设置 Azure 事件中心的诊断日志Set up diagnostic logs for an Azure event hub

可以查看两种类型的 Azure 事件中心日志:You can view two types of logs for Azure Event Hubs:

  • 活动日志 :此类日志提供对作业执行的操作的相关信息。Activity logs: These logs have information about operations done on a job. 这些日志始终启用。The logs are always enabled. 要查看活动日志条目,可以在 Azure 门户的事件中心命名空间的左窗格中选择“活动日志”。You can see activity log entries by selecting Activity log in the left pane for your event hub namespace in the Azure portal. 例如:“创建或更新命名空间”、“创建或更新事件中心”。For example: "Create or Update Namespace", "Create or Update Event Hub".

    事件中心命名空间的活动日志

  • 诊断日志 :通过使用 API 或语言 SDK 上的管理客户端,诊断日志可提供有关对命名空间所执行操作的更丰富的信息。Diagnostic logs: Diagnostic logs provide richer information about operations and actions that are conducted against your namespace by using the API, or through management clients on the language SDK.

    下面的部分演示如何对事件中心命名空间启用诊断日志。The following section shows you how to enable diagnostic logs for an Event Hubs namespace.

启用诊断日志Enable diagnostic logs

诊断日志默认已禁用。Diagnostic logs are disabled by default. 若要启用诊断日志,请执行以下步骤:To enable diagnostic logs, follow these steps:

  1. Azure 门户中,导航到你的事件中心命名空间。In the Azure portal, navigate to your Event Hubs namespace.

  2. 在左窗格中,选择“监视”下的“诊断设置”,然后选择“+ 添加诊断设置” 。Select Diagnostics settings under Monitoring in the left pane, and then select + Add diagnostic setting.

    诊断设置页面 - 添加诊断设置

  3. 在“类别详细信息”部分中,选择要启用的诊断日志类型 。In the Category details section, select the types of diagnostic logs that you want to enable. 本文的稍后部分将介绍有关这些类别的详细信息。You'll find details about these categories later in this article.

  4. 在“目标位置详细信息”部分中,设置所需的存档目标(目标位置);例如,存储帐户、事件中心或 Log Analytics 工作区。In the Destination details section, set the archive target (destination) that you want; for example, a storage account, an event hub, or a Log Analytics workspace.

    “添加诊断设置”页面

  5. 选择工具栏上的“保存”以保存诊断设置。Select Save on the toolbar to save the diagnostics settings.

    新设置在大约 10 分钟后生效。New settings take effect in about 10 minutes. 在此之后,日志将出现在“诊断日志”窗格上配置的存档目标中。After that, logs appear in the configured archival target, in the Diagnostics logs pane.

    有关配置诊断的详细信息,请参阅 Azure 诊断日志概述For more information about configuring diagnostics, see the overview of Azure diagnostic logs.

诊断日志类别Diagnostic logs categories

事件中心会捕获以下类别的诊断日志:Event Hubs captures diagnostic logs for the following categories:

类别Category 说明Description
存档日志Archive Logs 捕获有关事件中心捕获操作的信息,特别是与捕获错误相关的日志。Captures information about Event Hubs Capture operations, specifically, logs related to capture errors.
操作日志Operational Logs 捕获在 Azure 事件中心命名空间中执行的所有管理操作。Capture all management operations that are performed on the Azure Event Hubs namespace. 由于在 Azure 事件中心进行的数据操作量较大,因此不会捕获数据操作。Data operations are not captured, because of the high volume of data operations that are conducted on Azure Event Hubs.
自动缩放日志Auto scale logs 捕获在事件中心命名空间中执行的自动膨胀操作。Captures auto-inflate operations done on an Event Hubs namespace.
Kafka 协调器日志Kafka coordinator logs 捕获与事件中心相关的 Kafka 协调器操作。Captures Kafka coordinator operations related to Event Hubs.
Kafka 用户错误日志Kafka user error logs 捕获事件中心中调用的 Kafka API 的相关信息。Captures information about Kafka APIs called on Event Hubs.
事件中心虚拟网络 (VNet) 连接事件Event Hubs virtual network (VNet) connection event 捕获向事件中心发送流量的 IP 地址和虚拟网络的相关信息。Captures information about IP addresses and virtual networks sending traffic to Event Hubs.
客户管理的密钥用户日志Customer-managed key user logs 捕获与客户管理的密钥相关的操作。Captures operations related to customer-managed key.

