Azure Monitor 中的诊断设置的资源管理器模板示例

本文包含一些 Azure 资源管理器模板的示例，用于为 Azure 资源创建诊断设置。 每个示例都包含模板文件和参数文件，其中包含要提供给模板的示例值。

注释

在部署示例之前：

  • 确保监视的资源和每个选定的目标已存在。 Bicepexisting声明引用受监视的资源;它们不会创建或更新它们。
  • 提供用于组合资源 ID 的目标订阅、资源组和资源名称。 资源组模板以部署资源组中的受监视资源为目标，除非其范围另有说明。
  • 检查资源支持的日志和指标类别以及 目标要求。
  • 使用新的诊断设置名称添加设置。 重复使用现有名称会更新该设置，因此请保留其所需的目标、日志、指标、保留配置和其他设置。

每个命名的 API 版本占位符对应于其资源声明。 使用资源类型的 模板引用 解析该版本。 存储示例还使用单独命名的 API 版本进行终结点查找和嵌套部署。

若要为 Azure 资源创建诊断设置，请将类型 <resource namespace>/providers/diagnosticSettings 的资源添加到模板中。 本文为某些资源类型提供了示例，但相同模式可以应用于其他资源类型。 对于每种资源类型，允许的日志和指标的收集有所不同。

Important

模板部署会创建或更新指定名称的诊断设置；它们不是部分 PATCH 操作。 更新设置时，请保留其所需目标以及完整的日志和指标收集配置。

下表列出了包含本文中的示例的资源类型。

资源类型 诊断设置资源
活动日志 Microsoft.Insights/diagnosticSettings
Azure 数据资源管理器 Microsoft.Kusto/clusters/providers/diagnosticSettings
Azure 密钥保管库 Microsoft.KeyVault/vaults/providers/diagnosticSettings
Azure SQL 数据库 microsoft.sql/servers/databases/providers/diagnosticSettings
Azure SQL 托管实例 microsoft.sql/managedInstances/providers/diagnosticSettings
Azure SQL 数据库的托管实例 microsoft.sql/managedInstances/databases/providers/diagnosticSettings
恢复服务保管库 microsoft.recoveryservices/vaults/providers/diagnosticSettings
Log Analytics 工作区 Microsoft.OperationalInsights/workspaces/providers/diagnosticSettings
Azure 存储 Microsoft.Storage/storageAccounts/providers/diagnosticSettings

注释

请参阅 Azure 资源管理器 示例，了解 Azure Monitor 中提供的示例列表，以及有关如何在 Azure 订阅中部署示例的指导。

活动日志的诊断设置

Important

活动日志的诊断设置是针对订阅而非资源组（例如 Azure 资源的设置）创建的。 若要部署资源管理器模板，请使用 PowerShell 的 New-AzSubscriptionDeployment 或 Azure CLI 的 az deployment sub create。

活动日志

下面的示例通过向模板添加Microsoft.Insights/diagnosticSettings类型的资源，为活动日志创建诊断设置。

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


配置活动日志的诊断目标 
targetScope = 'subscription'

param settingName string = '<SettingName>'

param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'

param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'

param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'

param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'Administrative'
        enabled: true
      }
      {
        category: 'Security'
        enabled: true
      }
      {
        category: 'ServiceHealth'
        enabled: true
      }
      {
        category: 'Alert'
        enabled: true
      }
      {
        category: 'Recommendation'
        enabled: true
      }
      {
        category: 'Policy'
        enabled: true
      }
      {
        category: 'Autoscale'
        enabled: true
      }
      {
        category: 'ResourceHealth'
        enabled: true
      }
    ]
  }
}

活动日志参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "settingName": {
      "value": "<SettingName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Azure 数据资源管理器的诊断设置

下面的示例通过将 Microsoft.Kusto/clusters/providers/diagnosticSettings 类型的资源添加到模板，为 Azure 数据探索器群集创建诊断设置。

Azure 数据资源管理器

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为Azure 数据资源管理器配置诊断类别 
param clusterName string = '<ClusterName>'
param settingName string = '<SettingName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'
param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'
param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'
param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource dataExplorerCluster 'Microsoft.Kusto/clusters@<DataExplorerClusterApiVersion>' existing = {
  name: clusterName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: dataExplorerCluster
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    metrics: []
    logs: [
      {
        category: 'Command'
        categoryGroup: null
        enabled: true
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'Query'
        categoryGroup: null
        enabled: true
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'Journal'
        categoryGroup: null
        enabled: true
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'SucceededIngestion'
        categoryGroup: null
        enabled: false
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'FailedIngestion'
        categoryGroup: null
        enabled: false
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'IngestionBatching'
        categoryGroup: null
        enabled: false
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'TableUsageStatistics'
        categoryGroup: null
        enabled: false
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
      {
        category: 'TableDetails'
        categoryGroup: null
        enabled: false
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
    ]
  }
}

