10-16-2017 11:58 AM
10-16-2017 11:58 AM
I have multiple client environments streaming data to Log Analytics. What are the pros and cons to use a single instance versus individual instnaces of Log Analytics. Please point me to the business benefits . Thank you.
10-16-2017 01:07 PM - edited 10-19-2017 02:49 PM
Hi Avijeet, I'm started to use multiples instances for my clients. But latest the resource "Computer Groups" is launched I have trying to use my costumers on single instance. After that I am keeping my alerts so identified. Recently I think we will can associate a selected type of license to a determined costumer. It`s will be great to use one environment to me on terms of administration.
10-16-2017 10:40 PMSolution
10-17-2017 04:32 AM
Interesting question which I also gave quite some thought. There is no doubt a single instance is easier. However, there are two issues I have in an (large) enterprise environment.
I need to separate the different operate groups such as DBA, Server Ops, Security. They all need their own, customized home page in OMS. I don't see how I can manage that in the same workspace, the RBAC is not that sophisticated.
The other issues is the amount of data in the individual instances and the complexity of the workspaces. DBAs only want data and solutions related to certain Azure Resource Types, they have no interest in e.g. Windows event logs and VM related solutions. Security might also require a much longer retention time then operations.
In smaller environments I tend to use a single workspace, but in larger ones I'm leaning towards multiple workspaces. Any thoughts on that?
10-17-2017 05:25 AM
10-23-2017 10:14 AM
Hi, Thanks for sharing the pros and cons of having a shared Log Analytics instance versus multiple workspaces for unique/individual client needs. In the case with multiple Log Analytics workspaces, can you please share the reference model/architecture that meet these needs?
From my perspective, I think we need to consider the following steps for the first client setup and repeat step 2 through step 4 for the next cleint :
@Stanislav Zhelyazkov can you please validate the architecture and process? Thank you.
10-23-2017 10:44 PM
02-18-2019 03:59 PM
Other reason for multiple workspaces are the data retention and cost impact. Some data you need 2 years, other only form the last 30 days