使用 Azure 存储将 Azure 指标和日志数据存档Archive Azure metric and log data using Azure Storage

Azure 环境的很多层都会生成可存档到 Azure 存储帐户的日志和指标数据。Several layers of your Azure environment produce log and metric data that can be archived to an Azure Storage account. 在数据超过保留期之后,你可能需要执行此操作,在不可搜索的低成本存储空间中保留某时间段内监视数据的历史记录。You may want to do this to preserve a history of monitoring data over time in an inexpensive, non-searchable store after that data has passed its retention period.

  • Azure Monitor 平台指标可保留 93 天。Azure Monitor platform metrics are kept for 93 days.
  • 资源诊断日志仅在路由到 Log Analytics 时才显示,这些日志在 Log Analytics 中具有至少 30 天的可配置保留期。Resource diagnostic logs only appear if routed to Log Analytics, where they have a configurable retention period with a minimum of 30 days.
  • 活动日志条目可存储 90 天。Activity log entries are kept for 90 days.

本教程逐步介绍如何配置 Azure 环境以将数据存档到存储帐户。This tutorial steps through the process of configuring your Azure environment to archive data to a storage account.

  • 创建用于保存监控数据的存储帐户Create a storage account to hold monitoring data
  • 将订阅日志路由到其中Route subscription logs to it
  • 将资源数据路由到其中Route resource data to it
  • 将虚拟机(来宾 OS)数据路由到其中Route virtual machine (guest OS) data to it
  • 查看其中的监控数据View the monitoring data in it
  • 清理资源Clean up your resources

如果没有 Azure 订阅,请在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

登录到 Azure 门户Sign in to the Azure portal

登录到 Azure 门户Sign in to the Azure portal.

创建存储帐户Create a storage account

首先,需要设置要存档监视数据的存储帐户。First you need to set up a storage account to which the monitoring data will be archived. 为此,请按照此处的步骤操作To do this, follow the steps here.

将订阅日志路由到存储帐户Route subscription logs to the storage account

现可开始设置 Azure 环境,以便将监视数据路由到存储帐户。You are now ready to begin to set up your Azure environment to route monitoring data to a storage account. 首先配置要路由到存储帐户的订阅级数据(包含在 Azure 活动日志中)。First we configure subscription-level data (contained in the Azure Activity Log) to be routed to the storage account. Azure 活动日志提供 Azure 中的订阅级事件的历史记录。The Azure Activity Log provides a history of subscription-level events in Azure. 可在 Azure 门户中浏览该日志来确定由谁在何时创建、更新或删除了哪些资源 。You can browse it in the Azure portal to determine who created, updated, or deleted what resources and when they did it.

  1. 单击左侧导航列表中的“监视器”按钮,然后单击“活动日志” 。Click the Monitor button found on the left-hand navigation list, then on Activity Log.

    活动日志部分

  2. 在显示的活动日志部分,单击“导出”按钮 。In the Activity Log section that is displayed, click on the Export button.

  3. 在显示的“导出活动日志”部分,选中“导出到存储帐户”框,然后单击“选择存储帐户” 。In the Export activity log section that appears, check the box for Export to a storage account and click Select a storage account.

    活动日志导出

  4. 在显示的部分中,使用“存储帐户”下拉列表为先前在“创建存储帐户”步骤中创建的存储帐户选择名称,然后单击“确定” 。In the section that appears, use the Storage account dropdown to select the name of the storage account you created in the preceding Create a storage account step, then click OK.

    选择存储帐户

  5. 将“保留期(天)”滑块移至 30 。Set the Retention (days) slider to 30. 此滑块设置监视数据要在存储帐户中保留的天数。This slider sets a number of days to retain the monitoring data in the storage account. Azure Monitor 会自动删除早于所述天数的数据。Azure Monitor automatically deletes data older than the number of days specified. 如果保留期为 0 天,则无限期存储数据。A retention of zero days stores the data indefinitely.

  6. 单击“保存”并关闭此部分 。Click Save and close this section.

现在,订阅的监视数据将流入到存储帐户。Monitoring data from your subscription is now flowing into the storage account.

