将 Azure 诊断扩展中的数据收集到 Azure Monitor 日志Collect data from Azure diagnostics extension to Azure Monitor Logs

Azure 诊断扩展是 Azure Monitor 中的代理,可从 Azure 计算资源(包括虚拟机)的来宾操作系统中收集监视数据。Azure diagnostics extension is an agent in Azure Monitor that collects monitoring data from the guest operating system of Azure compute resources including virtual machines. 本文介绍了如何将诊断扩展收集的数据从 Azure 存储收集到 Azure Monitor 日志。This article describes how to collect data collected by the diagnostics extension from Azure Storage to Azure Monitor Logs.

备注

Azure Monitor 中的 Log Analytics 代理通常是用于将来宾操作系统中的数据收集到 Azure Monitor 日志的首选方法。The Log Analytics agent in Azure Monitor is typically the preferred method to collect data from the guest operating system into Azure Monitor Logs. 请参阅 Azure Monitor 代理概述来详细比较各个代理。See Overview of the Azure Monitor agents for a detailed comparison of the agents.

支持的数据类型Supported data types

Azure 诊断扩展将数据存储在 Azure 存储帐户中。Azure diagnostics extension stores data in an Azure Storage account. 要使 Azure Monitor 日志收集此数据,它必须位于以下位置:For Azure Monitor Logs to collect this data, it must be in the following locations:

日志类型Log Type 资源类型Resource Type 位置Location
IIS 日志IIS logs 虚拟机Virtual Machines
Web 角色Web roles
辅助角色Worker roles
wad-iis-logfiles(Blob 存储)wad-iis-logfiles (Blob Storage)
SyslogSyslog 虚拟机Virtual Machines LinuxsyslogVer2v0(表存储)LinuxsyslogVer2v0 (Table Storage)
Service Fabric 操作事件Service Fabric Operational Events Service Fabric 节点Service Fabric nodes WADServiceFabricSystemEventTableWADServiceFabricSystemEventTable
Service Fabric Reliable Actor 事件Service Fabric Reliable Actor Events Service Fabric 节点Service Fabric nodes WADServiceFabricReliableActorEventTableWADServiceFabricReliableActorEventTable
Service Fabric Reliable Service 事件Service Fabric Reliable Service Events Service Fabric 节点Service Fabric nodes WADServiceFabricReliableServiceEventTableWADServiceFabricReliableServiceEventTable
Windows 事件日志Windows Event logs Service Fabric 节点Service Fabric nodes
虚拟机Virtual Machines
Web 角色Web roles
辅助角色Worker roles
WADWindowsEventLogsTable(表存储)WADWindowsEventLogsTable (Table Storage)
Windows ETW 日志Windows ETW logs Service Fabric 节点Service Fabric nodes
虚拟机Virtual Machines
Web 角色Web roles
辅助角色Worker roles
WADETWEventTable(表存储)WADETWEventTable (Table Storage)

不支持的数据类型Data types not supported

  • 来宾操作系统中的性能数据Performance data from the guest operating system
  • Azure 网站中的 IIS 日志IIS logs from Azure websites

启用 Azure 诊断扩展Enable Azure diagnostics extension

请参阅安装并配置 Azure 诊断扩展 (WAD)使用 Linux 诊断扩展监视指标和日志,详细了解如何安装和配置诊断扩展。See Install and configure Azure diagnostics extension (WAD) or Use Linux Diagnostic Extension to monitor metrics and logs for details on installing and configuring the diagnostics extension. 这将允许你指定存储帐户并配置要转发到 Azure Monitor 日志的数据集合。This will allow you to specify the storage account and to configure collection of the data that you want to forward to Azure Monitor Logs.

从 Azure 存储收集日志Collect logs from Azure Storage

请使用以下过程启用从 Azure 存储帐户收集诊断扩展数据:Use the following procedure to enable collection of diagnostics extension data from an Azure Storage account:

  1. 在 Azure 门户中,转到 Log Analytics 工作区 并选择你的工作区。In the Azure portal, go to Log Analytics Workspaces and select your workspace.
  2. 在菜单的“工作区数据源”部分中单击“存储帐户日志”。Click Storage accounts logs in the Workspace Data Sources section of the menu.
  3. 单击“添加” 。Click Add.
  4. 选择包含要收集的数据的 存储帐户Select the Storage account that contains the data to collect.
  5. 选择要收集的 数据类型Select the Data Type you want to collect.
  6. “源”的值将基于数据类型自动填充。The value for Source is automatically populated based on the data type.
  7. 单击“确定”以保存配置。Click OK to save the configuration.
  8. 针对其他数据类型重复操作。Repeat for additional data types.

在大约 30 分钟过后,能够在 Log Analytics 工作区中看到存储帐户中的数据。In approximately 30 minutes, you are able to see data from the storage account in the Log Analytics workspace. 在应用了配置后,只能看到写入到存储中的数据。You will only see data that is written to storage after the configuration is applied. 工作区不会从存储帐户中读取预先存在的数据。The workspace does not read the pre-existing data from the storage account.

备注

该门户不会验证源是否存在于存储帐户中,也不会验证是否正在写入新数据。The portal does not validate that the source exists in the storage account or if new data is being written.

后续步骤Next steps