High availability and disaster recovery
IBM® Log Analysis is a highly available, multi-tenant, regional service for analyzing logs from your applications, platform resources and infrastructure. In this topic, you can learn more about IBM Log Analysis's availability and disaster recovery strategies.
As of 28 March 2024 the IBM Log Analysis and IBM Cloud Activity Tracker services are deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs, which replaces these two services, prior to 30 March 2025. For information about IBM Cloud Logs, see the IBM Cloud Logs documentation.
Availability zones
An availability zone is a logically and physically isolated location within an IBM Cloud region where your data is processed and hosted.
- An availability zone has independent power, cooling, and network infrastructures that are isolated from other zones to strengthen fault tolerance by avoiding single points of failure between zones.
- An availability zone offers high bandwidth and low inter-zone latency within a region.
A region (location) is a geographically and physically separate group of one or more availability zones with independent electrical and network infrastructures isolated from other regions.
- Regions are designed to remove shared single points of failure with other regions and guarantee low inter-zone latency within the region.
- Each region has 3 different data centers (DC) for redundancy.
The following table lists the high-availability (HA) status for the regions (locations) where the IBM Log Analysis service is available:
Geography | Region | EU-Supported | HA Status |
---|---|---|---|
Asia Pacific |
Chennai (in-che) |
N/A |
SZR |
Asia Pacific |
Tokyo (jp-tok) |
N/A |
MZR |
Asia Pacific |
Osaka (jp-osa) |
N/A |
MZR |
Asia Pacific |
Sydney (au-syd) |
N/A |
MZR |
Europe |
Frankfurt (eu-de) |
YES |
MZR |
Europe |
London (eu-gb) |
NO |
MZR |
North America |
Dallas (us-south) |
N/A |
MZR |
North America |
Washington (us-east) |
N/A |
MZR |
North America |
Toronto (ca-tor) |
N/A |
MZR |
South America |
Sao Paulo (br-sao) |
N/A |
MZR |
Where
-
A geography is a geographic area or larger political body that contains one or more regions.
-
A region is a defined geographic territory.
A region could be a specific postal code area, a town, a city, a state, a group of states, or even a group of countries.
A region contains multiple availability zones to meet local access, low latency, and security requirements for the region.
-
N/A
means feature that is not applicable to that geography. -
MZR
means multi-zone region. Learn more. -
SZR
means single-zone region. Learn more.
Availability of a logging instance
When you provision a logging instance, you select the location where the instance is created. The region determines where the logging data is processed and the data is hosted.
A multizone region (MZR) consist of 3 or more availability zones that are independent from each other to ensure that single failure events affect only a single zone.
By default, each logging instance consist of 3 zones, one primary zone and two secondary zones:
- Each zone is located in a different data center in the region.
- The data in your primary zone is automatically replicated to the secondary zones with low latency. You don't need to do anything to enable the replication.
- The service is designed to withstand a single zone failure with no interruption.
The MZR architecture offers automatic failover between zones within the region, and high availability for a logging instance withing a region.
The SZR architecture offers failover across 3 distinct systems within the single datacenter so that you get high availability from a system failure, but not from a datacenter failure.
Disaster recovery (DR) of the logging service in a region
Disaster recovery is about surviving a catastrophic failure or loss of availability in a region.
IBM Log Analysis follows IBM Cloud requirements for planning and recovering from disaster events.
If a regional disaster occurs, consider the following information:
- The estimated recovery time for rebuilding the regional site and restoring the service at another location is 24 hours.
- Older data will not be available when the service is restored. Services that are restored will be available to receive data buffered at end points during course of the outage and future ingested data. Data previously retained is available through your archives and is not reloaded into your service instance. You can access your archive data directly in IBM Cloud Object Storage or use the Data Engine service to access it.
- You might have 1 or more logging instances in the region. When these service instances are available in the new location, you will be able to use them. However, you will have to update the endpoints of applications and logging agents to point to the ingestion endpoint in the new location.
DR recovery time
The following table indicates the estimated recovery times in the event of a DR situation:
Recovery objective for DR | Estimated time |
---|---|
Maximum Tolerable Downtime (MTD) / Recovery Time Objective (RTO) | Less than 24 hours |
Recovery Point Objective (RPO) | Less than 4 hours |