所有日志均以 JavaScript 对象表示法 (JSON) 格式存储。All logs are stored in JavaScript Object Notation (JSON) format. 每个条目均包含字符串字段,这些字段采用以下部分所述的格式。Each entry has string fields that use the format described in the following sections.

存档日志架构Archive logs schema

存档日志 JSON 字符串包括下表列出的元素:Archive log JSON strings include elements listed in the following table:

名称Name 说明Description
TaskNameTaskName 描述失败的任务Description of the task that failed
ActivityIdActivityId 用于跟踪的内部 IDInternal ID, used for tracking
trackingIdtrackingId 用于跟踪的内部 IDInternal ID, used for tracking
resourceIdresourceId Azure 资源管理器资源 IDAzure Resource Manager resource ID
eventHubeventHub 事件中心的完整名称(包括命名空间名称)Event hub full name (includes namespace name)
partitionIdpartitionId 要写入到的事件中心分区Event Hub partition being written to
archiveSteparchiveStep 可能值:ArchiveFlushWriter、DestinationInitpossible values: ArchiveFlushWriter, DestinationInit
startTimestartTime 失败开始时间Failure start time
失败failures 发生失败的次数Number of times the failure occurred
durationInSecondsdurationInSeconds 失败持续时间Duration of failure
messagemessage 错误消息Error message
categorycategory ArchiveLogsArchiveLogs

以下代码是存档日志 JSON 字符串的示例:The following code is an example of an archive log JSON string:

{
   "TaskName": "EventHubArchiveUserError",
   "ActivityId": "000000000-0000-0000-0000-0000000000000",
   "trackingId": "0000000-0000-0000-0000-00000000000000000",
   "resourceId": "/SUBSCRIPTIONS/000000000-0000-0000-0000-0000000000000/RESOURCEGROUPS/<Resource Group Name>/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/<Event Hubs Namespace Name>",
   "eventHub": "<Event Hub full name>",
   "partitionId": "1",
   "archiveStep": "ArchiveFlushWriter",
   "startTime": "9/22/2016 5:11:21 AM",
   "failures": 3,
   "durationInSeconds": 360,
   "message": "Microsoft.WindowsAzure.Storage.StorageException: The remote server returned an error: (404) Not Found. ---> System.Net.WebException: The remote server returned an error: (404) Not Found.\r\n   at Microsoft.WindowsAzure.Storage.Shared.Protocol.HttpResponseParsers.ProcessExpectedStatusCodeNoException[T](HttpStatusCode expectedStatusCode, HttpStatusCode actualStatusCode, T retVal, StorageCommandBase`1 cmd, Exception ex)\r\n   at Microsoft.WindowsAzure.Storage.Blob.CloudBlockBlob.<PutBlockImpl>b__3e(RESTCommand`1 cmd, HttpWebResponse resp, Exception ex, OperationContext ctx)\r\n   at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.EndGetResponse[T](IAsyncResult getResponseResult)\r\n   --- End of inner exception stack trace ---\r\n   at Microsoft.WindowsAzure.Storage.Core.Util.StorageAsyncResult`1.End()\r\n   at Microsoft.WindowsAzure.Storage.Core.Util.AsyncExtensions.<>c__DisplayClass4.<CreateCallbackVoid>b__3(IAsyncResult ar)\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.",
   "category": "ArchiveLogs"
}

操作日志架构Operational logs schema

运行日志 JSON 字符串包括下表列出的元素:Operational log JSON strings include elements listed in the following table:

