Check the replica's usable log history before a workspace switchover

Source facts

Log Analytics workspace replication copies table schemas but only replicates logs ingested after activation; older logs are not backfilled. Microsoft recommends accumulating at least a week of data before switchover. The inactive region can be queried through the Log Analytics API to check its actual contents. Switchover is an operator-triggered action, not automatic failover. Microsoft Learn.

For DCR-based ingestion, the rules must be associated with the workspace’s data collection endpoint for replication. Auxiliary tables are unsupported, and Microsoft says not to enable replication on workspaces containing them. Alert rules are not automatically replicated with the workspace. Microsoft Learn.

Applicability

Review supported Log Analytics workspaces configured for cross-region workspace replication. Check the current region-pair and feature-support matrix before using this readiness check; it is not approval for every workspace-dependent service.

DSE recommendation

DSE recommends listing the lookback period and required tables for each essential investigation and alert query. Compare those requirements with the inactive region’s actual history, not the primary’s retention setting. Record any shortened investigation horizon explicitly. Keep alert-rule availability as a separate readiness item, and assign the switchover decision to an operator with the appropriate authority.

Verification

Query the inactive region for representative old and recent events in each required table. Confirm the targeted region, successful replication configuration and applicable ingestion endpoint associations. Exercise the important queries against that data before an approved switchover test. Preserve missing-history findings rather than interpreting a successful replication setting as evidence of a complete historical copy.

Official references

Microsoft Learn: Log Analytics workspace replication.