使用 Azure CLI 2.0 创建 Log Analytics 工作区Create a Log Analytics workspace with Azure CLI 2.0

Azure CLI 2.0 用于从命令行或脚本创建和管理 Azure 资源。The Azure CLI 2.0 is used to create and manage Azure resources from the command line or in scripts. 本快速入门展示了如何使用 Azure CLI 2.0 在 Azure Monitor 中部署 Log Analytics 工作区。This quickstart shows you how to use Azure CLI 2.0 to deploy a Log Analytics workspace in Azure Monitor. Log Analytics 工作区是适用于 Azure Monitor 日志数据的唯一环境。A Log Analytics workspace is a unique environment for Azure Monitor log data. 每个工作区都有其自己的数据存储库和配置,并且数据源和解决方案均配置为将其数据存储在特定工作区中。Each workspace has its own data repository and configuration, and data sources and solutions are configured to store their data in a particular workspace. 如果打算从以下源收集数据,则需要 Log Analytics 工作区:You require a Log Analytics workspace if you intend on collecting data from the following sources:

  • 订阅中的 Azure 资源Azure resources in your subscription
  • Configuration Manager 中的设备集合Device collections from Configuration Manager
  • Azure 存储中的诊断或日志数据Diagnostic or log data from Azure storage

对于其他源,如环境中的 Azure VM 和 Windows VM 或 Linux VM,请参阅以下主题:For other sources, such as Azure VMs and Windows or Linux VMs in your environment, see the following topics:

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

备注

请先运行 az cloud set -n AzureChinaCloud 更改云环境,然后才能在 Azure 中国中使用 Azure CLI。Before you can use Azure CLI in Azure China , please run az cloud set -n AzureChinaCloud first to change the cloud environment. 若要切换回 Azure 公有云,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Azure Public Cloud, run az cloud set -n AzureCloud again.

如果选择在本地安装并使用 CLI,本快速入门要求运行 Azure CLI 2.0.30 或更高版本。If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.30 or later. 运行 az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅安装 Azure CLI 2.0If you need to install or upgrade, see Install Azure CLI 2.0.

创建工作区Create a workspace

使用 az deployment group create 创建工作区。Create a workspace with az deployment group create. 以下示例使用本地计算机上的资源管理器模板在 chinanorth 位置中创建工作区。The following example creates a workspace in the chinanorth location using a Resource Manager template from your local machine. JSON 模板在经过配置后,只提示你输入工作区的名称,并为其他参数指定默认值,这些参数将会用作环境中的标准配置。The JSON template is configured to only prompt you for the name of the workspace, and specifies a default value for the other parameters that would likely be used as a standard configuration in your environment. 也可以将模板存储在 Azure 存储帐户中,以便在组织中共享访问。Or you can store the template in an Azure storage account for shared access in your organization. 有关使用模板的更多信息,请参阅使用资源管理器模板和 Azure CLI 部署资源For further information about working with templates, see Deploy resources with Resource Manager templates and Azure CLI

有关支持的区域的信息,请参阅可在哪些区域使用 Log Analytics,并在“搜索产品”字段中搜索 Azure Monitor。For information about regions supported, see regions Log Analytics is available in and search for Azure Monitor from the Search for a product field.

以下参数设置默认值:The following parameters set a default value:

  • 位置 - 默认为“中国北部”location - defaults to China North
  • sku - 默认为新的“按 GB”定价层,该层已在 2018 年 4 月的定价模型中发布sku - defaults to the new Per-GB pricing tier released in the April 2018 pricing model

警告

如果在订阅中创建或配置 Log Analytics 工作区,而该订阅已加入 2018 年 4 月的新定价模型,则唯一有效的 Log Analytics 定价层为 PerGB2018If creating or configuring a Log Analytics workspace in a subscription that has opted into the new April 2018 pricing model, the only valid Log Analytics pricing tier is PerGB2018.

