Forum Discussion
Single vs. multiple instances of Log Analytics
- With single instance you will have to manage RBAC only on that instance with multiple you will have the burden to manage it on all of them. If you need to create a query that goes across multiple workspaces you will have to explicitly write in the query the workspaces you want to query. If you do not have any regulatory reasons to keep data in multiple workspaces I would suggest to move to a single one. The more data you have the better analysis you can do on your data.
Interesting question which I also gave quite some thought. There is no doubt a single instance is easier. However, there are two issues I have in an (large) enterprise environment.
I need to separate the different operate groups such as DBA, Server Ops, Security. They all need their own, customized home page in OMS. I don't see how I can manage that in the same workspace, the RBAC is not that sophisticated.
The other issues is the amount of data in the individual instances and the complexity of the workspaces. DBAs only want data and solutions related to certain Azure Resource Types, they have no interest in e.g. Windows event logs and VM related solutions. Security might also require a much longer retention time then operations.
In smaller environments I tend to use a single workspace, but in larger ones I'm leaning towards multiple workspaces. Any thoughts on that?
Hi, Thanks for sharing the pros and cons of having a shared Log Analytics instance versus multiple workspaces for unique/individual client needs. In the case with multiple Log Analytics workspaces, can you please share the reference model/architecture that meet these needs?
From my perspective, I think we need to consider the following steps for the first client setup and repeat step 2 through step 4 for the next cleint :
- Have an Azure subscription.
- Choose a workspace name.
- Associate the workspace with the subscription.
- Choose a geographical location.
Stanislav_Zhelyazkov can you please validate the architecture and process? Thank you.
- Hi, There isn't reference architecture or model when you have multiple workspaces. It depends on your scenario and requirements why would you have multiple workspaces and how you will use them. The agent even supports connecting to multiple workspaces so you could even have different solutions enabled on different workspaces for the same server. It really depends on your scenarios and your requirements. The steps below are not something that applies to Log Analytics. Log Analytics is an Azure service. As an Azure service you will need to have Azure Subscription. Inside your Azure subscription you choose to deploy Log Analytics with name and region.
Other reason for multiple workspaces are the data retention and cost impact. Some data you need 2 years, other only form the last 30 days
