Upgrade to Azure Monitor Agent 1.36.3 created new group "azuremonitoragent" and users "azureotelcollector" and "azuremetricsext" which is undocumented behaviour

[szeestraten-nina]

We discovered that the upgrade to Azure Monitor Agent in our Azure Arc environment 1.36.3 created new group "azuremonitoragent" and users "azureotelcollector" and "azuremetricsext".

This behaviour was undocumented and not communicated anywhere as far as I can tell.

There was another post that mentioned something similar: https://learn.microsoft.com/en-us/answers/questions/5642028/ama-creating-group-in-linux-vm

See log entries below:

Dec  9 07:05:56 host01 useradd[2397947]: failed adding user 'syslog', data deleted
Dec  9 07:05:59 host01 groupadd[2398047]: group added to /etc/group: name=azuremonitoragent, GID=995
Dec  9 07:05:59 host01 groupadd[2398047]: group added to /etc/gshadow: name=azuremonitoragent
Dec  9 07:05:59 host01 groupadd[2398047]: new group: name=azuremonitoragent, GID=995
Dec  9 07:05:59 host01 useradd[2398054]: new user: name=azureotelcollector, UID=996, GID=995, home=/home/azureotelcollector, shell=/sbin/nologin, from=none
Dec  9 07:06:31 host01 useradd[2398563]: new group: name=azuremetricsext, GID=994
Dec  9 07:06:31 host01 useradd[2398563]: new user: name=azuremetricsext, UID=995, GID=994, home=/home/azuremetricsext, shell=/usr/sbin/nologin, from=none
Dec  9 07:06:32 host01 usermod[2398570]: add 'azuremetricsext' to group 'azuremonitoragent'
Dec  9 07:06:32 host01 usermod[2398570]: add 'azuremetricsext' to shadow group 'azuremonitoragent'
Dec  9 07:06:32 host01 usermod[2398584]: add 'azuremetricsext' to group 'syslog'
Dec  9 07:06:32 host01 usermod[2398584]: add 'azuremetricsext' to shadow group 'syslog'