将资源数据路由到存储帐户Route resource data to the storage account

接下来,通过设置资源诊断设置来配置要路由到存储帐户的资源级别数据(资源指标和诊断日志) 。Now we configure resource-level data (resource metrics and diagnostic logs) to be routed to the storage account by setting up resource diagnostic settings.

  1. 单击左侧导航列表中的“监视器”按钮,然后单击“诊断设置” 。Click the Monitor button found on the left-hand navigation list, then on Diagnostic Settings. 在此处查看订阅中所有资源的列表,这些资源通过 Azure Monitor 生成监视数据。Here you see a list of all resources in your subscription that produce monitoring data through Azure Monitor. 如果此列表中没有任何资源,可在处理前创建逻辑应用,以拥有可在其中配置诊断设置的资源。If you do not have any resources in this list, you can create a logic app before proceeding so that you have a resource that you can configure a diagnostic setting on.

  2. 单击列表中的某个资源,然后单击“启用诊断” 。Click on a resource in the list, and then click Turn on diagnostics.

    启用诊断

    如果已配置了设置,则转而显示现有设置和“添加诊断设置”按钮 。If there is already a setting configured, you instead see the existing settings, and a button to Add diagnostic setting. 单击此按钮。Click this button.

    资源诊断设置是描述应从特定资源中路由哪个监视数据以及此监视数据应传输到何处的一种定义 。A resource diagnostic setting is a definition of what monitoring data should be routed from a particular resource and where that monitoring data should go.

  3. 在显示的部分中,提供设置的“名称”,并勾选“存档到存储帐户”框 。In the section that appears, give your setting a name and check the box for Archive to a storage account.

    诊断设置部分

  4. 单击“存档到存储帐户”下的“配置”按钮,并选择在上一部分中创建的存储帐户 。Click on the Configure button under Archive to a storage account and select the storage account you created in the preceding section. 单击 “确定”Click OK.

    诊断设置存储帐户

  5. 勾选“日志”和“指标”下的所有框 。Check all the boxes under Log and Metric. 可能仅有下述选项之一,这具体取决于资源类型。Depending on the resource type, you may only have one of these options. 这些复选框可控制向所选目标(本例中为存储帐户)发送此资源类型可用的哪些日志和指标数据类别。These checkboxes control what categories of log and metric data available for that resource type are sent to the destination you've selected, in this case, a storage account.

    诊断设置类别

  6. 将“保留期(天)”滑块移至 30 。Set the Retention (days) slider to 30. 此滑块设置监视数据要在存储帐户中保留的天数。This slider sets a number of days to retain the monitoring data in the storage account. Azure Monitor 会自动删除早于所述天数的数据。Azure Monitor automatically deletes data older than the number of days specified. 如果保留期为 0 天,则无限期存储数据。A retention of zero days stores the data indefinitely.

  7. 单击“保存” 。Click Save.

现在,资源的监视数据将流入到存储帐户。Monitoring data from your resource is now flowing into the storage account.

Note

当前不支持通过诊断设置发送多维指标。Sending multi-dimensional metrics via diagnostic settings is not currently supported. 多维指标将按平展后的单维指标导出,并跨维值聚合。Metrics with dimensions are exported as flattened single dimensional metrics, aggregated across dimension values.

例如: 可以基于每个队列级别浏览和绘制事件中心上的“传入消息”指标。For example: The 'Incoming Messages' metric on an Event Hub can be explored and charted on a per queue level. 但是,当通过诊断设置导出时,该指标将表示为事件中心的所有队列中的所有传入消息。However, when exported via diagnostic settings the metric will be represented as all incoming messages across all queues in the Event Hub.

将虚拟机(来宾 OS)数据路由到存储帐户Route virtual machine (guest OS) data to the storage account

  1. 如果订阅中没有虚拟机,请创建虚拟机If you do not already have a virtual machine in your subscription, create a virtual machine.

  2. 在门户左侧的导航栏列表中,单击“虚拟机” 。In the left-hand navigation list in the portal, click on Virtual Machines.

  3. 在显示的虚拟机列表中,单击已创建的虚拟机。In the list of virtual machines that is displayed, click on the virtual machine you created.

