如何发现谁在 Azure 门户中删除了群集How to discover who deleted a cluster in Azure portal

如果工作区中的某个群集消失或被删除,可通过在 Azure 门户中的 Log Analytics 工作区服务中运行查询来确定哪个用户删除了该群集。If a cluster in your workspace has disappeared or been deleted, you can identify which user deleted it by running a query in the Log Analytics workspaces service in the Azure portal.

备注

如果尚未设置分析工作区,则必须配置 Azure Databricks 中的诊断日志记录才能继续操作。If you do not have an analytics workspace set up, you must configure Diagnostic Logging in Azure Databricks before you continue.

  1. 在 Azure 门户中加载 Log Analytics 工作区服务。Load the Log Analytics workspaces service in the Azure portal.

  2. 单击工作区的名称。Click the name of your workspace.

  3. 单击“日志”。Click Logs.

  4. 查找以下文本:在此处键入查询或单击示例查询之一即可开始。Look for the following text: Type your query here or click one of the example queries to start.

    Azure Log Analytics 工作区Azure Log Analytics workspace

  5. 输入以下查询:Enter the following query:

    DatabricksClusters
    | where ActionName == "permanentDelete"
         and Response contains "\"statusCode\":200"
         and RequestParams contains "\"cluster_id\":\"0210-024915-bore731\""  // Add cluster_id filter if cluster id is known
         and TimeGenerated between(datetime("2020-01-25 00:00:00") .. datetime("2020-01-28 00:00:00"))  // Add timestamp (in UTC) filter to narrow down the result.
    | extend id = parse_json(Identity)
    | extend requestParams = parse_json(RequestParams)
    | project UserEmail=id.email,clusterId = requestParams.cluster_id, SourceIPAddress, EventTime=TimeGenerated
    
  6. 根据需要编辑 cluster_id。Edit the cluster_id as required.

  7. 编辑 datetime 值以在特定时间范围内进行筛选。Edit the datetime values to filter on a specific time range.

  8. 单击“运行”以执行查询。Click Run to execute the query.

结果(如果有)将显示在查询框下方。The results (if any) display below the query box.

查询结果

如果仍找不到删除群集的用户,请通过 Microsoft 支持部门创建一个支持案例。If you are still unable to find who deleted the cluster, create a support case with Microsoft Support. 提供工作区 ID 和事件的时间范围(包括时区)等详细信息。Provide details such as the workspace id and the time range of the event (including your time zone). Microsoft 支持部门将查看相应的后端活动日志。Microsoft Support will review the corresponding backend activity logs.