部署 Windows 混合 Runbook 辅助角色Deploy a Windows Hybrid Runbook Worker

利用 Azure 自动化的混合 Runbook 辅助角色功能,既可以直接在托管角色的计算机上运行 Runbook,也可以对环境中的资源运行 Runbook,从而管理这些本地资源。You can use the Hybrid Runbook Worker feature of Azure Automation to run runbooks directly on the computer that's hosting the role and against resources in the environment to manage those local resources. Azure 自动化将存储并管理 Runbook,然后将其传送到一台或多台指定的计算机。Azure Automation stores and manages runbooks and then delivers them to one or more designated computers. 本文介绍了如何在 Windows 计算机上部署混合 Runbook 辅助角色。This article describes how to deploy a Hybrid Runbook Worker on a Windows machine.

成功部署 Runbook 辅助角色后,请查看在混合 Runbook 辅助角色上运行 Runbook,了解如何配置 Runbook,使本地数据中心或其他云环境中的过程实现自动化。After you successfully deploy a runbook worker, review Run runbooks on a Hybrid Runbook Worker to learn how to configure your runbooks to automate processes in your on-premises datacenter or other cloud environment.

Note

本文最近已更新,从使用术语“Log Analytics”改为使用术语“Azure Monitor 日志”。This article was recently updated to use the term Azure Monitor logs instead of Log Analytics. 日志数据仍然存储在 Log Analytics 工作区中,并仍然由同一 Log Analytics 服务收集并分析。Log data is still stored in a Log Analytics workspace and is still collected and analyzed by the same Log Analytics service. 我们正在更新术语,以便更好地反映 Azure Monitor 中日志的角色。We are updating the terminology to better reflect the role of logs in Azure Monitor. 有关详细信息,请参阅 Azure Monitor 术语更改See Azure Monitor terminology changes for details.

Windows 混合 Runbook 辅助角色的安装和配置Windows Hybrid Runbook Worker installation and configuration

若要安装和配置 Windows 混合 Runbook 辅助角色,可使用下述方法中的一种。To install and configure a Windows Hybrid Runbook Worker, you can use one of the following methods.

  • 对于 Azure VM,请通过适用于 Windows 的虚拟机扩展安装适用于 Windows 的 Log Analytics 代理。For Azure VMs, install the Log Analytics agent for Windows using the virtual machine extension for Windows. 该扩展通过 Azure 资源管理器模板或 PowerShell 在 Azure 虚拟机上安装 Log Analytics 代理,并将虚拟机注册到现有的 Log Analytics 工作区中。The extension installs the Log Analytics agent on Azure virtual machines, and enrolls virtual machines into an existing Log Analytics workspace using an Azure Resource Manager template or PowerShell. 安装代理后,可将 VM 添加到自动化帐户中的混合 Runbook 辅助角色组。Once the agent is installed, the VM can be added to a Hybrid Runbook Worker group in your Automation account. 请参阅手动部署部分中的步骤 3 和步骤 4。Refer to steps 3 and 4 in the Manual deployment section.

  • 使用自动化 Runbook 来彻底实现配置 Windows 计算机过程的自动化。Use an Automation runbook to completely automate the process of configuring a Windows computer. 对于数据中心或其他云环境中的计算机,建议使用此方法。This is the recommended method for machines in your datacenter or another cloud environment.

  • 按照分步过程操作,在非 Azure VM 上手动安装和配置混合 Runbook 辅助角色。Follow a step-by-step procedure to manually install and configure the Hybrid Runbook Worker role on your non-Azure VM.

Note

为了使用所需状态配置 (DSC) 管理支持混合 Runbook 辅助角色的服务器配置,必须将服务器添加为 DSC 节点。To manage the configuration of servers that support the Hybrid Runbook Worker role with Desired State Configuration (DSC), you must add the servers as DSC nodes.

Windows 混合 Runbook 辅助角色的最低要求Minimum requirements for Windows Hybrid Runbook Worker

Windows 混合 Runbook 辅助角色的最低要求如下:The minimum requirements for a Windows Hybrid Runbook Worker are:

  • Windows Server 2012 或更高版本Windows Server 2012 or later
  • Windows PowerShell 5.1 或更高版本(下载 WMF 5.1Windows PowerShell 5.1 or later (download WMF 5.1)
  • .NET Framework 4.6.2 或更高版本.NET Framework 4.6.2 or later
  • 双核Two cores
  • 4 GB RAM4 GB of RAM
  • 端口 443(出站)Port 443 (outbound)

网络配置Network configuration

若要查看混合 Runbook 辅助角色的更多网络要求,请参阅配置网络To get more networking requirements for the Hybrid Runbook Worker, see Configuring your network.

