You may already know that you can multi-home Azure Log Analytics Agents. However did you know that you can multi-home them when one of your Log Analytics sources is a SCOM Management Server? Yes you can. As well as any custom logs you create, you can simply add extra keys and workspace IDs to your script and call the ingestion CMDlet twice.
This is the scenario I have in my lab. My lab servers are all joined to my SCOM environment, and my SCOM environment is sending data to a workspace. Then I added the workspace ID and key under the Azure Log Analytics tab on the agent.
Custom Log Multi-Home
Perhaps you have a custom IoT device or an application that multiple groups need to monitor, with custom logs its a simple matter of adding extra keys and calling the cmdlet twice.
# Replace with your Workspace ID $CustomerId = "workspace 1 here" $invokeID = "workspace 2 here" # Replace with your Primary Key $SharedKey = "hey1 here" $invokekey = "key2 here" # Specify the name of the record type that you'll be creating $LogType = "your custom log" # Specify a field with the created time for the records $TimeStampField = get-date $TimeStampField = $TimeStampField.GetDateTimeFormats(115) # Submit the data to the API endpoint Send-OMSAPIIngestionFile -customerId $customerId -sharedKey $sharedKey -body $weather -logType $logType Send-OMSAPIIngestionFile -customerId $invokeID -sharedKey $invokekey -body $weather -logType $logType
Recap and Notes
- Multi-home Azure Log Analytics agents to multiple workspaces
- You can multi-home the agent even when your agent is already reporting to SCOM and Log Analytics
- Multi-home your custom logs
Some things to remember, not every Log Analytics solution is likely to work when you multi-home the agents. For instance, if you have the Update Management solution installed in one workspace, and try to add it to another workspace with agents from the first, it will throw an error for those agents. This makes sense because you don’t want two different sources managing your windows updates.