Azure 数据资源管理器参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "clusterName": {
      "value": "<ClusterName>"
    },
    "settingName": {
      "value": "<SettingName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Azure 数据资源管理器：启用“审核”类别组

注释

当需要 audit 类别组时，请使用此变体而不是单个类别示例。 这两个变体都使用Azure 数据资源管理器参数文件。

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


启用Azure 数据资源管理器审核类别组 
param clusterName string = '<ClusterName>'
param settingName string = '<SettingName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'
param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'
param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'
param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource dataExplorerCluster 'Microsoft.Kusto/clusters@<DataExplorerClusterApiVersion>' existing = {
  name: clusterName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: dataExplorerCluster
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: null
        categoryGroup: 'audit'
        enabled: true
        retentionPolicy: {
          enabled: false
          days: 0
        }
      }
    ]
  }
}

Azure 密钥保管库 的诊断设置

Important

对于 Azure 密钥保管库，事件中心必须与密钥保管库位于同一区域。

Azure 密钥保管库

下面的示例通过将类型为Microsoft.KeyVault/vaults/providers/diagnosticSettings的资源添加到模板中，为 Azure 密钥保管库实例创建诊断设置。

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为Azure 密钥保管库配置诊断目标 
param settingName string = '<SettingName>'

param vaultName string = '<VaultName>'

param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'

param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'

param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'

param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource keyVault 'Microsoft.KeyVault/vaults@<KeyVaultApiVersion>' existing = {
  name: vaultName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: keyVault
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'AuditEvent'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'AllMetrics'
        enabled: true
      }
    ]
  }
}

Azure 密钥保管库参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "settingName": {
      "value": "<SettingName>"
    },
    "vaultName": {
      "value": "<VaultName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Azure SQL 数据库的诊断设置

下面的示例通过将类型 microsoft.sql/servers/databases/providers/diagnosticSettings 的资源添加到模板，为 Azure SQL 数据库实例创建了诊断设置。

Azure SQL 数据库

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为Azure SQL 数据库配置诊断目标 
param settingName string = '<SettingName>'

param serverName string = '<ServerName>'

param dbName string = '<DbName>'

param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'

param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'

param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'

param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource sqlServer 'Microsoft.Sql/servers@<SqlServerApiVersion>' existing = {
  name: serverName
}

resource sqlDatabase 'Microsoft.Sql/servers/databases@<SqlDatabaseApiVersion>' existing = {
  parent: sqlServer
  name: dbName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: sqlDatabase
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'SQLInsights'
        enabled: true
      }
      {
        category: 'AutomaticTuning'
        enabled: true
      }
      {
        category: 'QueryStoreRuntimeStatistics'
        enabled: true
      }
      {
        category: 'QueryStoreWaitStatistics'
        enabled: true
      }
      {
        category: 'Errors'
        enabled: true
      }
      {
        category: 'DatabaseWaitStatistics'
        enabled: true
      }
      {
        category: 'Timeouts'
        enabled: true
      }
      {
        category: 'Blocks'
        enabled: true
      }
      {
        category: 'Deadlocks'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'Basic'
        enabled: true
      }
      {
        category: 'InstanceAndAppAdvanced'
        enabled: true
      }
      {
        category: 'WorkloadManagement'
        enabled: true
      }
    ]
  }
}

Azure SQL 数据库参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "settingName": {
      "value": "<SettingName>"
    },
    "serverName": {
      "value": "<ServerName>"
    },
    "dbName": {
      "value": "<DbName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Azure SQL 托管实例的诊断设置

下面的示例通过将类型 microsoft.sql/managedInstances/providers/diagnosticSettings 的资源添加到模板，为 Azure SQL 托管实例的一个实例创建诊断设置。

Azure SQL 托管实例

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为Azure SQL 托管实例配置诊断 
param sqlManagedInstanceName string = '<SqlManagedInstanceName>'
param diagnosticSettingName string = '<DiagnosticSettingName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'
param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'
param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'
param eventHubName string = '<EventHubName>'

var diagnosticWorkspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource sqlManagedInstance 'Microsoft.Sql/managedInstances@<SqlManagedInstanceApiVersion>' existing = {
  name: sqlManagedInstanceName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: diagnosticSettingName
  scope: sqlManagedInstance
  properties: {
    workspaceId: diagnosticWorkspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'ResourceUsageStats'
        enabled: true
      }
      {
        category: 'DevOpsOperationsAudit'
        enabled: true
      }
      {
        category: 'SQLSecurityAuditEvents'
        enabled: true
      }
    ]
  }
}

