在 Azure 门户中创建 Log Analytics 工作区Create a Log Analytics workspace in the Azure portal

使用“Log Analytics 工作区”菜单通过 Azure 门户创建 Log Analytics 工作区。Use the Log Analytics workspaces menu to create a Log Analytics workspace using the Azure portal. Log Analytics 工作区是适用于 Azure Monitor 日志数据的唯一环境。A Log Analytics workspace is a unique environment for Azure Monitor log data. 每个工作区都有其自己的数据存储库和配置,并且数据源和解决方案均配置为将其数据存储在特定工作区中。Each workspace has its own data repository and configuration, and data sources and solutions are configured to store their data in a particular workspace. 如果打算从以下源收集数据,则需要 Log Analytics 工作区:You require a Log Analytics workspace if you intend on collecting data from the following sources:

  • 订阅中的 Azure 资源Azure resources in your subscription
  • 受 System Center Operations Manager 监视的本地计算机On-premises computers monitored by System Center Operations Manager
  • Configuration Manager 中的设备集合Device collections from Configuration Manager
  • Azure 存储中的诊断或日志数据Diagnostics or log data from Azure storage

对于其他源,如环境中的 Azure VM 和 Windows VM 或 Linux VM,请参阅以下主题:For other sources, such as Azure VMs and Windows or Linux VMs in your environment, see the following topics:

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a Trial before you begin.

登录到 Azure 门户Sign in to Azure portal

https://portal.azure.cn 中登录 Azure 门户。Sign in to the Azure portal at https://portal.azure.cn.

创建工作区Create a workspace

  1. 在 Azure 门户中,单击“所有服务”。In the Azure portal, click All services. 在资源列表中,键入“Log Analytics”。In the list of resources, type Log Analytics. 开始键入时,会根据输入筛选该列表。As you begin typing, the list filters based on your input. 选择“Log Analytics 工作区”。Select Log Analytics workspaces.

    Azure 门户

  2. 单击“添加”,然后为以下各项选择选项:Click Add, and then select choices for the following items:

    • 为新的 Log Analytics 工作区提供名称,如 DefaultLAWorkspace。Provide a name for the new Log Analytics workspace, such as DefaultLAWorkspace. 此名称在所有 Azure Monitor 订阅中必须是全局唯一的。This name must be globally unique across all Azure Monitor subscriptions.

    • 如果选择的默认值不合适,请从下拉列表中选择要链接到的订阅Select a Subscription to link to by selecting from the drop-down list if the default selected is not appropriate.

    • 对于资源组,选择要使用已设置的现有资源组,还是要创建一个新资源组。For Resource Group, choose to use an existing resource group already setup or create a new one.

    • 选择可用位置Select an available Location. 有关详细信息,请参阅可在哪些区域中使用 Log Analytics,并在“搜索产品”字段中搜索 Azure Monitor。For more information, see which regions Log Analytics is available in and search for Azure Monitor from the Search for a product field.

    • 如果在 2018 年 4 月 2 日后创建的新订阅中创建工作区,则它将自动使用“每 GB”定价计划,并且不提供用于选择定价层的选项。If you are creating a workspace in a new subscription created after April 2, 2018, it will automatically use the Per GB pricing plan and the option to select a pricing tier will not be available. 如果是为 4 月 2 日之前创建的现有订阅创建工作区,或者是为绑定到现有企业协议 (EA) 注册的订阅创建工作区,则可以选择首选定价层。If you are creating a workspace for an existing subscription created before April 2, or to subscription that was tied to an existing Enterprise Agreement (EA) enrollment, select your preferred pricing tier. 有关特定层的详细信息,请参阅 Log Analytics 定价详细信息For more information about the particular tiers, see Log Analytics Pricing Details.

      创建 Log Analytics 资源边栏选项卡

  3. 在“Log Analytics 工作区”窗格上提供所需信息后,单击“确定” 。After providing the required information on the Log Analytics Workspace pane, click OK.

在验证信息和创建工作区时,可以在菜单中的“通知”下面跟踪操作进度。While the information is verified and the workspace is created, you can track its progress under Notifications from the menu.

疑难解答Troubleshooting

如果创建了一个工作区,该工作区已在过去 14 天内删除且处于软删除状态,那么该操作可能会有不同的结果,具体取决于你的工作区配置:When you create a workspace that was deleted in the last 14 days and in soft-delete state, the operation could have different outcome depending on your workspace configuration:

  1. 如果你提供的工作区名称、资源组、订阅和区域与已删除的工作区中的相同,则将恢复你的工作区,包括其数据、配置和连接的代理。If you provide the same workspace name, resource group, subscription and region as in the deleted workspace, your workspace will be recovered including its data, configuration and connected agents.
  2. 如果你使用相同的工作区名称,但提供不同的资源组、订阅或区域,则将收到错误“此工作区名称已被使用。请尝试输入其他名称。”If you use the same workspace name, but different resource group, subscription or region, you will get an error This workspace name is already in use. Please try another one. 若要替换软删除,同时永久删除你的工作区并创建新的同名工作区,请按照以下步骤,先恢复工作区再执行永久删除:To override the soft-delete and permanently delete your workspace and create a new workspace with the same name, follow these steps to recover the workspace first and perform permanent delete:

后续步骤Next steps

现在,你已有可用的工作区,可以配置监视遥测收集、运行日志搜索分析该数据,以及添加管理解决方案以提供其他数据和分析见解。Now that you have a workspace available, you can configure collection of monitoring telemetry, run log searches to analyze that data, and add a management solution to provide additional data and analytic insights.