加入通过 State Configuration (DSC) 进行管理的服务器Server onboarding for management with State Configuration (DSC)

若要了解如何加入通过 State Configuration (DSC) 进行管理的服务器,请参阅加入通过 State Configuration (DSC) 进行管理的计算机For information about onboarding servers for management with State Configuration (DSC), see Onboard machines for management by State Configuration (DSC).

启用更新管理会自动将连接到 Log Analytics 工作区的任何 Windows 计算机配置为支持 Runbook 更新的混合 Runbook 辅助角色。Enabling Update Management automatically configures any Windows computer that's connected to your Log Analytics workspace as a Hybrid Runbook Worker to support runbook updates. 但是,此辅助角色未注册到任何已在自动化帐户中定义的混合 Runbook 辅助角色组。However, this worker is not registered with any Hybrid Runbook Worker groups already defined in your Automation account.

将计算机添加到混合 Runbook 辅助角色组Addition of the computer to a Hybrid Runbook Worker group

可将辅助角色计算机添加到自动化帐户中的混合 Runbook 辅助角色组。You can add the worker computer to a Hybrid Runbook Worker group in your Automation account. 请注意,只要对 Azure 自动化功能和混合 Runbook 辅助角色组成员身份使用同一帐户,就必须支持自动化 Runbook。Note that you must support Automation runbooks as long as you're using the same account for both the Azure Automation feature and the Hybrid Runbook Worker group membership. 此功能已添加到 7.2.12024.0 版本的混合 Runbook 辅助角色。This functionality has been added to version 7.2.12024.0 of the Hybrid Runbook Worker.

自动化部署Automated deployment

在目标计算机上执行以下步骤,以便自动完成 Windows 混合辅助角色的安装和配置。On the target machine, perform the following steps to automate the installation and configuration of the Windows Hybrid Worker role.

步骤 1 - 下载 PowerShell 脚本Step 1 - Download the PowerShell script

PowerShell 库下载 New-OnPremiseHybridWorker.ps1 脚本。Download the New-OnPremiseHybridWorker.ps1 script from the PowerShell Gallery. 应直接从运行混合 Runbook 辅助角色的计算机或环境中的另一台计算机下载。The download should be directly from the computer running the Hybrid Runbook Worker role or from another computer in your environment. 下载该脚本后,将其复制到辅助角色。When you have downloaded the script, copy it to your worker. New-OnPremiseHybridWorker.ps1 脚本在执行过程中使用下面所述的参数。The New-OnPremiseHybridWorker.ps1 script uses the parameters described below during execution.

参数Parameter 状态Status 说明Description
AAResourceGroupName 必需Mandatory 与自动化帐户关联的资源组的名称。The name of the resource group that's associated with your Automation account.
AutomationAccountName 必需Mandatory 自动化帐户的名称。The name of your Automation account.
Credential 可选Optional 登录到 Azure 环境时要使用的凭据。The credentials to use when logging in to the Azure environment.
HybridGroupName 必需Mandatory 混合 Runbook 辅助角色组的名称,可将其指定为支持此方案的 runbook 的目标。The name of a Hybrid Runbook Worker group that you specify as a target for the runbooks that support this scenario.
OMSResourceGroupName 可选Optional Log Analytics 工作区的资源组的名称。The name of the resource group for the Log Analytics workspace. 如果未指定此资源组,将使用 AAResourceGroupName 值。If this resource group is not specified, the value of AAResourceGroupName is used.
SubscriptionID 必需Mandatory 与自动化帐户关联的 Azure 订阅的标识符。The identifier of the Azure subscription associated with your Automation account.
TenantID 可选Optional 与自动化帐户关联的租户组织的标识符。The identifier of the tenant organization associated with your Automation account.
WorkspaceName 可选Optional Log Analytics 工作区名称。The Log Analytics workspace name. 如果没有 Log Analytics 工作区,该脚本会创建并配置一个。If you don't have a Log Analytics workspace, the script creates and configures one.