Azure SQL 托管实例参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "sqlManagedInstanceName": {
      "value": "<SqlManagedInstanceName>"
    },
    "diagnosticSettingName": {
      "value": "<DiagnosticSettingName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Azure SQL 数据库的托管实例的诊断设置

下面的示例通过在模板中添加类型为 microsoft.sql/managedInstances/databases/providers/diagnosticSettings 的资源，为 Azure SQL 数据库的托管实例创建了诊断设置。

Azure SQL 数据库的托管实例

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为托管 SQL 数据库配置诊断 
param sqlManagedInstanceName string = '<SqlManagedInstanceName>'
param sqlManagedDatabaseName string = '<SqlManagedDatabaseName>'
param diagnosticSettingName string = '<DiagnosticSettingName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'
param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'
param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'
param eventHubName string = '<EventHubName>'

var diagnosticWorkspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource sqlManagedInstance 'Microsoft.Sql/managedInstances@<SqlManagedInstanceApiVersion>' existing = {
  name:sqlManagedInstanceName
}

resource sqlManagedDatabase 'Microsoft.Sql/managedInstances/databases@<SqlManagedDatabaseApiVersion>' existing = {
  name: sqlManagedDatabaseName
  parent: sqlManagedInstance
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: diagnosticSettingName
  scope: sqlManagedDatabase
  properties: {
    workspaceId: diagnosticWorkspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'SQLInsights'
        enabled: true
      }
      {
        category: 'QueryStoreRuntimeStatistics'
        enabled: true
      }
      {
        category: 'QueryStoreWaitStatistics'
        enabled: true
      }
      {
        category: 'Errors'
        enabled: true
      }
    ]
  }
}

Azure SQL 数据库 托管实例的参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "sqlManagedInstanceName": {
      "value": "<SqlManagedInstanceName>"
    },
    "sqlManagedDatabaseName": {
      "value": "<SqlManagedDatabaseName>"
    },
    "diagnosticSettingName": {
      "value": "<DiagnosticSettingName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

恢复服务保管库的诊断设置

下面的示例将 microsoft.recoveryservices/vaults/providers/diagnosticSettings 类型的资源添加到模板，从而为 Azure 恢复服务保管库创建诊断设置。 此示例指定收集模式，如 Azure 资源日志中所述。 为 Dedicated 属性指定 AzureDiagnostics 或 logAnalyticsDestinationType。

恢复服务保管库

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为恢复服务保管库配置诊断目标 
param recoveryServicesName string = '<RecoveryServicesName>'
param settingName string = '<SettingName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'
param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'
param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'
param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource recoveryServicesVault 'Microsoft.RecoveryServices/vaults@<RecoveryServicesVaultApiVersion>' existing = {
  name: recoveryServicesName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: recoveryServicesVault
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'AzureBackupReport'
        enabled: false
      }
      {
        category: 'CoreAzureBackup'
        enabled: true
      }
      {
        category: 'AddonAzureBackupJobs'
        enabled: true
      }
      {
        category: 'AddonAzureBackupAlerts'
        enabled: true
      }
      {
        category: 'AddonAzureBackupPolicy'
        enabled: true
      }
      {
        category: 'AddonAzureBackupStorage'
        enabled: true
      }
      {
        category: 'AddonAzureBackupProtectedInstance'
        enabled: true
      }
      {
        category: 'AzureSiteRecoveryJobs'
        enabled: false
      }
      {
        category: 'AzureSiteRecoveryEvents'
        enabled: false
      }
      {
        category: 'AzureSiteRecoveryReplicatedItems'
        enabled: false
      }
      {
        category: 'AzureSiteRecoveryReplicationStats'
        enabled: false
      }
      {
        category: 'AzureSiteRecoveryRecoveryPoints'
        enabled: false
      }
      {
        category: 'AzureSiteRecoveryReplicationDataUploadRate'
        enabled: false
      }
      {
        category: 'AzureSiteRecoveryProtectedDiskDataChurn'
        enabled: false
      }
    ]
    logAnalyticsDestinationType: 'Dedicated'
  }
}

恢复服务保管库参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "settingName": {
      "value": "<SettingName>"
    },
    "recoveryServicesName": {
      "value": "<RecoveryServicesName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Log Analytics 工作区的诊断设置

