Azure Key Vault 日志记录Azure Key Vault logging

• 11/27/2020
• • m
  • a
  • v

在创建一个或多个 Key Vault 之后，可能需要监视 Key Vault 的访问方式、时间和访问者。After you create one or more key vaults, you'll likely want to monitor how and when your key vaults are accessed, and by whom. 为此，可以启用 Azure Key Vault 日志记录，以便在提供的 Azure 存储帐户中保存信息。You can do this by enabling logging for Azure Key Vault, which saves information in an Azure storage account that you provide. 有关设置此操作的分步指南，请参阅如何启用 Key Vault 日志记录。For step by step guidance on setting this up, see How to enable Key Vault logging.

最多在执行 Key Vault 操作 10 分钟后，就能访问其日志记录信息。You can access your logging information 10 minutes (at most) after the key vault operation. 但大多数情况下不用等待这么长时间。In most cases, it will be quicker than this. 存储帐户中的日志完全由你管理：It's up to you to manage your logs in your storage account:

• 请使用标准的 Azure 访问控制方法限制可访问日志的人员，以此保护日志。Use standard Azure access control methods to secure your logs by restricting who can access them.
• 删除不想继续保留在存储帐户中的日志。Delete logs that you no longer want to keep in your storage account.

有关 Key Vault的概述信息，请参阅什么是 Azure Key Vault？。For overview information about Key Vault, see What is Azure Key Vault?. 有关 Key Vault 可用位置的信息，请参阅定价页。For information about where Key Vault is available, see the pricing page. 有关将 Azure Monitor 用于 Key Vault 的信息。For information about using Azure Monitor for Key Vault.

解释 Key Vault 日志Interpret your Key Vault logs

启用日志记录时，系统会为你指定的存储帐户自动创建一个名为“insights-logs-auditevent”的新容器。When you enable logging, a new container called insights-logs-auditevent is automatically created for your specified storage account. 可以使用此同一个存储帐户来收集多个 Key Vault 的日志。You can use this same storage account for collecting logs for multiple key vaults.

每个 Blob 存储为文本，并格式化为 JSON Blob。Individual blobs are stored as text, formatted as a JSON blob. 让我们看一个示例日志项。Let's look at an example log entry.

    {
        "records":
        [
            {
                "time": "2016-01-05T01:32:01.2691226Z",
                "resourceId": "/SUBSCRIPTIONS/361DA5D4-A47A-4C79-AFDD-XXXXXXXXXXXX/RESOURCEGROUPS/CONTOSOGROUP/PROVIDERS/MICROSOFT.KEYVAULT/VAULTS/CONTOSOKEYVAULT",
                "operationName": "VaultGet",
                "operationVersion": "2015-06-01",
                "category": "AuditEvent",
                "resultType": "Success",
                "resultSignature": "OK",
                "resultDescription": "",
                "durationMs": "78",
                "callerIpAddress": "104.40.82.76",
                "correlationId": "",
                "identity": {"claim":{"http://schemas.microsoft.com/identity/claims/objectidentifier":"d9da5048-2737-4770-bd64-XXXXXXXXXXXX","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn":"live.com#username@outlook.com","appid":"1950a258-227b-4e31-a9cf-XXXXXXXXXXXX"}},
                "properties": {"clientInfo":"azure-resource-manager/2.0","requestUri":"https://control-prod-wus.vaultcore.azure.cn/subscriptions/361da5d4-a47a-4c79-afdd-XXXXXXXXXXXX/resourcegroups/contosoresourcegroup/providers/Microsoft.KeyVault/vaults/contosokeyvault?api-version=2015-06-01","id":"https://contosokeyvault.vault.azure.cn/","httpStatusCode":200}
            }
        ]
    }

下表列出了字段的名称和描述：The following table lists the field names and descriptions:

operationName 字段值采用 ObjectVerb 格式。The operationName field values are in ObjectVerb format. 例如：For example:

• 所有 Key Vault 操作采用 Vault<action> 格式，例如 VaultGet 和 VaultCreate。All key vault operations have the Vault<action> format, such as VaultGet and VaultCreate.
• 所有密钥操作采用 Key<action> 格式，例如 KeySign 和 KeyList。All key operations have the Key<action> format, such as KeySign and KeyList.
• 所有机密操作采用 Secret<action> 格式，例如 SecretGet 和 SecretListVersions。All secret operations have the Secret<action> format, such as SecretGet and SecretListVersions.

下表列出了 operationName 值和对应的 REST API 命令：The following table lists the operationName values and corresponding REST API commands:

操作名称表Operation names table

使用 Azure Monitor 日志Use Azure Monitor logs

可以使用 Azure Monitor 日志中的 Key Vault 解决方案查看 Key Vault AuditEvent 日志。You can use the Key Vault solution in Azure Monitor logs to review Key Vault AuditEvent logs. 在 Azure Monitor 日志中，可以使用日志查询来分析数据并获取所需的信息。In Azure Monitor logs, you use log queries to analyze data and get the information you need.

有关详细信息，包括如何进行设置，请参阅 Azure Monitor 中的 Azure Key Vault。For more information, including how to set this up, see Azure Key Vault in Azure Monitor.

后续步骤Next steps

• 如何启用 Key Vault 日志记录How to enable Key Vault logging
• 有关在 .NET Web 应用程序中使用 Azure Key Vault 的教程，请参阅从 Web 应用程序使用 Azure Key Vault。For a tutorial that uses Azure Key Vault in a .NET web application, see Use Azure Key Vault from a web application.
• 有关编程参考，请参阅 Azure 密钥保管库开发人员指南。For programming references, see the Azure Key Vault developer's guide.
• 有关 Azure Key Vault 的 Azure PowerShell 1.0 cmdlet 列表，请参阅 Azure Key Vault cmdlet。For a list of Azure PowerShell 1.0 cmdlets for Azure Key Vault, see Azure Key Vault cmdlets.