  4. 在显示的部分中,单击左侧导航栏中的“诊断设置” 。In the section that appears, click on Diagnostic Settings on the left-hand navigation. 在此部分中,可在虚拟机上设置现成的 Azure Monitor 监视扩展并将 Windows 或 Linux 生成的数据路由到存储帐户中。This section enables you to set up the out-of-box monitoring extension from Azure Monitor on your virtual machine and route data being produced by Windows or Linux to a storage account.

    导航到诊断设置

  5. 在显示的部分中,单击“启用来宾级别监视” 。Click Enable guest-level monitoring in the section that appears.

    启用诊断设置

  6. 正确保存诊断设置之后,“概述”选项卡会显示一个列表描述所收集的数据和存储位置 。Once the diagnostic setting has correctly saved, the Overview tab shows a list of the data being collected and where it is being stored. 单击“性能计数器”部分,查看正在收集的一组 Windows 性能计数器 。Click on the Performance counters section to review the set of Windows performance counters being collected.

    性能计数器设置

  7. 单击“日志”选项卡,并勾选应用程序和系统日志中的“信息”级别日志复选框 。Click on the Logs tab and check the checkboxes for Information level logs on Application and System logs.

    日志设置

  8. 单击“存储帐户”下的“代理”选项卡,并单击所示的存储帐户名称 。Click on the Agent tab and under Storage account click on the name of the storage account shown.

    更新存储帐户

  9. 在显示的部分中,选择在之前的“创建存储帐户”步骤中创建的存储帐户 。In the section that appears, pick the storage account you created in the preceding Create a storage account step.

  10. 单击“保存” 。Click Save.

现在,虚拟机的监视数据将流入到存储帐户。Monitoring data from your virtual machines is now flowing into the storage account.

查看存储帐户中的监视数据View the monitoring data in the storage account

Warning

存储帐户中日志数据的格式将在 2018 年 11 月 1 日更改为 JSON Lines。The format of the log data in the storage account will change to JSON Lines on Nov. 1st, 2018. 请参阅此文章来了解此影响,以及如何通过更新工具来处理新格式。See this article for a description of the impact and how to update your tooling to handle the new format.

如果已执行前述步骤,则数据已开始流向存储帐户。If you have followed the preceding steps, data has begun flowing to your storage account.

  1. 对于某些数据类型(例如活动日志),需要有一些在存储帐户中生成事件的活动。For some data types, for example, the Activity Log, there needs to be some activity that generates an event in the storage account. 若要在活动日志中生成活动,请按照这些说明操作。To generate activity in the Activity Log, follow these instructions. 可能最多需等待 5 分钟,事件即会在存储帐户中显示。You may need to wait up to five minutes before the event appears in the storage account.

  2. 在门户中,导航到左侧导航栏上的“存储帐户”部分 。In the portal, navigate to the Storage Accounts section by finding it on the left-hand navigation bar.

  3. 找到并单击上一部分中创建的存储帐户。Identify the storage account you created in the preceding section and click on it.

  4. 单击“Blob”,再单击标记为“insights-operational-logs”的容器,最后单击标记为“name=default”的容器 。Click on Blobs, then on the container labeled insights-operational-logs and finally on the container labeled name=default. 这就是包含活动日志的容器。This is the container that has your Activity Log in it. 监视数据依次按资源 ID(仅活动日志的订阅 ID)、日期和时间细分存入容器。Monitoring data is broken out into containers by resource ID (just the subscription ID for the Activity Log), then by date and time. 这些 blob 的完整格式为:The full format for these blobs is:

    insights-operational-logs/name=default/resourceId=/SUBSCRIPTIONS/{订阅 ID}/y={四位数年份}/m={两位数月份}/d={两位数日期}/h={两位数 24 小时制小时}/m=00/PT1H.jsoninsights-operational-logs/name=default/resourceId=/SUBSCRIPTIONS/{subscription ID}/y={four-digit numeric year}/m={two-digit numeric month}/d={two-digit numeric day}/h={two-digit 24-hour clock hour}/m=00/PT1H.json

