.

Supported operating systems

You can install the Network Watcher Agent extension for Windows on the following operating systems:

  • Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 releases.
  • Windows 10 and 11 releases.

Note

Currently, Nano Server isn't supported.

You can install the Network Watcher Agent extension for Linux on the following Linux distributions:

Distribution Version
AlmaLinux 9.2
Azure Linux 2.0
CentOS 1 6.10 and 7
Debian 7 and 8
openSUSE Leap 42.3+
Oracle Linux 6.10 2, 7, 8, and 9+
Red Hat Enterprise Linux (RHEL) 6.10 3, 7, 8, and 9.2
Rocky Linux 9.1
SUSE Linux Enterprise Server (SLES) 12 and 15 (SP2, SP3, and SP4)
Ubuntu 16+

1 CentOS Linux reached its end of life (EOL) on June 30, 2024. For more information, see the CentOS End Of Life guidance.

2 Extended life cycle (ELS) support for Oracle Linux version 6.X ended on July 1, 2024.

3 Extended life cycle (ELS) support for Red Hat Enterprise Linux 6.X ended on June 30, 2024.

Note

Internet Control Message Protocol (ICMP) monitoring isn't currently supported in the Network Watcher Agent on Oracle Linux due to known kernel-level limitations specific to the distro.

Extension schema

The following JSON shows the schema for the Network Watcher Agent extension. The extension doesn't require or support any user-supplied settings, and it relies on its default configuration.

{
    "name": "[concat(parameters('vmName'), '/AzureNetworkWatcherExtension')]",
    "type": "Microsoft.Compute/virtualMachines/extensions",
    "apiVersion": "2023-03-01",
    "location": "[resourceGroup().location]",
    "dependsOn": [
        "[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
    ],
    "properties": {
        "autoUpgradeMinorVersion": true,
        "publisher": "Microsoft.Azure.NetworkWatcher",
        "type": "NetworkWatcherAgentWindows",
        "typeHandlerVersion": "1.4"
    }
}

{
    "name": "[concat(parameters('vmName'), '/AzureNetworkWatcherExtension')]",
    "type": "Microsoft.Compute/virtualMachines/extensions",
    "apiVersion": "2023-03-01",
    "location": "[resourceGroup().location]",
    "dependsOn": [
        "[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
    ],
    "properties": {
        "autoUpgradeMinorVersion": true,
        "publisher": "Microsoft.Azure.NetworkWatcher",
        "type": "NetworkWatcherAgentLinux",
        "typeHandlerVersion": "1.4"
    }
}

List installed extensions

From the virtual machine page in the Azure portal, you can view the installed extensions by following these steps:

  1. Under Settings, select Extensions + applications.

  2. In the Extensions tab, you can see all installed extensions on the virtual machine. If the list is long, use the search box to filter the list.

    Screenshot that shows how to view installed extensions on a VM in the Azure portal.

    Screenshot that shows how to view installed extensions on a VM in the Azure portal.

Install Network Watcher Agent VM extension

From the virtual machine page in the Azure portal, you can install the Network Watcher Agent VM extension by following these steps:

  1. Under Settings, select Extensions + applications.

  2. Select + Add, search for Network Watcher Agent, and install it. If the extension is already installed, you can see it in the list of extensions.

    Screenshot that shows the VM's extensions page in the Azure portal.

  3. In the search box of Install an Extension, enter Network Watcher Agent, select the matching extension for your operating system from the list, and then select Next.

    Screenshot that shows how to install Network Watcher Agent for Windows in the Azure portal.

    Screenshot that shows how to install Network Watcher Agent for Linux in the Azure portal.

  4. Select Review + create and then select Create.

Update Network Watcher Agent VM extension

Check your extension version

You can check your extension version by using the Azure portal, the Azure CLI, or PowerShell.

  1. Go to Extensions + applications of your VM in the Azure portal.

  2. In the extensions list, check the Version column for AzureNetworkWatcherExtension. If a newer version is available, the Latest Version column shows (Update Available).

    Screenshot that shows the Network Watcher extension.

Note

The latest version of the Network Watcher extension is 1.4.4011.1.

Enable automatic upgrade

Automatic upgrade lets the Azure platform update the extension to the latest version without manual intervention. Use the following steps to check whether automatic upgrade is enabled, and to enable it if it's not.

  1. Under Settings of your VM in the Azure portal, select Extensions + applications.

  2. Select AzureNetworkWatcherExtension from the list of extensions, and check the Automatic upgrade status column.

  3. If it shows Disabled, select Enable automatic upgrade from the toolbar.

    Screenshot that shows the Network Watcher extension.

  4. Select Yes to confirm.

    Screenshot that shows the confirmation dialog for enabling automatic upgrade on the Network Watcher extension.

Note

After you enable automatic upgrade, Azure updates the extension automatically without requiring a restart of the virtual machine. This process can take up to 30 days after a new version is released.

