Azure 活动日志收集和导出的更新Update to Azure Activity log collection and export

Azure 活动日志是一种方便用户深入了解 Azure 中发生的订阅级别事件的平台日志The Azure Activity log is a platform log that provides insight into subscription-level events that have occurred in Azure. 将活动日志条目发送到事件中心或存储帐户Log Analytics 工作区的方法已更改为使用诊断设置The method to send Activity log entries to an event hub or storage account or to a Log Analytics workspace has changed to use diagnostic settings. 本文介绍各方法之间的区别,以及如何在准备更改诊断设置时清除旧版设置。This article describes the difference between the methods and how to clear legacy settings in preparation to change to diagnostic settings.

各方法之间的区别Differences between methods

优点Advantages

与当前方法相比,使用诊断设置具有以下优势:Using diagnostic settings has the following advantages over the current methods:

  • 用于收集所有平台日志的一致方法。Consistent method for collecting all platform logs.
  • 跨多个订阅和租户收集活动日志。Collect Activity log across multiple subscriptions and tenants.
  • 筛选集合,以便仅收集特定类别的日志。Filter collection to only collect logs for particular categories.
  • 收集所有活动日志类别。Collect all Activity log categories. 部分类别不是使用旧版方法收集的。Some categories are not collected using legacy method.
  • 更短的日志引入延迟。Faster latency for log ingestion. 以前的方法的延迟大约为 15 分钟,而诊断设置仅会增加约 1 分钟的延迟。The previous method has about 15 minutes latency while diagnostic settings adds only about 1 minute.

注意事项Considerations

启用此功能之前,请考虑使用诊断设置的活动日志集合的以下详细信息。Consider the following details of Activity log collection using diagnostic settings before enabling this feature.

  • 已删除将活动日志收集到 Azure 存储的保留期设置,这意味着数据在删除之前将无限期存储。The retention setting for collecting the Activity log to Azure storage has been removed meaning that data will be stored indefinitely until you remove it.
  • 目前只能使用 Azure 门户创建订阅级别的诊断设置。Currently, you can only create a subscription level diagnostic setting using the Azure portal. 若要使用 PowerShell 或 CLI 等其他方法,可以创建资源管理器模板。To use other methods such as PowerShell or CLI, you can create a Resource Manager template.

数据区别Differences in data

诊断设置收集的数据与之前收集活动日志的方法所收集的数据相同,但目前存在以下差异:Diagnostic settings collect the same data as the previous methods used to collect the Activity log with the following current differences:

以下列已删除。The following columns have been removed. 这些列的替换项采用不同的格式,因此可能需要修改使用它们的日志查询。The replacement for these columns are in a different format, so you may need to modify log queries that use them. 可能仍会在架构中看到删除的列,但系统不会用数据填充它们。You may still see removed columns in the schema, but they won't be populated with data.

删除的列Removed column 替换列Replacement column
ActivityStatusActivityStatus ActivityStatusValueActivityStatusValue
ActivitySubstatusActivitySubstatus ActivitySubstatusValueActivitySubstatusValue
OperationNameOperationName OperationNameValueOperationNameValue
ResourceProviderResourceProvider ResourceProviderValueResourceProviderValue

已添加以下列:The following column have been added:

  • Authorization_dAuthorization_d
  • Claims_dClaims_d
  • Properties_dProperties_d

使用旧版设置Work with legacy settings

如果未选择使用诊断设置替换旧版设置,则旧版设置将继续收集活动日志。Legacy settings for collecting the Activity log will continue to work if you don't choose to replace with a diagnostic setting. 使用以下方法管理订阅的日志配置文件。Use the following method to manage the log profile for a subscription.

  1. 从 Azure 门户上的 Azure Monitor 菜单中,选择“活动日志” 。From the Azure Monitor menu in the Azure portal, select Activity log.

  2. 单击“诊断设置”。 Click Diagnostic settings.

    诊断设置

  3. 单击紫色横幅了解旧版体验。Click the purple banner for the legacy experience.

    旧版体验

有关使用旧版集合方法的详细信息,请参阅以下文章。See the following articles for details on using the legacy collection methods.

禁用现有设置Disable existing settings

应禁用活动的现有集合,然后才能使用诊断设置。You should disable existing collection of the Activity before enabling it using diagnostic settings. 同时启用两者可能会导致数据重复。Having both enabled may result in duplicate data.

禁用到 Log Analytics 工作区的集合Disable collection into Log Analytics workspace

  1. 打开 Azure 门户中的“Log Analytics 工作区”菜单,然后选择要收集活动日志的工作区 。Open the Log Analytics workspaces menu in the Azure portal and select the workspace to collect the Activity Log.
  2. 在工作区的菜单的“工作区数据源”部分,选择“Azure 活动日志”。 In the Workspace Data Sources section of the workspace's menu, select Azure Activity log.
  3. 单击要断开连接的订阅。Click the subscription you want to disconnect.
  4. 单击“断开连接”,然后在系统提示进行确认时单击“确定” 。Click Disconnect and then Yes when asked to confirm your choice.

禁用日志配置文件Disable log profile

  1. 按照使用旧版设置中所述流程打开旧版设置。Use the procedure described in Work with legacy settings to open legacy settings.
  2. 禁用所有当前到存储或事件中心的集合。Disable any current collection to storage or event hubs.

活动日志监视解决方案Activity Log monitoring solution

Azure Log Analytics 监视解决方案包含多个日志查询和视图,用于分析 Log Analytics 工作区中的活动日志记录。The Azure Log Analytics monitoring solution includes multiple log queries and views for analyzing the Activity Log records in your Log Analytics workspace. 如果使用诊断设置收集活动日志,则此解决方案会使用 Log Analytics 工作区中收集的日志数据,并在不进行任何更改的情况下继续生效。This solution uses log data collected in a Log Analytics workspace and will continue to work without any changes if you collect the Activity log using diagnostic settings. 有关此解决方案的详细信息,请参阅活动日志分析监视解决方案See Activity Logs Analytics monitoring solution for details on this solution.

后续步骤Next steps