In order to use Log Analytics you must have a OMS workspace, which is the dedicated environment of Log Analytics within which we find the data repository and the different solutions. I this article will be considered the different aspects that you should evaluate about the Log Analytics workspaces.
What is a workspace?
A workspace of Log Analytics is nothing more than a container in Azure environment within which are collected, aggregated and analyzed data from different sources and collected by Log Analytics.
To create a workspace, you must have an Azure subscription. Starting from 26 September 2016 In fact, all the workspace must necessarily be connected to an Azure subscription at the time of creation. During the process of creating the workspace you will also give it a name, that is not currently possible to change post creation, and associate it with an existing Resource Group or create a specific one. Finally you are asked in what location create it and what licensing model adopt. In this regard, it is recalled that Log Analytics can be licensed according to the different modes that you can refer to this link.
Figure 1 – Creating a Log Analytics workspace
Figure 2 – Location currently available for creating a workspace
How many workspaces should be created?
Within each Azure subscription you can be created more workspaces. When you need to determine the appropriate number of workspaces to create you should consider the following factors:
- Geographical data location. Geographically distributed companies may need to store data in specific regions to contemplate policies of sovereignty and for compliance reasons. Another aspect to consider may be the presence of other resources in the Azure environment that must report data in Log Analytics. In these scenarios, to avoid charges caused by outbound data transfer, it is good to keep, whenever possible, the resources and the OMS workspace in the same region.
- Data Isolation. If you need to manage data in Log Analytics from different customers (for example Service Provider) or separate organizational units that must be kept isolated for several reasons you may want to create separate workspaces.
- Billing flexibility. You are billed for the workspace so it can be useful, to keep distinct the billing costs and have greater visibility, create separate workspaces for different departments or for different business units.
When considering the number of Log Analytics workspaces that you must create you should keep in mind that if in your environment you have enabled theintegration between System Center Operations Manager and OMS Log Analytics you can connect each Operations Manager management group with only one workspace. The Microsoft Monitoring Agent may instead be configured directly to return the data that both towards Operations Manager towards different workspaces of Log Analytics.
Figure 3 – Configuration of the Microsoft Monitoring Agent to return data to multiple workspaces
How to perform queries across multiple Log Analytics workspaces
Thanks to the new language introduced in recent months in Log Analycts you can now perform queries across multiple Log Analytics workspaces to analyze and aggregate data included in separate workspaces. This type of query you can run it by logging in to the new Advanced Analytics Portal.
When creating queries, to refer to another workspace, you must use the expression workspace(). More details about you can consult them in Microsoft's official documentation.
Figure 4 – Sample query cross workspaces
How to migrate workspaces
The migration of an existing Log Analytics workspace to another Azure subscription can take place directly from Azure portal or by using the cmdlet powershell Move-AzureRmResource. There isn't the ability to migrate the data contained in a workspace to another Log Analytics workspace or change the region where the data resides.
Figure 5 – Select the change of the subscription
Figure 6 – Migrating a workspace to another Azure subscription
Depending on installed solutions might be necessary to repeat the installation of the same solutions post-migration.
Conclusions
When you decide to adopt Log Analytics is appropriate to conduct a detailed assessment to establish the more appropriate deployment design, passing first by the aspects addressed concerning workspaces. Certain choices made at the time of creation of the workspace can not be easily changed later and for this reason it is appropriate to carry them out in a targeted manner, following the deployment best practices, to perform a successful deployment of Log Analytics.