步骤 2 - 打开 Windows PowerShell 命令行 shellStep 2 - Open Windows PowerShell command line shell

在“管理员”模式下,从“开始”屏幕打开 Windows PowerShell 。Open Windows PowerShell from the Start screen in Administrator mode.

步骤 3 - 运行 PowerShell 脚本Step 3 - Run the PowerShell script

在 PowerShell 命令行 shell 中,浏览到包含已下载的脚本的文件夹。In the PowerShell command line shell, browse to the folder that contains the script that you have downloaded. 更改参数 AutomationAccountNameAAResourceGroupNameOMSResourceGroupNameHybridGroupNameSubscriptionIDWorkspaceName 的值。Change the values for the parameters AutomationAccountName, AAResourceGroupName, OMSResourceGroupName, HybridGroupName, SubscriptionID, and WorkspaceName. 然后运行脚本。Then run the script.

运行脚本后,系统会提示在 Azure 上进行身份验证。You're prompted to authenticate with Azure after you run the script. 必须以订阅管理员角色成员和订阅共同管理员的帐户登录。You must sign in with an account that's a member of the Subscription Admins role and co-administrator of the subscription.

.\New-OnPremiseHybridWorker.ps1 -AutomationAccountName <NameofAutomationAccount> -AAResourceGroupName <NameofResourceGroup>`
-OMSResourceGroupName <NameofOResourceGroup> -HybridGroupName <NameofHRWGroup> `
-SubscriptionID <AzureSubscriptionId> -WorkspaceName <NameOfLogAnalyticsWorkspace>

步骤 4 - 安装 NuGetStep 4 - Install NuGet

系统会提示用户同意安装 NuGet 并使用 Azure 凭据进行身份验证。You're prompted to agree to install NuGet, and to authenticate with your Azure credentials. 如果没有最新的 NuGet 版本,可以从 Available NuGet Distribution Versions(可用的 NuGet 发行版本)获取。If you don't have the latest NuGet version, you can obtain it from Available NuGet Distribution Versions.

步骤 5 - 验证部署Step 5 - Verify the deployment

脚本完成后,“混合辅助角色组”页会显示新组和成员数。After the script is finished, the Hybrid Worker Groups page shows the new group and the number of members. 如果这是现有的组,则成员数会递增。If it's an existing group, the number of members is incremented. 可以从“混合辅助角色组”页上的列表中选择组,并选择“混合辅助角色”磁贴。You can select the group from the list on the Hybrid Worker Groups page and choose the Hybrid Workers tile. 在“混合辅助角色”页上,可以查看列出组的每个成员。On the Hybrid Workers page, you can see each member of the group listed.

手动部署Manual deployment

在目标计算机上,针对自动化环境执行前两个步骤一次,On the target machine, perform the first two steps once for your Automation environment. 然后对每台辅助角色计算机执行其余步骤。Then perform the remaining steps for each worker computer.

步骤 1 - 创建 Log Analytics 工作区Step 1 - Create a Log Analytics workspace

如果还没有 Log Analytics 工作区,请在创建工作区前查看 Azure Monitor 日志设计指南If you don't already have a Log Analytics workspace, review the Azure Monitor Log design guidance before you create the workspace.

步骤 2 - 将 Azure 自动化功能添加到 Log Analytics 工作区Step 2 - Add an Azure Automation feature to the Log Analytics workspace

自动化功能添加了 Azure 自动化的功能,包括对混合 Runbook 辅助角色的支持。An Automation feature adds functionality for Azure Automation, including support for the Hybrid Runbook Worker. 将解决方案添加到 Log Analytics 工作区时,它会自动将你安装的辅助角色组件推送到代理计算机,如下一步所述。When you add a solution to your Log Analytics workspace, it automatically pushes to the agent computer the worker components that you install as described in the next step.

若要将自动化解决方案添加到工作区,请运行以下 PowerShell cmdlet。To add the Automation solution to your workspace, run the following PowerShell cmdlet.

