受影响资源的 Azure Resource Graph 示例查询

本页收集了有关 Azure 服务健康状况受影响资源的 Azure Resource Graph 示例查询。

注释

每次查询后，通常会在 5 分钟内看到更新的结果。

概述

本页可帮助你通过 Azure Resource Graph 使用 Kusto 查询语言（KQL）监视和了解 Azure 服务和资源的运行状况。

它包括专门针对 Azure 服务运行状况的示例查询。

受影响的资源示例查询

已确认在计划内维护中受影响的资源

概述本文档介绍如何使用 Azure Resource Graph （ARG） 查询将计划内维护与Azure 服务运行状况数据相关联。 它们共同标识受影响的资源，确定维护状态，并指定是否需要执行任何操作。

查询 1 - 维护更新和受影响的资源

Purpose

此查询标识与特定 计划内维护通知 ID 关联的所有资源。

数据源

  • maintenanceresources（microsoft.maintenance/updates）
  • servicehealthresources（microsoft.resourcehealth/events/impactedresources）

输出

受影响资源的合并列表及其维护状态。

maintenanceresources
| where type == 'microsoft.maintenance/updates'
| extend p = parse_json(properties)
| mv-expand d = p.value
| where tostring(d.notificationId) == 'PYN_-ZL8'
| extend
    targetResourceId = tolower(name),
    plannedMaintenanceId = tostring(d.notificationId),
    status = tostring(d.status),
    resourceGroup = tostring(
        split(split(id, '/resourceGroups/')[1], '/')[0]
    ),
    resourceType = strcat(
        tostring(split(split(id, '/providers/')[1], '/')[0]),
        '/',
        tostring(split(split(id, '/providers/')[1], '/')[1])
    )
| project targetResourceId, subscriptionId, resourceGroup, resourceType, plannedMaintenanceId, status, source = 'Maintenance'
| union (
servicehealthresources
| where type =~ 'microsoft.resourcehealth/events/impactedresources'
| where id contains 'PYN_-ZL8'
| extend p = parse_json(properties)
| extend
    targetResourceId = tolower(tostring(p.targetResourceId)),
    status = tostring(p.status),
    resourceGroup = tostring(split(split(tostring(p.targetResourceId), '/resourceGroups/')[1], '/')[0]),
    resourceType = strcat(
        tostring(split(split(tostring(p.targetResourceId), '/providers/')[1], '/')[0]),
        '/',
        tostring(split(split(tostring(p.targetResourceId), '/providers/')[1], '/')[1])
    )
| project targetResourceId, subscriptionId, resourceGroup, resourceType, status
)
| project subscriptionId, targetResourceId, resourceGroup, resourceType, plannedMaintenanceId, status

查询 2 - 服务运行状况事件到资源解析

Purpose

从 服务运行状况事件开始，确定维护下的确切 主机、 VM 或 VMSS 实例 ，并确定 是否需要客户修正 （维护扩展）。

数据源

  • servicehealthresources（events 和 impactedresources）
  • maintenanceresources（microsoft.maintenance/updates）

