创建诊断设置以收集 Azure 中的平台日志和指标Create diagnostic setting to collect platform logs and metrics in Azure

Azure 中的平台日志提供 Azure 资源及其所依赖的 Azure 平台的详细诊断和审核信息。Platform logs in Azure provide detailed diagnostic and auditing information for Azure resources and the Azure platform they depend on. 本文详细介绍如何创建和配置诊断设置,以将平台日志收集到不同的目标。This article provides details on creating and configuring diagnostic settings to collect platform logs to different destinations.

每个 Azure 资源需有自身的诊断设置。Each Azure resource requires its own diagnostic setting. 诊断设置定义该资源的以下属性:The diagnostic setting defines the following for that resource:

  • 发送到设置中所定义目标的日志和指标数据的类别。Categories of logs and metric data sent to the destinations defined in the setting. 不同资源类型的可用类别各不相同。The available categories will vary for different resource types.
  • 要将日志发送到的一个或多个目标。One or more destinations to send the logs. 当前目标包括 Log Analytics 工作区、事件中心和 Azure 存储。Current destinations include Log Analytics workspace, Event Hubs, and Azure Storage.
  • 存储在 Azure 存储中的数据的保留策略。Retention policy for data stored in Azure Storage.

一个诊断设置可为每个目标定义一种类型。A single diagnostic setting can define one of each of the destinations. 若要将数据发送到多个特定的目标类型(例如,两个不同的 Log Analytics 工作区),请创建多个设置。If you want to send data to more than one of a particular destination type (for example, two different Log Analytics workspaces), then create multiple settings. 每个资源最多可以有 5 个诊断设置。Each resource can have up to 5 diagnostic settings.

Note

活动日志可以像其他平台日志一样转发到相同的目标,但未配置诊断设置。The Activity log can be forwarded to the same destinations as the other platform logs, but is not configured with diagnostic settings. 有关详细信息,请参阅 Azure 中的平台日志概述See Overview of Platform logs in Azure for details.

Note

平台指标自动收集到 Azure Monitor 指标中。Platform metrics are collected automatically to Azure Monitor Metrics. 使用诊断设置可将特定 Azure 服务的指标收集到 Azure Monitor 日志中,以使用日志查询结合其他监视数据进行分析。Diagnostic settings can be used to collect metrics for certain Azure services into Azure Monitor Logs for analysis with other monitoring data using log queries.

DestinationsDestinations

平台日志可以发送到下表中列出的目标。Platform logs can be sent to the destinations in the following table. 每个目标的配置是使用本文所述的创建诊断设置的相同过程执行的。The configuration for each destination is performed using the same process for creating diagnostic settings described in this article. 有关将数据发送到该目标的详细信息,请参阅下表中的每个链接。Follow each link in the following table for details on sending data to that destination.

目标Destination 说明Description
Log Analytics 工作区Log Analytics workspace 将日志收集到 Log Analytics 工作区可以使用强大的日志查询结合 Azure Monitor 收集的其他监视数据对其进行分析,并利用其他 Azure Monitor 功能,例如警报和可视化。Collecting logs into a Log Analytics workspace allows you to analyze them with other monitoring data collected by Azure Monitor using powerful log queries and also to leverage other Azure Monitor features such as alerts and visualizations.
事件中心Event hubs 向事件中心发送日志可将数据流式传输到外部系统,例如第三方 SIEM 和其他日志分析解决方案。Sending logs to Event Hubs allows you to stream data to external systems such as third-party SIEMs and other log analytics solutions.
Azure 存储帐户Azure storage account 将日志存档到 Azure 存储帐户有助于审核、静态分析或备份。Archiving logs to an Azure storage account is useful for audit, static analysis, or backup.

在 Azure 门户中创建诊断设置Create diagnostic settings in Azure portal

可以在 Azure 门户中通过“Azure Monitor”菜单或资源菜单配置诊断设置。You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource.

  1. 在 Azure 门户上的“Azure Monitor”菜单中,单击“设置”下的“诊断设置”,然后单击该资源。 From the Azure Monitor menu in the Azure portal, click Diagnostic settings under Settings and then click on the resource.

    诊断设置

    或者,在 Azure 门户上的资源菜单中,单击“Monitor”下的“诊断设置”。 Or from the resource menu in the Azure portal, click Diagnostic settings under Monitor.

    诊断设置

  2. 如果选定的资源上不存在任何设置,系统会提示创建设置。If no settings exist on the resource you have selected, you are prompted to create a setting. 单击“启用诊断” 。Click Turn on diagnostics.

    添加诊断设置 - 没有现有的设置

    如果资源上有现有的设置,则会看到已配置的设置列表。If there are existing settings on the resource, you will see a list of settings already configured. 单击“添加诊断设置”以添加新设置,或单击“编辑设置”以编辑现有设置。 Either click Add diagnostic setting to add a new setting or Edit setting to edit an existing one. 每个设置最多只能包含一个目标类型。Each setting can have no more than one of each of the destination types.

    添加诊断设置 - 现有的设置

  3. 为设置指定名称(如果未指定)。Give your setting a name if it doesn't already have one.

  4. 选中要将日志发送到的每个目标对应的框。Check the box for each destination to send the logs. 单击“配置”并根据下表中所述指定其设置。 Click Configure to specify their settings as described in the following table.