Set-AzOperationalInsightsIntelligencePack -ResourceGroupName <logAnalyticsResourceGroup> -WorkspaceName <LogAnalyticsWorkspaceName> -IntelligencePackName "AzureAutomation" -Enabled $true -DefaultProfile <IAzureContextContainer>

步骤 3 - 安装适用于 Windows 的 Log Analytics 代理Step 3 - Install the Log Analytics agent for Windows

适用于 Windows 的 Log Analytics 代理将计算机连接到 Azure Monitor Log Analytics 工作区。The Log Analytics agent for Windows connects computers to an Azure Monitor Log Analytics workspace. 在计算机上安装代理并将其连接到工作区时,代理会自动下载混合 Runbook 辅助角色所需的组件。When you install the agent on your computer and connect it to your workspace, it automatically downloads the components that are required for the Hybrid Runbook Worker.

若要在计算机上安装代理,请按照将 Windows 计算机连接到 Azure Monitor 日志中的说明操作。To install the agent on the computer, follow the instructions at Connect Windows computers to Azure Monitor logs. 可以对多台计算机重复此过程,以将多个辅助角色添加到环境。You can repeat this process for multiple computers to add multiple workers to your environment.

当代理在几分钟后成功连接到 Log Analytics 工作区时,可运行以下查询以验证它是否正在向工作区发送检测信号数据。When the agent has successfully connected to your Log Analytics workspace after a few minutes, you can run the following query to verify that it is sending heartbeat data to the workspace.

Heartbeat 
| where Category == "Direct Agent" 
| where TimeGenerated > ago(30m)

在搜索结果中,应可以看到计算机的检测信号记录,该记录指示计算机已连接到服务,并向其报告。In the search results, you should see heartbeat records for the computer, indicating that it is connected and reporting to the service. 默认情况下,每个代理都会将一个检测信号记录转发到其分配的工作区。By default, every agent forwards a heartbeat record to its assigned workspace.

使用以下步骤来完成代理的安装和设置。Use the following steps to complete the agent installation and setup.

  1. 验证代理是否正确下载了自动化解决方案。Verify that the agent has correctly downloaded the Automation solution. 它在 C:\Program Files\Microsoft Monitoring Agent\Agent 中应包含一个名为 AzureAutomationFiles 的文件夹。 It should have a folder called AzureAutomationFiles in C:\Program Files\Microsoft Monitoring Agent\Agent.
  2. 若要确认混合 Runbook 辅助角色的版本,请浏览到 C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation 并留意 version 子文件夹。 To confirm the version of the Hybrid Runbook Worker, browse to C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation and note the version subfolder.

步骤 4 - 安装 Runbook 环境并连接到 Azure 自动化Step 4 - Install the runbook environment and connect to Azure Automation

将代理配置为向 Log Analytics 工作区报告时,自动化解决方案会向下推送 HybridRegistration PowerShell 模块,其中包含 Add-HybridRunbookWorker cmdlet。When you configure an agent to report to a Log Analytics workspace, the Automation solution pushes down the HybridRegistration PowerShell module, which contains the Add-HybridRunbookWorker cmdlet. 使用此 cmdlet 将 Runbook 环境安装到计算机上,并将其注册到 Azure 自动化。Use this cmdlet to install the runbook environment on the computer and register it with Azure Automation.

在管理员模式下打开 PowerShell 会话,并运行以下命令以导入模块。Open a PowerShell session in Administrator mode and run the following commands to import the module.

cd "C:\Program Files\Microsoft Monitoring Agent\Agent\AzureAutomation\<version>\HybridRegistration"
Import-Module .\HybridRegistration.psd1

现在,使用以下语法运行 Add-HybridRunbookWorker cmdlet。Now run the Add-HybridRunbookWorker cmdlet using the following syntax.

Add-HybridRunbookWorker –GroupName <String> -EndPoint <Url> -Token <String>

可以从 Azure 门户的“管理密钥”页获取此 cmdlet 所需的信息。You can get the information required for this cmdlet from the Manage Keys page in the Azure portal. 通过在自动化帐户中的“设置”页上选择“密钥”来打开此页。Open this page by selecting Keys on the Settings page in your Automation account.

