Azure Monitor Log Analytics 示例查询

Azure Monitor 资源日志是 Azure 服务发出的日志,用于描述这些服务或资源的操作。 日志导出到 Log Analytics 工作区后,会存储在表中。 本系列文章包含用于从 Log Analytics 表中检索数据的示例查询。 这些查询也可以在 Log Analytics 工作区中使用。

按表列出的示例查询

AACAudit

AACHttpRequest

AADCustomSecurityAttributeAuditLogs

AADDomainServicesAccountLogon

AADDomainServicesAccountManagement

AADDomainServicesDirectoryServiceAccess

AADDomainServicesLogonLogoff

AADDomainServicesPolicyChange

AADDomainServicesPrivilegeUse

AADManagedIdentitySignInLogs

AADNonInteractiveUserSignInLogs

AADProvisioningLogs

AADRiskyUsers

AADServicePrincipalRiskEvents

AADServicePrincipalSignInLogs

AADUserRiskEvents

ABSBotRequests

ACICollaborationAudit

ACRConnectedClientList

ACREntraAuthenticationAuditLog

ACSAdvancedMessagingOperations

ACSAuthIncomingOperations

ACSBillingUsage

ACSCallAutomationIncomingOperations

ACSCallAutomationMediaSummary

ACSCallClientMediaStatsTimeSeries

ACSCallClientOperations

ACSCallDiagnostics

ACSCallRecordingIncomingOperations

ACSCallRecordingSummary

ACSCallSummary

ACSCallSurvey

ACSChatIncomingOperations

ACSEmailSendMailOperational

ACSEmailStatusUpdateOperational

ACSJobRouterIncomingOperations

ACSRoomsIncomingOperations

ACSSMSIncomingOperations

ADAssessmentRecommendation

ADFActivityRun

ADFPipelineRun

ADFSSignInLogs

ADFTriggerRun

ADTDataHistoryOperation

ADTDigitalTwinsOperation

ADTEventRoutesOperation

ADTModelsOperation

ADTQueryOperation

ADXIngestionBatching

ADXTableUsageStatistics

AEWComputePipelinesLogs

AFSAuditLogs

AGCAccessLogs

AGSGrafanaLoginEvents

AHDSDicomAuditLogs

AHDSDicomDiagnosticLogs

AHDSMedTechDiagnosticLogs

AKSAudit

AKSAuditAdmin

AKSControlPlane

ALBHealthEvent

AMSKeyDeliveryRequests

AMSLiveEventOperations

AMSMediaAccountHealth

AMSStreamingEndpointRequests

AOIDatabaseQuery

AOIDigestion

AOIStorage

ASCDeviceEvents

ASRJobs

ASRReplicatedItems

ASimDnsActivityLogs

AVNMConnectivityConfigurationChange

AVNMIPAMPoolAllocationChange

AVNMNetworkGroupMembershipChange

AVNMRuleCollectionChange

AVSSyslog

AWSCloudTrail

AWSGuardDuty

AWSVPCFlow

AZFWApplicationRule

AZFWDnsQuery

AZFWFatFlow

AZFWFlowTrace

AZFWIdpsSignature

AZFWInternalFqdnResolutionFailure

AZFWNatRule

AZFWNetworkRule

AZFWThreatIntel

AZKVAuditLogs

AZMSDiagnosticErrorLogs

AZMSHybridConnectionsEvents

AZMSOperationalLogs

AZMSRunTimeAuditLogs

AZMSVnetConnectionEvents

AddonAzureBackupJobs

AddonAzureBackupStorage

AegDataPlaneRequests

AegDeliveryFailureLogs

AegPublishFailureLogs

AgriFoodApplicationAuditLogs

AgriFoodFarmManagementLogs

AgriFoodJobProcessedLogs

AlertEvidence

AlertInfo

AmlComputeClusterEvent

AmlComputeCpuGpuUtilization

AmlComputeJobEvent

AmlDataSetEvent

AmlEnvironmentEvent

AmlModelsEvent

AmlOnlineEndpointConsoleLog

AmlOnlineEndpointEventLog

AmlOnlineEndpointTrafficLog

AmlRegistryWriteEventsLog

异常

ApiManagementGatewayLogs

AppDependencies

AppEnvSpringAppConsoleLogs

AppExceptions

AppPageViews

AppPlatformLogsforSpring

AppPlatformSystemLogs

AppRequests

AppServiceAppLogs