Update manually

  1. Under Settings of your VM in the Azure portal, select Extensions + applications.

  2. Select AzureNetworkWatcherExtension from the list of extensions, and then select Update from the toolbar.

    Screenshot that shows the Network Watcher extension.

  3. Select Yes to confirm.

    Screenshot that shows the confirmation dialog for updating the Network Watcher extension to the latest version.

  4. When the update finishes, the Version and Latest Version columns show the same version number.

    Screenshot that shows the Network Watcher extension after it's updated to the latest version.

If updating doesn't apply the latest version, remove the extension and install it again:

  1. Select AzureNetworkWatcherExtension from the list of extensions, and then select Uninstall.
  2. Select + Add, search for Network Watcher Agent, and install it again. The platform automatically installs the latest available version. For more information, see Install Network Watcher Agent VM extension.

Update at scale with a PowerShell script

If you have large deployments, use a PowerShell script to update multiple VMs in a subscription at once. The following script updates the Network Watcher extension on all out-of-date VMs in a subscription:

<#
    .SYNOPSIS
    This script scans all VMs in the provided subscription and upgrades any out-of-date AzureNetworkWatcherExtensions to the latest available version.
    .DESCRIPTION
    This script is a no-op if AzureNetworkWatcherExtensions are already up to date.
    Requires Azure PowerShell 4.2 or higher to be installed.
    .EXAMPLE
    .\UpdateVMAgentsInSub.ps1 -SubID aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e -NoUpdate
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory=$true)]
    [string] $SubID,
    [Parameter(Mandatory=$false)]
    [Switch] $NoUpdate = $false
)
function Get-LatestExtensionVersion($location, $extensionType)
{
    $latestImage = Get-AzVMExtensionImage -Location $location -PublisherName "Microsoft.Azure.NetworkWatcher" -Type $extensionType |
        Sort-Object -Property { [Version]$_.Version } -Descending |
        Select-Object -First 1
    return $latestImage.Version
}
Write-Host "Scanning all VMs in the subscription: $($SubID)"
Set-AzContext -SubscriptionId $SubID
$vms = Get-AzVM
$foundVMs = $false
Write-Host "Starting VM search, this may take a while"
foreach ($vmName in $vms)
{
    # Get Detailed VM info
    $vm = Get-AzVM -ResourceGroupName $vmName.ResourceGroupName -Name $vmName.name -Status
    $isitWindows = $vm.OsName -like "*Windows*"
    $type = if ($isitWindows) { "NetworkWatcherAgentWindows" } else { "NetworkWatcherAgentLinux" }
    $latestVersion = Get-LatestExtensionVersion -location $vmName.Location -extensionType $type

    foreach ($extension in $vm.Extensions)
    {
        if ($extension.Name -eq "AzureNetworkWatcherExtension")
        {
            if ([Version]$extension.TypeHandlerVersion -lt [Version]$latestVersion)
            {
                $foundVMs = $true
                if (-not ($NoUpdate))
                {
                    Write-Host "Found VM that needs to be updated: subscriptions/$($SubID)/resourceGroups/$($vm.ResourceGroupName)/providers/Microsoft.Compute/virtualMachines/$($vm.Name) -> Updating to $latestVersion " -NoNewline
                    Remove-AzVMExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -Name "AzureNetworkWatcherExtension" -Force
                    Write-Host "... " -NoNewline
                    Set-AzVMExtension -ResourceGroupName $vm.ResourceGroupName -Location $vmName.Location -VMName $vm.Name -Name "AzureNetworkWatcherExtension" -Publisher "Microsoft.Azure.NetworkWatcher" -Type $type -TypeHandlerVersion $latestVersion
                    Write-Host "Done"
                }
                else
                {
                    Write-Host "Found $(if ($isitWindows) {"Windows"} else {"Linux"}) VM that needs to be updated to $($latestVersion): subscriptions/$($SubID)/resourceGroups/$($vm.ResourceGroupName)/providers/Microsoft.Compute/virtualMachines/$($vm.Name)"
                }
            }
        }
    }
}

if ($foundVMs)
{
    Write-Host "Finished $(if ($NoUpdate) {"searching"} else {"updating"}) out of date AzureNetworkWatcherExtension on VMs"
}
else
{
    Write-Host "All AzureNetworkWatcherExtensions up to date"
}

Uninstall Network Watcher Agent VM extension

From the virtual machine page in the Azure portal, you can uninstall the Network Watcher Agent VM extension by following these steps:

  1. Under Settings, select Extensions + applications.

  2. Select AzureNetworkWatcherExtension from the list of extensions, and then select Uninstall.

    Screenshot that shows how to uninstall Network Watcher Agent for Windows in the Azure portal.

    Screenshot that shows how to uninstall Network Watcher Agent for Linux in the Azure portal.

    Note

    You might see Network Watcher Agent VM extension named differently than AzureNetworkWatcherExtension.

Frequently asked questions (FAQ)

To get answers to the most frequently asked questions about Network Watcher Agent, see Network Watcher Agent FAQ.

Related content

  • Last updated on