“管理密钥”页

  • 对于 GroupName 参数,请使用混合 Runbook 辅助角色组的名称。For the GroupName parameter, use the name of the Hybrid Runbook Worker group. 如果该组已经存在于自动化帐户中,则会将当前计算机添加到其中。If this group already exists in the Automation account, the current computer is added to it. 如果该组不存在,则将添加该组。If this group doesn't exist, it's added.
  • 对于 EndPoint 参数,请使用“管理密钥”页上的“URL”条目。For the EndPoint parameter, use the URL entry on the Manage Keys page.
  • 对于 Token 参数,请使用“管理密钥”页上的“主访问密钥”条目。For the Token parameter, use the PRIMARY ACCESS KEY entry on the Manage Keys page.
  • 如果需要,请设置 Verbose 参数以接收有关安装的详细信息。If required, set the Verbose parameter to receive details about the installation.

步骤 5 - 安装 PowerShell 模块Step 5 - Install PowerShell modules

Runbook 可以使用在 Azure 自动化环境中安装的模块中定义的任何活动和 cmdlet。Runbooks can use any of the activities and cmdlets defined in the modules installed in your Azure Automation environment. 这些模块不会自动部署到本地计算机,因此必须手动安装。As these modules are not automatically deployed to on-premises computers, you must install them manually. Azure 模块除外。The exception is the Azure module. 该模块是默认安装的,并可用于访问所有 Azure 服务的 cmdlet 以及 Azure 自动化的活动。This module is installed by default and provides access to cmdlets for all Azure services and activities for Azure Automation.

由于混合 Runbook 辅助角色的主要用途是管理本地资源,因此很可能需要安装支持这些资源的模块,尤其是 PowerShellGet 模块。Because the primary purpose of the Hybrid Runbook Worker is to manage local resources, you most likely need to install the modules that support these resources, particularly the PowerShellGet module. 有关安装 Windows PowerShell 模块的信息,请参阅 Windows PowerShellFor information on installing Windows PowerShell modules, see Windows PowerShell.

安装的模块必须位于 PSModulePath 环境变量所引用的位置,以便混合辅助角色自动将其导入。Modules that are installed must be in a location referenced by the PSModulePath environment variable so that the hybrid worker can automatically import them. 有关详细信息,请参阅在 PSModulePath 中安装模块For more information, see Install Modules in PSModulePath.

从本地 Windows 计算机中删除混合 Runbook 辅助角色Remove the Hybrid Runbook Worker from an on-premises Windows computer

  1. 在 Azure 门户中,转到自动化帐户。In the Azure portal, go to your Automation account.

  2. 在“帐户设置”下,选择“密钥”并记下“URL”和“主访问密钥”的值 。Under Account Settings, select Keys and note the values for URL and Primary Access Key.

  3. 在管理员模式下打开 PowerShell 会话,并使用“URL”和“主访问密钥”值运行以下命令。Open a PowerShell session in Administrator mode and run the following command with your URL and primary access key values. 使用 Verbose 参数以获取删除过程的详细日志。Use the Verbose parameter for a detailed log of the removal process. 若要从混合辅助角色组中删除过时的计算机,请使用可选的 machineName 参数。To remove stale machines from your Hybrid Worker group, use the optional machineName parameter.

Remove-HybridRunbookWorker -url <URL> -key <PrimaryAccessKey> -machineName <ComputerName>

删除混合辅助角色组Remove a Hybrid Worker group

若要删除混合 Runbook 辅助角色组,首先需要从每台计算机上删除属于该组的混合 Runbook 辅助角色。To remove a Hybrid Runbook Worker group, you first need to remove the Hybrid Runbook Worker from every computer that is a member of the group. 然后,使用以下步骤删除该组:Then use the following steps to remove the group:

  1. 在 Azure 门户中打开自动化帐户。Open the Automation account in the Azure portal.

  2. 在“流程自动化” 下选择“混合辅助角色组”。Select Hybrid worker groups under Process Automation. 选择要删除的组。Select the group that you want to delete. 将显示该组的属性页。The properties page for that group appears.

    “属性”页

  3. 在所选组的属性页中,选择“删除”。On the properties page for the selected group, select Delete. 系统会显示一条消息,要求确认此操作。A message asks you to confirm this action. 如果确定要继续,请选择“是”。Select Yes if you're sure that you want to continue.

    确认消息

    完成此过程可能需要数秒钟的时间。This process can take several seconds to finish. 可以在菜单中的“通知”下面跟踪操作进度。You can track its progress under Notifications from the menu.

后续步骤Next steps