VIAudit 表的查询

有关在 Azure 门户中使用这些查询的信息，请参阅 Log Analytics 教程。 有关 REST API，请参阅查询。

按帐户 ID 审核视频索引器

显示帐户 (AccountId = <Guid ID>) 的审核事件，并按用户 UPN 显示可选筛选器。

VIAudit
| where AccountId == "<AccountId>"  // please fill in the accountId <Guid>
// | where Upn == "<Upn>" // to to filter on a specific user upn, uncomment this line
| limit 100

视频索引器审核前 10 位用户（按操作）

按操作呈现前 10 个用户的时间表，其中包含用于筛选的可选帐户 ID。

// Trend of top 10 active Upn's
VIAudit
// | where AccountId == "<AccountId>"  // to filter on a specific accountId, uncomment this line
| where TimeGenerated > ago(30d)
| summarize count() by Upn
| top 10 by count_ desc
| project Upn
| join (VIAudit
| where TimeGenerated > ago(30d)
| summarize count() by Upn, bin(TimeGenerated,1d)) on Upn
| project TimeGenerated, Upn, count_
| render timechart

视频索引器审核分析的错误消息

显示审核失败事件，其中包含用于筛选的可选帐户 ID。

// Project failures with detailed error message.
VIAudit
// | where AccountId == "<AccountId>"  // to filter on a specific accountId, uncomment this line
| where  Status == "Failure"
| parse Description with "ErrorType: " ErrorType ". Message: " ErrorMessage ". Trace" *
| project TimeGenerated, OperationName, ErrorMessage, ErrorType, CorrelationId, _ResourceId

视频索引器审核失败的操作

显示所有失败操作尝试的审核日志，并按帐户 ID 和用户 UPN 进行筛选。

VIAudit
// | where AccountId == "<AccountId>"  // to filter on a specific accountId, uncomment this line
// | where Upn == "<Upn>" // to to filter on a specific user upn, uncomment this line
| where Status == "Failure"
| limit 100