Log Analytics Workspace Test

A Log Analytics workspace is a unique environment for log data from Azure Monitor and other Azure services. Each workspace has its own data repository and configuration but might combine data from multiple services.

You can use a single workspace for all your data collection. You can also create multiple workspaces based on requirements such as:

The geographic location of the data.
Access rights that define which users can access data.
Configuration settings like pricing tiers and data retention.

Each workspace contains multiple tables that are organized into separate columns with multiple rows of data. Each table is defined by a unique set of columns. Rows of data provided by the data source share those columns. Log queries define columns of data to retrieve and provide output to different features of Azure Monitor and other services that use workspaces.

Azure Monitor costs can vary significantly based on the volume of data being collected in the Log Analytics workspace. This volume is affected by the set of solutions using the workspace and the amount of data that each solution collects.

Using the Log Analytics Workspace test, you can track the amount of data each workspace collects, in terms of the number of tables and entries in every workspace. If a workspace is billable, then this information will help administrators guage the Azure Monitor costs that may apply to each workspace. Detailed diagnostics will point you to the precise tables that will likely contribute the most to the costs, because of their size or the number of entries.

Target of the Test: A Microsoft Azure Subscription

Agent deploying the test: A remote agent

Output of the test: One set of results for each log analytics workspace in every resource group

Configurable parameters for the test
Parameters	Description
Test Period	How often should the test be executed.
Host	The host for which the test is to be configured.
Subscription ID	Specify the GUID which uniquely identifies the Microsoft Azure Subscription to be monitored. To know the ID that maps to the target subscription, do the following: Login to the Microsoft Azure Portal. When the portal opens, click on the Subscriptions option (as indicated by Figure 4). Figure 4 : Clicking on the Subscriptions option Figure 5 that appears next will list all the subscriptions that have been configured for the target Azure AD tenant. Locate the subscription that is being monitored in the list, and check the value displayed for that subscription in the Subscription ID column. Figure 5 : Determining the Subscription ID Copy the Subscription ID in Figure 5 to the text box corresponding to the SUBSCRIPTION ID parameter in the test configuration page.
Tenant ID	Specify the Directory ID of the Azure AD tenant to which the target subscription belongs. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor a Microsoft Azure Subscription Using Azure ARM REST API.
Client ID, Client Password, and Confirm Password	To connect to the target subscription, the eG agent requires an Access token in the form of an Application ID and the client secret value. For this purpose, you should register a new application with the Azure AD tenant. To know how to create such an application and determine its Application ID and client secret, refer to Configuring the eG Agent to Monitor a Microsoft Azure Subscription Using Azure ARM REST API. Specify the Application ID of the created Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box.
Proxy Host and Proxy Port	In some environments, all communication with the Azure cloud be routed through a proxy server. In such environments, you should make sure that the eG agent connects to the cloud via the proxy server and collects metrics. To enable metrics collection via a proxy, specify the IP address of the proxy server and the port at which the server listens against the Proxy Host and Proxy Port parameters. By default, these parameters are set to none, indicating that the eG agent is not configured to communicate via a proxy, by default.
Proxy Username, Proxy Password and Confirm Password	If the proxy server requires authentication, then, specify a valid proxy user name and password in the Proxy Username and Proxy Password parameters, respectively. Then, confirm the password by retyping it in the Confirm Password text box.
Log Analytics Workspace Name	By default, this test monitors all log analytics workspaces. This is why, this parameter is set to all by default. If you want only specific log analytics workspaces to be monitored, then, you can specify these workspace names as a comma-separated list.
DD Frequency	Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.
Detailed Diagnosis	To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled: The eG manager license should allow the detailed diagnosis capability Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measures made by the test:

Measurement

Description

Measurement Unit

Interpretation

Total size of log analytics workspace

Indicates the total size of this log analytics workspace.

Compare the value of this measure across log analytics workspaces to identify the workspace which is of the largest size, and may probably cost the most.

To know which tables are contributing the maximum to the size and cost of the log analytics workspace, use the detailed diagnosis of this measure.

Entries in log analytics workspace

Indicates the total number of entries in this log analytics workspace.

Number

Compare the value of this measure across log analytics workspaces to identify the workspace which has the highest number of entries, and may probably cost the most.

To know which tables are contributing the maximum to the size and cost of the log analytics workspace, use the detailed diagnosis of this measure.

Is the log analytics workspace billable?

Indicates whether/not this log analytics workspace is billable.

The values of this measure and their corresponding numeric values are listed in the table below:

Measure Value	Numeric Value
True	1
False	0

Note:

By default, this measure reports the Measure Values listed in the table above to indicate whether/not the log analytics workspace is billable. In the graph of this measure however, the same is represented using the numeric equivalents only.