下面的示例通过向模板添加一种 Microsoft.OperationalInsights/workspaces/providers/diagnosticSettings 类型的资源，从而为 Log Analytics 工作区创建诊断设置。 本示例将有关在工作区中执行的查询的审核数据发送到同一工作区。

Log Analytics 工作区

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。


为Log Analytics工作区配置查询审核 
param workspaceName string = '<WorkspaceName>'
param settingName string = '<SettingName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'
param destinationStorageSubscriptionId string = '<DestinationStorageSubscriptionId>'
param destinationStorageResourceGroupName string = '<DestinationStorageResourceGroupName>'
param destinationStorageAccountName string = '<DestinationStorageAccountName>'
param eventHubSubscriptionId string = '<EventHubSubscriptionId>'
param eventHubResourceGroupName string = '<EventHubResourceGroupName>'
param eventHubNamespaceName string = '<EventHubNamespaceName>'
param eventHubAuthorizationRuleName string = '<EventHubAuthorizationRuleName>'
param eventHubName string = '<EventHubName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var storageAccountId = resourceId(
  destinationStorageSubscriptionId,
  destinationStorageResourceGroupName,
  'Microsoft.Storage/storageAccounts',
  destinationStorageAccountName
)

var eventHubAuthorizationRuleId = resourceId(
  eventHubSubscriptionId,
  eventHubResourceGroupName,
  'Microsoft.EventHub/namespaces/authorizationRules',
  eventHubNamespaceName,
  eventHubAuthorizationRuleName
)

resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@<WorkspaceApiVersion>' existing = {
  name: workspaceName
}
resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: logAnalyticsWorkspace
  properties: {
    workspaceId: workspaceId
    storageAccountId: storageAccountId
    eventHubAuthorizationRuleId: eventHubAuthorizationRuleId
    eventHubName: eventHubName
    logs: [
      {
        category: 'Audit'
        enabled: true
      }
    ]
  }
}

Log Analytics工作区参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "settingName": {
      "value": "<SettingName>"
    },
    "workspaceName": {
      "value": "<WorkspaceName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    },
    "destinationStorageSubscriptionId": {
      "value": "<DestinationStorageSubscriptionId>"
    },
    "destinationStorageResourceGroupName": {
      "value": "<DestinationStorageResourceGroupName>"
    },
    "destinationStorageAccountName": {
      "value": "<DestinationStorageAccountName>"
    },
    "eventHubSubscriptionId": {
      "value": "<EventHubSubscriptionId>"
    },
    "eventHubResourceGroupName": {
      "value": "<EventHubResourceGroupName>"
    },
    "eventHubNamespaceName": {
      "value": "<EventHubNamespaceName>"
    },
    "eventHubAuthorizationRuleName": {
      "value": "<EventHubAuthorizationRuleName>"
    },
    "eventHubName": {
      "value": "<EventHubName>"
    }
  }
}

Azure 存储的诊断设置

以下示例为 Azure 存储帐户中提供的每个存储服务终结点创建诊断设置。 设置应用于帐户中可用的每个单独存储服务。 可用的存储服务取决于存储帐户的类型。

此模板仅在帐户中存在存储服务时，才会为该帐户创建诊断设置。 对于提供的每项服务，诊断设置将启用事务指标以及资源日志集合，以进行读取、写入和删除操作。

Azure 存储

以下Bicep示例使用Microsoft.Insights/diagnosticSettings资源类型。

main.bicep

注释

将 main.bicep 和 module.bicep 保存在同一目录中。 主文件检索现有帐户的服务终结点，并将其连同目标参数一起传递给模块。

param storageAccountName string = '<StorageAccountName>'
param settingName string = '<SettingName>'
param storageSyncName string = '<StorageSyncName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'

module nested './module.bicep' = {
  name: 'nested'
  params: {
    endpoints: reference(resourceId('Microsoft.Storage/storageAccounts', storageAccountName), '<StorageEndpointReadApiVersion>', 'Full').properties.primaryEndpoints
    settingName: settingName
    storageAccountName: storageAccountName
    storageSyncName: storageSyncName
    destinationWorkspaceSubscriptionId: destinationWorkspaceSubscriptionId
    destinationWorkspaceResourceGroupName: destinationWorkspaceResourceGroupName
    destinationWorkspaceName: destinationWorkspaceName
  }
}

module.bicep

注释

此模块由 main.bicep 调用；它不是单独的部署入口点。 其 endpoints 对象来自现有存储帐户。 storageSyncName 标识同一部署资源组中的单独目标存储帐户。


