Multi-Home with Azure Log Analytics SCOM, Custom Logs

You may already know that you can multi-home Azure Log Analytics Agents. However did you know that you can multi-home them when one of your Log Analytics sources is a SCOM Management Server? Yes you can. As well as any custom logs you create, you can simply add extra keys and workspace IDs to your script and call the ingestion CMDlet twice.

This is the scenario I have in my lab. My lab servers are all joined to my SCOM environment, and my SCOM environment is sending data to a workspace. Then I added the workspace ID and key under the Azure Log Analytics tab on the agent.

Custom Log Multi-Home

Perhaps you have a custom IoT device or an application that multiple groups need to monitor, with custom logs its a simple matter of adding extra keys and calling the cmdlet twice.

# Replace with your Workspace ID
$CustomerId = "workspace 1 here"
$invokeID = "workspace 2 here"

# Replace with your Primary Key
$SharedKey = "hey1 here"
$invokekey = "key2 here"

# Specify the name of the record type that you'll be creating
$LogType = "your custom log"

# Specify a field with the created time for the records
$TimeStampField = get-date
$TimeStampField = $TimeStampField.GetDateTimeFormats(115)

# Submit the data to the API endpoint
Send-OMSAPIIngestionFile -customerId $customerId -sharedKey $sharedKey -body $weather -logType $logType
Send-OMSAPIIngestionFile -customerId $invokeID -sharedKey $invokekey -body $weather -logType $logType

and that is how you can Multi-Home Azure Log Analytics custom logs. There are a number of uses for this. Perhaps you want to send production data to a “lab” workspace to test with the data. Or as mentioned previously, you have two different groups that need to see the data but don’t want to share a workspace.

Recap and Notes

You can:

Multi-home Azure Log Analytics agents to multiple workspaces
You can multi-home the agent even when your agent is already reporting to SCOM and Log Analytics
Multi-home your custom logs

Some things to remember, not every Log Analytics solution is likely to work when you multi-home the agents. For instance, if you have the Update Management solution installed in one workspace, and try to add it to another workspace with agents from the first, it will throw an error for those agents. This makes sense because you don’t want two different sources managing your windows updates.