    设置Setting 说明Description
    Log Analytics 工作区Log Analytics workspace 工作区的名称。Name of workspace.
    存储帐户Storage account 存储帐户的名称。Name of storage account.
    事件中心命名空间Event hub namespace 要在其中创建事件中心的命名空间(如果这是首次流式传输日志)或要将日志流式传输到的命名空间(如果已有资源将该日志类别流式传输到此命名空间)。The namespace where the event hub is created (if this is your first time streaming logs) or streamed to (if there are already resources that are streaming that log category to this namespace).
    事件中心名称Event hub name (可选)在设置中指定要将所有数据发送到的事件中心名称。Optionally specify an event hub name to send all data in the setting. 如果未指定名称,将为每个日志类别创建一个事件中心。If you don't specify a name, an event hub is created for each log category. 如果发送多个类别,可能需要指定一个名称来限制创建的事件中心数。If you are sending multiple categories, you may want to specify a name to limit the number of event hubs created. 有关详细信息,请参阅 Azure 事件中心配额和限制See Azure Event Hubs quotas and limits for details.
    事件中心策略名称Event hub policy name 定义流式传输机制拥有的权限。Defines the permissions that the streaming mechanism has.

    添加诊断设置 - 现有的设置

  5. 选中要发送到指定目标的每个数据类别对应的框。Check the box for each of the categories of data to send to the specified destinations. 如果选择了“存档到存储帐户”选项,则还需要指定保留期If you selected the option to Archive to a storage account, then you will also need to specify the retention period.

Note

当前不支持通过诊断设置发送多维指标。Sending multi-dimensional metrics via diagnostic settings is not currently supported. 多维指标将按平展后的单维指标导出,并跨维值聚合。Metrics with dimensions are exported as flattened single dimensional metrics, aggregated across dimension values.

例如: 可以基于每个队列级别浏览和绘制事件中心上的“传入消息”指标。For example: The 'Incoming Messages' metric on an Event Hub can be explored and charted on a per queue level. 但是,当通过诊断设置导出时,该指标将表示为事件中心的所有队列中的所有传入消息。However, when exported via diagnostic settings the metric will be represented as all incoming messages across all queues in the Event Hub.

  1. 单击“保存” 。Click Save.

片刻之后,新设置会显示在此资源的设置列表中,生成新的事件数据后,日志会立即流式传输到指定的目标。After a few moments, the new setting appears in your list of settings for this resource, and logs are streamed to the specified destinations as new event data is generated. 请注意,发出事件后可能需要最多 15 分钟的时间该事件才会出现在 Log Analytics 工作区中Note that there may be up to fifteen minutes between when an event is emitted and when it appears in a Log Analytics workspace.

使用 PowerShell 创建诊断设置Create diagnostic settings using PowerShell

Azure PowerShell 中使用 Set-AzDiagnosticSetting cmdlet 创建诊断设置。Use the Set-AzDiagnosticSetting cmdlet to create a diagnostic setting with Azure PowerShell. 有关参数说明,请参阅此 cmdlet 的文档。See the documentation for this cmdlet for descriptions of its parameters.

以下示例 PowerShell cmdlet 使用所有三个目标创建诊断设置。Following is an example PowerShell cmdlet to create a diagnostic setting using all three destinations.

Set-AzDiagnosticSetting -Name KeyVault-Diagnostics -ResourceId /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault -Category AuditEvent -MetricCategory AllMetrics -Enabled $true -StorageAccountId /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount -RetentionEnabled $true -RetentionInDays 7 -WorkspaceId /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/oi-default-east-us/providers/microsoft.operationalinsights/workspaces/myworkspace  -EventHubAuthorizationRuleId /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourcegroup/providers/Microsoft.EventHub/namespaces/myeventhub/authorizationrules/RootManageSharedAccessKey

使用 Azure CLI 创建诊断设置Create diagnostic settings using Azure CLI

Azure CLI 中使用 az monitor diagnostic-settings create 命令创建诊断设置。Use the az monitor diagnostic-settings create command to create a diagnostic setting with Azure CLI. 有关参数说明,请参阅此命令的文档。See the documentation for this command for descriptions of its parameters.

以下示例 CLI 命令使用所有三个目标创建诊断设置。Following is an example CLI command to create a diagnostic setting using all three destinations.

az monitor diagnostic-settings create  \
--name KeyVault-Diagnostics \
--resource /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault \
--logs    '[{"category": "AuditEvent","enabled": true,"retentionPolicy": {"days": 7,"enabled": true}}]' \
--metrics '[{"category": "AllMetrics","enabled": true,"retentionPolicy": {"days": 7,"enabled": true}}]' \
--storage-account /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount \
--workspace /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/oi-default-east-china/providers/microsoft.operationalinsights/workspaces/myworkspace \
--event-hub-rule /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourcegroup/providers/Microsoft.EventHub/namespaces/myeventhub/authorizationrules/RootManageSharedAccessKey

使用 REST API 配置诊断设置Configure diagnostic settings using REST API

若要使用 Azure Monitor REST API 创建或更新诊断设置,请参阅诊断设置See Diagnostic Settings to create or update diagnostic settings using the Azure Monitor REST API.

使用资源管理器模板配置诊断设置Configure diagnostic settings using Resource Manager template

若要使用资源管理器模板创建或更新诊断设置,请参阅在创建资源时使用资源管理器模板自动启用诊断设置See Automatically enable Diagnostic Settings at resource creation using a Resource Manager template to create or update diagnostic settings with a Resource Manager template.

后续步骤Next steps