创建和部署模板Create and deploy template

  1. 将以下 JSON 语法复制并粘贴到该文件中:Copy and paste the following JSON syntax into your file:

    {
    "$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
            "type": "String",
            "metadata": {
              "description": "Specifies the name of the workspace."
            }
        },
        "location": {
            "type": "String",
            "allowedValues": [
              "chinaeast2"
            ],
            "defaultValue": "chinaeast2",
            "metadata": {
              "description": "Specifies the location in which to create the workspace."
            }
        },
        "sku": {
            "type": "String",
            "allowedValues": [
              "Standalone",
              "PerNode",
              "PerGB2018"
            ],
            "defaultValue": "PerGB2018",
            "metadata": {
            "description": "Specifies the service tier of the workspace: Standalone, PerNode, Per-GB"
        }
          }
    },
    "resources": [
        {
            "type": "Microsoft.OperationalInsights/workspaces",
            "name": "[parameters('workspaceName')]",
            "apiVersion": "2015-11-01-preview",
            "location": "[parameters('location')]",
            "properties": {
                "sku": {
                    "Name": "[parameters('sku')]"
                },
                "features": {
                    "searchVersion": 1
                }
            }
          }
       ]
    }
    
  2. 按要求编辑模板。Edit the template to meet your requirements. 查看 Microsoft.OperationalInsights/workspaces 模板参考,了解支持的属性和值。Review Microsoft.OperationalInsights/workspaces template reference to learn what properties and values are supported.

  3. 在本地文件夹中将此文件另存为 deploylaworkspacetemplate.jsonSave this file as deploylaworkspacetemplate.json to a local folder.

  4. 已做好部署此模板的准备。You are ready to deploy this template. 在包含模板的文件夹中使用以下命令。Use the following commands from the folder containing the template. 当系统提示输入工作区名称时,提供一个在资源组中唯一的名称。When you're prompted for a workspace name, provide a name that is unique in your resource group.

    az deployment group create --resource-group <my-resource-group> --name <my-deployment-name> --template-file deploylaworkspacetemplate.json
    

部署可能需要几分钟才能完成。The deployment can take a few minutes to complete. 完成后,会看到一条包含结果的消息,如下所示:When it finishes, you see a message similar to the following that includes the result:

部署完成后的示例结果

疑难解答Troubleshooting

如果创建了一个工作区,该工作区已在过去 14 天内删除且处于软删除状态,那么该操作可能会有不同的结果,具体取决于你的工作区配置:When you create a workspace that was deleted in the last 14 days and in soft-delete state, the operation could have different outcome depending on your workspace configuration:

  1. 如果你提供的工作区名称、资源组、订阅和区域与已删除的工作区中的相同,则将恢复你的工作区,包括其数据、配置和连接的代理。If you provide the same workspace name, resource group, subscription and region as in the deleted workspace, your workspace will be recovered including its data, configuration and connected agents.
  2. 每个资源组的工作区名称必须是唯一的。Workspace name must be unique per resource group. 如果你使用已经存在(也在资源组的软删除中)的工作区名称,则会收到错误消息:工作区名称 workspace-name 不唯一或冲突 。If you use a workspace name that is already exists, also in soft-delete in your your resource group, you will get an error The workspace name 'workspace-name' is not unique, or conflict. 若要替换软删除,同时永久删除你的工作区并创建新的同名工作区,请按照以下步骤,先恢复工作区再执行永久删除:To override the soft-delete and permanently delete your workspace and create a new workspace with the same name, follow these steps to recover the workspace first and perform permanent delete:

后续步骤Next steps

现在,你已有可用的工作区,可以配置监视遥测收集、运行日志搜索分析该数据,以及添加管理解决方案以提供其他数据和分析见解。Now that you have a workspace available, you can configure collection of monitoring telemetry, run log searches to analyze that data, and add a management solution to provide additional data and analytic insights.