名称Name 说明Description
ActivityIdActivityId 内部 ID,用于跟踪目的Internal ID, used for tracking purposes
EventNameEventName 操作名称Operation name
resourceIdresourceId Azure 资源管理器资源 IDAzure Resource Manager resource ID
SubscriptionIdSubscriptionId 订阅 IDSubscription ID
EventTimeStringEventTimeString 操作时间Operation time
EventPropertiesEventProperties 操作属性Operation properties
状态Status 操作状态Operation status
调用方Caller 操作的调用方(Azure 门户或管理客户端)Caller of operation (Azure portal or management client)
类别Category OperationalLogsOperationalLogs

以下代码是运行日志 JSON 字符串的示例:The following code is an example of an operational log JSON string:

Example:
{
   "ActivityId": "00000000-0000-0000-0000-00000000000000",
   "EventName": "Create EventHub",
   "resourceId": "/SUBSCRIPTIONS/00000000-0000-0000-0000-0000000000000/RESOURCEGROUPS/<Resource Group Name>/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/<Event Hubs namespace name>",
   "SubscriptionId": "000000000-0000-0000-0000-000000000000",
   "EventTimeString": "9/28/2016 8:40:06 PM +00:00",
   "EventProperties": "{\"SubscriptionId\":\"0000000000-0000-0000-0000-000000000000\",\"Namespace\":\"<Namespace Name>\",\"Via\":\"https://<Namespace Name>.servicebus.chinacloudapi.cn/f8096791adb448579ee83d30e006a13e/?api-version=2016-07\",\"TrackingId\":\"5ee74c9e-72b5-4e98-97c4-08a62e56e221_G1\"}",
   "Status": "Succeeded",
   "Caller": "ServiceBus Client",
   "category": "OperationalLogs"
}

自动缩放日志架构Autoscale logs schema

自动缩放日志 JSON 包括下表列出的元素:Autoscale log JSON includes elements listed in the following table:

名称Name 说明Description
TrackingIdTrackingId 内部 ID,用于跟踪目的Internal ID, which is used for tracing purposes
ResourceIdResourceId Azure 资源管理器资源 ID。Azure Resource Manager resource ID.
消息Message 信息性消息,提供有关自动膨胀操作的详细信息。Informational message, which provides details about auto-inflate action. 此消息包含给定命名空间的吞吐量单位的以前值和当前值,以及触发了 TU 膨胀的因素。The message contains previous and current value of throughput unit for a given namespace and what triggered the inflate of the TU.

下面是一个示例自动缩放事件:Here's an example autoscale event:

{
    "TrackingId": "fb1b3676-bb2d-4b17-85b7-be1c7aa1967e",
    "Message": "Scaled-up EventHub TUs (UpdateStartTimeUTC: 5/13/2020 7:48:36 AM, PreviousValue: 1, UpdatedThroughputUnitValue: 2, AutoScaleReason: 'IncomingMessagesPerSecond reached 2170')",
    "ResourceId": "/subscriptions/0000000-0000-0000-0000-000000000000/resourcegroups/testrg/providers/microsoft.eventhub/namespaces/namespace-name"
}

Kafka 协调器日志架构Kafka coordinator logs schema

Kafka 协调器日志 JSON 包括下表列出的元素:Kafka coordinator log JSON includes elements listed in the following table:

名称Name 说明Description
RequestIdRequestId 请求 ID,用于跟踪目的Request ID, which is used for tracing purposes
ResourceIdResourceId Azure 资源管理器资源 IDAzure Resource Manager resource ID
OperationOperation 组协调期间执行的操作的名称Name of the operation that's done during the group coordination
ClientIdClientId 客户端 IDClient ID
NamespaceNameNamespaceName 命名空间名称Namespace name
SubscriptionIdSubscriptionId Azure 订阅 IDAzure subscription ID
消息Message 信息性或警告消息,提供有关组协调期间执行的操作的详细信息。Informational or warning message, which provides details about actions done during the group coordination.

