From 73fd9e8b5c4d6836642b75f8ed99ff18e253872a Mon Sep 17 00:00:00 2001 From: Guy Wild <98332688+guywi-ms@users.noreply.github.com> Date: Thu, 19 Sep 2024 16:40:03 +0300 Subject: [PATCH 1/4] Update workspace-replication.md --- .../logs/workspace-replication.md | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/articles/azure-monitor/logs/workspace-replication.md b/articles/azure-monitor/logs/workspace-replication.md index d9521b2e3f..3e46916c3c 100644 --- a/articles/azure-monitor/logs/workspace-replication.md +++ b/articles/azure-monitor/logs/workspace-replication.md @@ -310,22 +310,31 @@ The `POST` command is a long running operation that can take some time to comple ## Audit the inactive workspace -By default, Azure Monitor run queries in your _active_ region. The active region is typically your primary region in your primary workspace. During switchover, the secondary workspace becomes _active_ and the primary region is _inactive_. +By default, Azure Monitor runs queries in your _active_ region. The active region is typically your primary region in your primary workspace. During switchover, the secondary workspace becomes _active_ and the primary region is _inactive_. In some cases, you might want to query the _inactive_ region. For example, you might want to ensure that your secondary workspace has complete replication of ingested logs before you switch over. +By default, your workspace’s active region is the region where you create the workspace, and the inactive region is the secondary region, where you create the replicated workspace. +When you trigger failover, this switches – the secondary region is activated, and primary region becomes inactive. We say it's inactive because it’s not the direct target of log ingestion and query requests. +It's useful to query the inactive region before you switch between regions to verify that the workspace in the inactive region has the logs you expect to see there. + ### Query inactive region -To query the available logs on the inactive workspace: +To query log data in the inactive region, use this GET command: -1. In the Azure portal, go to your Log Analytics workspace. -1. On the left, select **Logs**. -1. On the query toolbar, select **More tools** (...) at the right. -1. Enable **Query inactive region**. +```http +GET + +api.loganalytics.azure.com/v1/workspaces//query?query=×pan=P1D&overrideWorkspaceRegion= +``` - :::image type="content" source="media/workspace-replication/query-inactive-region.png" alt-text="Screenshot that shows how to query the inactive region through the workspace Logs page in the Azure portal." lightbox="media/workspace-replication/query-inactive-region.png"::: +For example, to run a simple query like `Perf | count` in your secondary region, use: -After you enable the **Query inactive region** option, Log Analytics shows query results for the inactive region rather than the active region. +```http +GET + +api.loganalytics.azure.com/v1/workspaces//query?query=Perf%20|%20count×pan=P1D&overrideWorkspaceRegion=secondary +``` You can confirm that Azure Monitor runs your query in the intended region by checking these fields in the `LAQueryLogs` table, which is created when you [enable query auditing in your Log Analytics workspace](query-audit.md): From 03c82f850c7db540b7c6dae6bc408be6abcc317b Mon Sep 17 00:00:00 2001 From: guywi-ms Date: Thu, 19 Sep 2024 17:31:59 +0300 Subject: [PATCH 2/4] Update workspace-replication.md --- articles/azure-monitor/logs/workspace-replication.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/articles/azure-monitor/logs/workspace-replication.md b/articles/azure-monitor/logs/workspace-replication.md index 3e46916c3c..ded952a9c6 100644 --- a/articles/azure-monitor/logs/workspace-replication.md +++ b/articles/azure-monitor/logs/workspace-replication.md @@ -310,12 +310,11 @@ The `POST` command is a long running operation that can take some time to comple ## Audit the inactive workspace -By default, Azure Monitor runs queries in your _active_ region. The active region is typically your primary region in your primary workspace. During switchover, the secondary workspace becomes _active_ and the primary region is _inactive_. - -In some cases, you might want to query the _inactive_ region. For example, you might want to ensure that your secondary workspace has complete replication of ingested logs before you switch over. By default, your workspace’s active region is the region where you create the workspace, and the inactive region is the secondary region, where you create the replicated workspace. + When you trigger failover, this switches – the secondary region is activated, and primary region becomes inactive. We say it's inactive because it’s not the direct target of log ingestion and query requests. + It's useful to query the inactive region before you switch between regions to verify that the workspace in the inactive region has the logs you expect to see there. ### Query inactive region From d750b3c2ac496fc5d15db003d5be3a4ae33b04df Mon Sep 17 00:00:00 2001 From: guywi-ms Date: Thu, 19 Sep 2024 17:48:44 +0300 Subject: [PATCH 3/4] Update workspace-replication.md --- articles/azure-monitor/logs/workspace-replication.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/articles/azure-monitor/logs/workspace-replication.md b/articles/azure-monitor/logs/workspace-replication.md index ded952a9c6..353f75c1f8 100644 --- a/articles/azure-monitor/logs/workspace-replication.md +++ b/articles/azure-monitor/logs/workspace-replication.md @@ -324,10 +324,10 @@ To query log data in the inactive region, use this GET command: ```http GET -api.loganalytics.azure.com/v1/workspaces//query?query=×pan=P1D&overrideWorkspaceRegion= +api.loganalytics.azure.com/v1/workspaces//query?query=×pan=&overrideWorkspaceRegion= ``` -For example, to run a simple query like `Perf | count` in your secondary region, use: +For example, to run a simple query like `Perf | count` for the past day in your secondary region, use: ```http GET From 9e2c1eb94452488ed96784b5bd5e75a9b293c846 Mon Sep 17 00:00:00 2001 From: Guy Wild <98332688+guywi-ms@users.noreply.github.com> Date: Sun, 22 Sep 2024 16:03:37 +0300 Subject: [PATCH 4/4] Update workspace-replication.md --- articles/azure-monitor/logs/workspace-replication.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/articles/azure-monitor/logs/workspace-replication.md b/articles/azure-monitor/logs/workspace-replication.md index 353f75c1f8..19e98e57fe 100644 --- a/articles/azure-monitor/logs/workspace-replication.md +++ b/articles/azure-monitor/logs/workspace-replication.md @@ -310,8 +310,7 @@ The `POST` command is a long running operation that can take some time to comple ## Audit the inactive workspace - -By default, your workspace’s active region is the region where you create the workspace, and the inactive region is the secondary region, where you create the replicated workspace. +By default, your workspace’s active region is the region where you create the workspace, and the inactive region is the secondary region, where Azure Monitor creates the replicated workspace. When you trigger failover, this switches – the secondary region is activated, and primary region becomes inactive. We say it's inactive because it’s not the direct target of log ingestion and query requests.