AppServiceAuditLogs

AppServiceAuthenticationLogs

AppServiceConsoleLogs

AppServiceFileAuditLogs

AppServiceHTTPLogs

AutoscaleEvaluationsLog

AutoscaleScaleActionsLog

AzureActivity

AzureAttestationDiagnostics

AzureBackupOperations

AzureDiagnostics

AzureLoadTestingOperation

AzureMetrics

CCFApplicationLogs

CIEventsAudit

CIEventsOperational

CassandraLogs

ChaosStudioExperimentEventLogs

CloudAppEvents

CloudHsmServiceOperationAuditLogs

CommonSecurityLog

ConfidentialWatchlist

ConfigurationChange

ConfigurationData

ContainerAppConsoleLogs

ContainerImageInventory

ContainerInventory

ContainerLog

ContainerLogV2

ContainerNodeInventory

ContainerRegistryLoginEvents

ContainerRegistryRepositoryEvents

ContainerServiceLog

CoreAzureBackup

DCRLogErrors

DNSQueryLogs

DataTransferOperations

DatabricksWorkspaceLogs

DataverseActivity

DevCenterDiagnosticLogs

DevCenterResourceOperationLogs

DeviceCalendar

DeviceCleanup

DeviceHardwareHealth

DeviceHealth

DeviceSkypeHeartbeat

DeviceTvmSecureConfigurationAssessment

DeviceTvmSoftwareInventory

DeviceTvmSoftwareVulnerabilities

DnsEvents

EGNFailedHttpDataPlaneOperations

EGNFailedMqttConnections

EGNMqttDisconnections

EGNSuccessfulHttpDataPlaneOperations

EGNSuccessfulMqttConnections

EmailAttachmentInfo

EmailEvents

EmailPostDeliveryEvents

EmailUrlInfo

事件

FailedIngestion

FunctionAppLogs

GCPAuditLogs

Heartbeat

IdentityDirectoryEvents

IdentityLogonEvents

IdentityQueryEvents

InsightsMetrics

KubeEvents

KubeMonAgentEvents

KubeNodeInventory

KubePodInventory

KubeServices

LAQueryLogs

LASummaryLogs

LogicAppWorkflowRuntime

MDCDetectionDNSEvents

MDCDetectionFimEvents

MDCDetectionGatingValidationEvents

MNFDeviceUpdates

MNFSystemSessionHistoryUpdates

MNFSystemStateMessageUpdates

MicrosoftDataShareReceivedSnapshotLog

MicrosoftDataShareSentSnapshotLog

MicrosoftGraphActivityLogs

MicrosoftPurviewInformationProtection

NGXOperationLogs

NGXSecurityLogs

NWConnectionMonitorPathResult

NWConnectionMonitorTestResult

NetworkSessions

OEPAirFlowTask

OLPSupplyChainEntityOperations

OfficeActivity

性能

PowerAppsActivity

PowerAutomateActivity

PowerBIActivity

PowerPlatformAdminActivity

PowerPlatformConnectorActivity

PowerPlatformDlpActivity

ProjectActivity

ProtectionStatus

PurviewSecurityLogs

REDConnectionEvents

ResourceManagementPublicAccessLogs

SQLAssessmentRecommendation

SecurityAttackPathData

SecurityEvent

SentinelAudit

SignalRServiceDiagnosticLogs

SigninLogs

StorageBlobLogs

StorageCacheOperationEvents

StorageCacheUpgradeEvents

StorageCacheWarningEvents

StorageMalwareScanningResults

SucceededIngestion

SynapseLinkEvent

Syslog

TSIIngress

UCDOAggregatedStatus

UCDOStatus

更新

UpdateRunProgress

UpdateSummary

UrlClickEvents

使用情况

VCoreMongoRequests

VIAudit

VIIndexing

W3CIISLog

WVDAgentHealthStatus

WVDCheckpoints

WVDConnectionNetworkData

WVDConnections

WVDErrors

WaaSDeploymentStatus

WaaSUpdateStatus

Watchlist

WindowsEvent

WireData

WorkloadDiagnosticLogs

后续步骤