示例Example

{
    "RequestId": "FE01001A89E30B020000000304620E2A_KafkaExampleConsumer#0",
    "Operation": "Join.Start",
    "ClientId": "KafkaExampleConsumer#0",
    "Message": "Start join group for new member namespace-name:c:$default:I:KafkaExampleConsumer#0-cc40856f7f3c4607915a571efe994e82, current group size: 0, API version: 2, session timeout: 10000ms, rebalance timeout: 300000ms.",
    "SubscriptionId": "0000000-0000-0000-0000-000000000000",
    "NamespaceName": "namespace-name",
    "ResourceId": "/subscriptions/0000000-0000-0000-0000-000000000000/resourcegroups/testrg/providers/microsoft.eventhub/namespaces/namespace-name",
    "Category": "KafkaCoordinatorLogs"
}

Kafka 用户错误日志架构Kafka user error logs schema

Kafka 用户错误日志 JSON 包括下表列出的元素:Kafka user error log JSON includes elements listed in the following table:

名称Name 说明Description
TrackingIdTrackingId 跟踪 ID,用于跟踪目的。Tracking ID, which is used for tracing purposes.
NamespaceNameNamespaceName 命名空间名称Namespace name
EventhubEventhub 事件中心名称Event hub name
PartitionIdPartitionId Partition IDPartition ID
GroupIdGroupId 组 IDGroup ID
ClientIdClientId 客户端 IDClient ID
ResourceIdResourceId Azure 资源管理器资源 ID。Azure Resource Manager resource ID.
消息Message 信息性消息,提供有关错误的详细信息Informational message, which provides details about an error

事件中心虚拟网络连接事件架构Event Hubs virtual network connection event schema

事件中心虚拟网络 (VNet) 连接事件 JSON 包含下表列出的元素:Event Hubs virtual network (VNet) connection event JSON includes elements listed in the following table:

名称Name 说明Description
SubscriptionIdSubscriptionId Azure 订阅 IDAzure subscription ID
NamespaceNameNamespaceName 命名空间名称Namespace name
IPAddressIPAddress 连接到事件中心服务的客户端的 IP 地址IP address of a client connecting to the Event Hubs service
操作Action 评估连接请求时事件中心服务执行的操作。Action done by the Event Hubs service when evaluating connection requests. 支持的操作为“接受连接”和“拒绝连接” 。Supported actions are Accept Connection and Deny Connection.
原因Reason 提供执行操作的原因Provides a reason why the action was done
CountCount 给定操作的发生次数Number of occurrences for the given action
ResourceIdResourceId Azure 资源管理器资源 ID。Azure Resource Manager resource ID.

示例Example

{
    "SubscriptionId": "0000000-0000-0000-0000-000000000000",
    "NamespaceName": "namespace-name",
    "IPAddress": "1.2.3.4",
    "Action": "Deny Connection",
    "Reason": "IPAddress doesn't belong to a subnet with Service Endpoint enabled.",
    "Count": "65",
    "ResourceId": "/subscriptions/0000000-0000-0000-0000-000000000000/resourcegroups/testrg/providers/microsoft.eventhub/namespaces/namespace-name",
    "Category": "EventHubVNetConnectionEvent"
}

客户管理的密钥用户日志Customer-managed key user logs

客户管理的密钥用户日志 JSON 包括下表列出的元素:Customer-managed key user log JSON includes elements listed in the following table:

名称Name 说明Description
类别Category 消息类别的类型。Type of category for a message. 以下值之一:“错误”和“信息” It's one of the following values: error and info
ResourceIdResourceId 内部资源 ID,包括 Azure 订阅 ID 和命名空间名称Internal resource ID, which includes Azure subscription ID and namespace name
KeyVaultKeyVault Key Vault 资源的名称Name of the Key Vault resource
密钥Key Key Vault 密钥的名称。Name of the Key Vault key.
版本Version Key Vault 密钥的版本Version of the Key Vault key
OperationOperation 对服务器请求执行的操作的名称The name of an operation done to serve requests
代码Code 状态代码Status code
消息Message 消息,提供有关错误或信息性消息的详细信息Message, which provides details about an error or informational message

后续步骤Next steps