  5. 通过单击容器中的资源 ID、日期和时间,导航到 PT1H.json 文件。Navigate to the PT1H.json file by clicking into the containers for resource ID, date, and time. 单击 PT1H.json 文件,再单击“下载” 。Click on the PT1H.json file and click Download. 每个 PT1H.json blob 都包含一个 JSON blob,其中的事件为在 blob URL 中指定的小时(例如 h=12)内发生的。Each PT1H.json blob contains a JSON blob of events that occurred within the hour specified in the blob URL (for example, h=12). 在当前的小时内发生的事件将附加到 PT1H.json 文件。During the present hour, events are appended to the PT1H.json file as they occur. 分钟值始终为 00 (m=00),因为日志事件按小时细分成单个 blob。The minute value (m=00) is always 00, since log events are broken into individual blobs per hour.

    现可查看存储帐户中存储的 JSON 事件。You can now view the JSON event that was stored in the storage account. 资源诊断日志的 blob 格式为:For resource diagnostic logs, the format for the blobs is:

    insights-logs-{日志类别名称}/resourceId=/{资源 ID}/y={4 位数年份}/m={2 位数月份}/d={2 位数日期}/h={2 位数 24 小时制小时}/m=00/PT1H.jsoninsights-logs-{log category name}/resourceId=/{resource ID}/y={four-digit numeric year}/m={two-digit numeric month}/d={two-digit numeric day}/h={two-digit 24-hour clock hour}/m=00/PT1H.json

  6. 来宾 OS 监视数据存储在表中。Guest OS monitoring data is stored in tables. 导航回到存储帐户主页,并单击“表” 。navigate back to the storage account home, and click Tables. 存在用于指标、性能计数器和事件日志的表格。There are tables for metrics, performance counters, and event logs.

现已成功设置要存档到存储帐户的监视数据。You have now successfully set up monitoring data to be archived to a storage account.

清理资源Clean up resources

  1. 从之前的“将订阅日志路由到存储帐户”步骤导航回到“导出活动日志”部分,并单击“重置” 。Navigate back to the Export Activity Log section from the preceding Route subscription logs to the storage account step, and click Reset.

  2. 导航到“诊断设置”部分,单击在之前的“将资源数据路由到存储帐户”步骤中创建诊断设置所使用的资源,然后找到创建的设置,单击“编辑设置”按钮,并单击“删除” 。Navigate to the Diagnostic Settings section, click the resource on which you created a diagnostic setting in the preceding Route resource data to the storage account step, then find the setting you created, click the Edit setting button and click Delete.

  3. 在之前“将虚拟机(来宾 OS)数据路由到存储帐户”步骤中配置的虚拟机上导航到“诊断设置”部分,然后在“代理”选项卡下单击“删除”(位于“删除 Azure 诊断代理”部分下) 。Navigate to the Diagnostic Settings section on the virtual machine you configured in the preceding Route virtual machine (guest OS) data to the storage account step, and under the Agent tab click Remove (beneath the Remove Azure Diagnostics agent section).

  4. 导航到之前“创建存储帐户”步骤中所创建的存储帐户,并单击“删除存储帐户” 。Navigate to the storage account you created in the preceding Create a storage account step and click Delete storage account. 键入存储帐户名称,再单击“删除” 。Type the name of the storage account, and then click Delete.

  5. 如果已为前述步骤创建虚拟机或逻辑应用,请一并删除。If you created a virtual machine or Logic App for the preceding steps, delete those as well.

后续步骤Next steps

在本教程中,学习了如何设置 Azure 环境(订阅、资源和来宾 OS)中要存档到存储帐户的监视数据。In this tutorial, you learned how to set up monitoring data from your Azure environment (subscription, resource, and guest OS) to be archived to a storage account.

  • 创建用于保存监控数据的存储帐户Create a storage account to hold monitoring data
  • 将订阅日志路由到其中Route subscription logs to it
  • 将资源数据路由到其中Route resource data to it
  • 将虚拟机(来宾 OS)数据路由到其中Route virtual machine (guest OS) data to it
  • 查看其中的监控数据View the monitoring data in it
  • 清理资源Clean up your resources

若要充分使用数据并得出额外见解,还要将数据发送到 Log Analytics。To get more out of your data and derive additional insights, also send your data into Log Analytics.