With large scale implementation of Azure, the Log Analytics Workspace volume could increase and the default value for retention is quite long if you are not changing it.
This PowerShell script will help you to reset the 2 retention values applied in Workspace Tables (Live and Total).
I applied a selection criteria based in name as we are using a naming convention with status (prod, vs nonprod), you can anyway adapt this part with your context.
#Install-Module -Name Az -Repository PSGallery -Force
Import-module Az
Connect-AzAccount
$RetentionDays = 30
$TotalRetentionDays = 30
$AzureRetentionDays = 90
$AzureTotalRetentionDays = 90
$namecriteria = "nonprod"
$All_Az_Subscriptions = Get-AzSubscription
Foreach ($Az_Subscription in $All_Az_Subscriptions)
{
###################################################
#Set the context
Write-Host "Working on subscription ""$($Az_Subscription.Name)"""
Set-AzContext -SubscriptionObject $Az_Subscription | Out-Null
$AllWorkspaces = Get-AzOperationalInsightsWorkspace
foreach ($myWorkspace in $AllWorkspaces)
{
Write-Host " ---------------", $myWorkspace.Name ,"---------------- " -foregroundcolor "gray"
if ($myWorkspace.Name -match $namecriteria)
{
Write-Host " >>> WORKSPACE TO APPLY RETENTION ADJUSTMENT:", $myWorkspace.Name -foregroundcolor "green"
if ($myWorkspace.retentionInDays -gt $RetentionDays)
{
Write-Host " >>> APPLYING DEFAULT RETENTION PERIOD:", $RetentionDays -foregroundcolor "yellow"
Set-AzOperationalInsightsWorkspace -ResourceGroupName $myWorkspace.ResourceGroupName -Name $myWorkspace.Name -RetentionInDays $RetentionDays
}
$GetAllTables = Get-AzOperationalInsightsTable -ResourceGroupName $myWorkspace.ResourceGroupName -WorkspaceName $myWorkspace.Name
foreach ($MyTable in $GetAllTables)
{
if (($MyTable.Name -eq "AzureActivity") -or ($MyTable.Name -eq "Usage"))
{
if (($MyTable.RetentionInDays -gt $AzureRetentionDays) -or ($MyTable.TotalRetentionInDays -gt $AzureTotalRetentionDays))
{
Write-Host " >>> APPLYING SPECIFIC RETENTION PERIOD:", $AzureRetentionDays, "- TABLE:", $MyTable.Name -foregroundcolor "yellow"
Update-AzOperationalInsightsTable -ResourceGroupName $MyTable.ResourceGroupName -WorkspaceName $MyTable.WorkspaceName -TableName $MyTable.Name -RetentionInDays $AzureRetentionDays -TotalRetentionInDays $AzureTotalRetentionDays
}
else
{
Write-Host " >>> NO CHANGE FOR RETENTION PERIOD FOR TABLE:", $MyTable.Name -foregroundcolor "green"
}
}
else
{
if (($MyTable.RetentionInDays -gt $RetentionDays) -or ($MyTable.TotalRetentionInDays -gt $RetentionDays))
{
Write-Host " >>> APPLYING NEW RETENTION PERIOD:", $RetentionDays, "- TABLE:", $MyTable.Name -foregroundcolor "yellow"
Update-AzOperationalInsightsTable -ResourceGroupName $MyTable.ResourceGroupName -WorkspaceName $MyTable.WorkspaceName -TableName $MyTable.Name -RetentionInDays $RetentionDays -TotalRetentionInDays $TotalRetentionDays
}
else
{
Write-Host " >>> NO CHANGE FOR RETENTION PERIOD FOR TABLE:", $MyTable.Name -foregroundcolor "green"
}
}
}
}
else
{
Write-Host " >>> WORKSPACE NOT CONCERNED BY THIS CHANGE:", $myWorkspace.Name -foregroundcolor "green"
}
}
}
With this script, we reduced the Workspace cost for non prod drastically maintaining only the last 30 days live without any archive.
The material used for this script is:
Fabrice Romelard