为可用的存储服务配置诊断 
param endpoints object
param settingName string = '<SettingName>'
param storageAccountName string = '<StorageAccountName>'
param storageSyncName string = '<StorageSyncName>'
param destinationWorkspaceSubscriptionId string = '<DestinationWorkspaceSubscriptionId>'
param destinationWorkspaceResourceGroupName string = '<DestinationWorkspaceResourceGroupName>'
param destinationWorkspaceName string = '<DestinationWorkspaceName>'

var workspaceId = resourceId(
  destinationWorkspaceSubscriptionId,
  destinationWorkspaceResourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  destinationWorkspaceName
)

var hasBlob = contains(endpoints, 'blob')
var hasTable = contains(endpoints, 'table')
var hasFile = contains(endpoints, 'file')
var hasQueue = contains(endpoints, 'queue')

resource storageAccount 'Microsoft.Storage/storageAccounts@<StorageAccountApiVersion>' existing = {
  name: storageAccountName
}

resource diagnosticSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = {
  name: settingName
  scope: storageAccount
  properties: {
    workspaceId: workspaceId
    storageAccountId: resourceId('Microsoft.Storage/storageAccounts', storageSyncName)
    metrics: [
      {
        category: 'Transaction'
        enabled: true
      }
    ]
  }
}

resource blob 'Microsoft.Storage/storageAccounts/blobServices@<StorageBlobServiceApiVersion>' existing = {
  name:'default'
  parent:storageAccount
}

resource blobSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = if (hasBlob) {
  name: settingName
  scope: blob
  properties: {
    workspaceId: workspaceId
    storageAccountId: resourceId('Microsoft.Storage/storageAccounts', storageSyncName)
    logs: [
      {
        category: 'StorageRead'
        enabled: true
      }
      {
        category: 'StorageWrite'
        enabled: true
      }
      {
        category: 'StorageDelete'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'Transaction'
        enabled: true
      }
    ]
  }
}

resource table 'Microsoft.Storage/storageAccounts/tableServices@<StorageTableServiceApiVersion>' existing = {
  name:'default'
  parent:storageAccount
}

resource tableSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = if (hasTable) {
  name: settingName
  scope: table
  properties: {
    workspaceId: workspaceId
    storageAccountId: resourceId('Microsoft.Storage/storageAccounts', storageSyncName)
    logs: [
      {
        category: 'StorageRead'
        enabled: true
      }
      {
        category: 'StorageWrite'
        enabled: true
      }
      {
        category: 'StorageDelete'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'Transaction'
        enabled: true
      }
    ]
  }
}

resource file 'Microsoft.Storage/storageAccounts/fileServices@<StorageFileServiceApiVersion>' existing = {
  name:'default'
  parent:storageAccount
}

resource fileSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = if (hasFile) {
  name: settingName
  scope: file
  properties: {
    workspaceId: workspaceId
    storageAccountId: resourceId('Microsoft.Storage/storageAccounts', storageSyncName)
    logs: [
      {
        category: 'StorageRead'
        enabled: true
      }
      {
        category: 'StorageWrite'
        enabled: true
      }
      {
        category: 'StorageDelete'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'Transaction'
        enabled: true
      }
    ]
  }
}

resource queue 'Microsoft.Storage/storageAccounts/queueServices@<StorageQueueServiceApiVersion>' existing = {
  name:'default'
  parent:storageAccount
}

resource queueSetting 'Microsoft.Insights/diagnosticSettings@<DiagnosticSettingsApiVersion>' = if (hasQueue) {
  name: settingName
  scope: queue
  properties: {
    workspaceId: workspaceId
    storageAccountId: resourceId('Microsoft.Storage/storageAccounts', storageSyncName)
    logs: [
      {
        category: 'StorageRead'
        enabled: true
      }
      {
        category: 'StorageWrite'
        enabled: true
      }
      {
        category: 'StorageDelete'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'Transaction'
        enabled: true
      }
    ]
  }
}

Azure 存储参数文件 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "value": "<StorageAccountName>"
    },
    "settingName": {
      "value": "<SettingName>"
    },
    "storageSyncName": {
      "value": "<StorageSyncName>"
    },
    "destinationWorkspaceSubscriptionId": {
      "value": "<DestinationWorkspaceSubscriptionId>"
    },
    "destinationWorkspaceResourceGroupName": {
      "value": "<DestinationWorkspaceResourceGroupName>"
    },
    "destinationWorkspaceName": {
      "value": "<DestinationWorkspaceName>"
    }
  }
}

后续步骤

  • 上次更新时间为