Azure Monitor 中的诊断设置

使用以下步骤在 Azure 门户中创建新的诊断设置或编辑现有诊断设置。

1. 在 Azure 门户中配置诊断设置的位置取决于资源：

   • For a single resource, select Diagnostic settings under Monitoring on the resource's menu.

     

   • For one or more resources, select Diagnostic settings under Settings on the Azure Monitor menu and then select the resource.

     

   • For the activity log, select Activity log on the Azure Monitor menu and then select Export Activity Logs. 请确保 禁用活动日志的任何旧配置。

     

2. 选择 “添加诊断设置 ”以添加新设置或 “编辑”设置 以编辑现有设置。 如果要发送到同一类型的多个目标，可能需要为资源设置多个诊断设置。

   

3. 为设置指定说明性名称（如果未指定）。

   

4. 要路由的日志和指标：对于日志，请选择 一个类别组 ，或选择要发送到稍后指定的目标的每个类别数据的单个复选框。 每种 Azure 服务的类别列表各不相同。 Select AllMetrics if you want to collect platform metrics.

5. Destination details: Select the checkbox for each destination that should be included in the diagnostic settings and then provide the details for each. 如果选择 Log Analytics 工作区作为目标，则可能需要指定收集模式。 See Collection mode for details.

Use the New-AzDiagnosticSetting cmdlet to create a diagnostic setting with Azure PowerShell. 有关参数说明，请参阅此 cmdlet 的文档。

以下示例 PowerShell 脚本创建一个诊断设置，用于将密钥保管库的所有日志和指标发送到 Log Analytics 工作区。

$KV = Get-AzKeyVault -ResourceGroupName <resource group name> -VaultName <key vault name>
$Law = Get-AzOperationalInsightsWorkspace -ResourceGroupName <resource group name> -Name <workspace name>  # LAW name is case sensitive

$metric = New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -Category AllMetrics
$log = New-AzDiagnosticSettingLogSettingsObject -Enabled $true -CategoryGroup allLogs  # use audit for only audit logs
New-AzDiagnosticSetting -Name 'KeyVault-Diagnostics' -ResourceId $KV.ResourceId -WorkspaceId $Law.ResourceId -Log $log -Metric $metric -Verbose

在 Azure CLI 中使用 az monitor diagnostic-settings create 命令来创建诊断设置。 有关参数说明，请参阅此命令的文档。

以下示例脚本创建一个诊断设置，用于将数据发送到所有三个目标。 To specify resource-specific mode if the service supports it, add the export-to-resource-specific parameter with a value of true.`

az monitor diagnostic-settings create  \
--name KeyVault-Diagnostics \
--resource /subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.KeyVault/vaults/mykeyvault \
--logs    '[{"category": "AuditEvent","enabled": true}]' \
--metrics '[{"category": "AllMetrics","enabled": true}]' \
--storage-account /subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.Storage/storageAccounts/<storage account name> \
--workspace /subscriptions/<subscription ID>/resourcegroups/<resource group name>/providers/microsoft.operationalinsights/workspaces/<log analytics workspace name> \
--event-hub-rule /subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.EventHub/namespaces/<event hub namespace>/authorizationrules/RootManageSharedAccessKey \
--event-hub <event hub name> \
--export-to-resource-specific true

以下示例模板创建一个诊断设置，用于将所有审核日志发送到 Log Analytics 工作区。 apiVersion 可以根据范围中的资源而变化。 若要获取其他资源的示例模板，请参阅 Azure Monitor 中适用于诊断设置的 Resource Manager 模板示例。

Template file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "scope": {
        "type": "string"
    },
    "workspaceId": {
        "type": "string"
    },
    "settingName": {
        "type": "string"
    }
},
  "resources": [
    {
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "scope": "[parameters('scope')]",
      "name": "[parameters('settingName')]",
      "properties": {
       "workspaceId": "[parameters('workspaceId')]",
      "logs": [
             {
            "category": null,
            "categoryGroup": "audit",
            "enabled": true
          }
        ]
      }
    }
  ]
  }

Parameter file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "settingName": {
        "value": "audit3"
    },
    "workspaceId": {
      "value": "/subscriptions/<subscription id>/resourcegroups/<resourcegroup name>/providers/microsoft.operationalinsights/workspaces/<workspace name>"
    },
    "scope": {
      "value": "Microsoft.<resource type>/<resourceName>"
    }
  }
}