Log Analytics has introduced a new feature called workspace replication, which enhances resilience to regional incidents. This feature allows users to create a copy of their workspace in another region. Once replication is enabled, any new logs added to the primary workspace will also be replicated to the secondary workspace. However, existing logs will not be copied over to the secondary workspace. The secondary workspace cannot be directly accessed or managed, and its main purpose is to create an active-passive setup for users. This means that at any given time, there is one active instance and one inactive instance of the workspace that is updated in the background.
In the event of an outage affecting the primary workspace, users can switch to the secondary workspace by enabling failover. This action redirects all ingest and query requests to the secondary workspace, allowing users to continue monitoring their resources and applications as needed. The secondary workspace stores a copy of all logs ingested since replication was enabled, enabling users to seamlessly switch over and continue using alerts, workbooks, and other services that access their logs, such as Sentinel. Additionally, during this period, the secondary region also replicates incoming records to the primary workspace. This allows users to return to the primary region once it is healthy again and continue working as usual.
Workspace replication is charged based on the amount of data replicated in GB. Users have the option to apply replication to a subset of their data collection rules (DCR) in order to limit the scope of replication and related costs. More detailed pricing information can be found on the Azure Monitor pricing page.
For further information on workspace replication, users are encouraged to consult the Workspace Replication Documentation.
Article Source
https://azure.microsoft.com/en-us/updates/log-analytics-workspace-replication-public-preview/