输出

资源解析的视图，指示维护状态和所需的用户操作。

servicehealthresources
| where type =~ 'microsoft.resourcehealth/events'
| where name contains '1J14-8LG'
| project plannedMaintenanceID = tostring(properties.ExternalIncidentId)
| join kind=inner (
maintenanceresources
| where ['type'] == 'microsoft.maintenance/updates'
| extend prop = parse_json(properties)
| mv-expand Value = prop.value
| where tostring(Value.maintenanceScope) == 'Host'
| extend plannedMaintenanceID = tostring(Value.properties.plannedMaintenanceId)
| extend name = tolower(name)
| extend controlledMaintenanceEndTime = tostring(Value.endTimeUtc)
| extend status = tostring(Value.properties.plannedMaintenanceStatus)
| extend isVmssInstance = name has '/virtualmachinescalesets/'
| extend isHost = name has '/hostgroups/hosts/'
| extend vmssName = extract(@'/virtualmachinescalesets/([^/]+)/', 1, name)
| extend vmssInstance = extract(@'/virtualmachines/([^/]+)$', 1, name)
| extend vmName = extract(@'/virtualmachines/([^/]+)$', 1, name)
| extend hostName = extract(@'/hosts/([^/]+)$', 1, name)
| extend targetResourceName =
    iff(isHost, hostName,
        iff(isVmssInstance, strcat(vmssName, '_', vmssInstance), vmName))
| extend targetResourceType =
    iff(isVmssInstance,
        'microsoft.compute/virtualmachinescalesets/virtualmachines',
        iff(isHost,
            'microsoft.compute/hostgroups/hosts',
            'microsoft.compute/virtualmachines'))
| extend needsMaintenanceExtension =
    not(status in ('InProgress', 'RetryLater', 'NoUpdatesPending', 'Completed'))
| extend targetExtensionName =
    iff(needsMaintenanceExtension, 'Microsoft_Azure_Maintenance', '')
| extend targetBladeName =
    iff(needsMaintenanceExtension, 'PlannedMaintenance.ReactView', '')
| extend targetParameters =
    iff(needsMaintenanceExtension,
        strcat('{\"id\":\"', name, '\"}'),
        '')
) on plannedMaintenanceID
| project
    targetResourceId = name,
    targetResourceType,
    targetRegion = location,
    targetResourceGroup = resourceGroup,
    subscriptionId,
    plannedMaintenanceID,
    targetResourceName ,
    controlledMaintenanceEndTime,
    status,
    targetExtensionName =
        iff(
            status in ('InProgress','RetryLater','NoUpdatesPending','Completed'),
            '',
            'Microsoft_Azure_Maintenance'
        ),
    targetBladeName =
        iff(
            status in ('InProgress','RetryLater','NoUpdatesPending','Completed'),
            '',
            'PlannedMaintenance.ReactView'
        ),
    targetParameters =
        iff(
            status in ('InProgress','RetryLater','NoUpdatesPending','Completed'),
            '',
            targetParameters
        )
| union (
    servicehealthresources
    | where type =~ 'microsoft.resourcehealth/events/impactedresources'
    | where id contains '1J14-8LG'
    | extend p = parse_json(properties)
    | project  targetResourceId = tostring(p.targetResourceId),targetResourceType = tostring(p.targetResourceType), targetResourceName=tostring(p.resourceName),targetRegion=tostring(p.targetRegion), subscriptionId)
| project targetResourceId, targetResourceType, targetResourceName, targetRegion,subscriptionId,plannedMaintenanceID,status

其他事件类型中已确认受影响的资源

此查询查找并返回所有受服务问题（中断）和服务运行状况事件影响的所有受影响资源的列表，这些资源在访问的所有订阅中都会受到影响。

ServiceHealthResources
| where type == "microsoft.resourcehealth/events/impactedresources"
| extend TrackingId = split(split(id, "/events/", 1)[0], "/impactedResources", 0)[0]
| extend p = parse_json(properties)
| project subscriptionId, TrackingId, resourceName= p.resourceName, resourceGroup=p.resourceGroup, resourceType=p.targetResourceType, details = p, id

az graph query -q "ServiceHealthResources | where type == 'microsoft.resourcehealth/events/impactedresources' | extend TrackingId = split(split(id, '/events/', 1)[0], '/impactedResources', 0)[0] | extend p = parse_json(properties) | project subscriptionId, TrackingId, resourceName= p.resourceName, resourceGroup=p.resourceGroup, resourceType=p.targetResourceType, details = p, id"

确认受影响的资源，含更多详细信息

此查询会检索你可访问的所有订阅中，所有受 Service Health 问题（例如服务中断）影响的资源。 它还包括 resources 表中的额外信息。

servicehealthresources
| where type == "microsoft.resourcehealth/events/impactedresources"
| extend TrackingId = split(split(id, "/events/", 1)[0], "/impactedResources", 0)[0]
| extend p = parse_json(properties)
| project subscriptionId, TrackingId, targetResourceId= tostring(p.targetResourceId), details = p
| join kind=inner (
    resources
    )
    on $left.targetResourceId == $right.id

az graph query -q "ServiceHealthResources | where type == 'microsoft.resourcehealth/events/impactedresources' | extend TrackingId = split(split(id, '/events/', 1)[0], '/impactedResources', 0)[0] | extend p =  parse_json(properties) | project subscriptionId, TrackingId, targetResourceId = tostring(p.targetResourceId), details = p | join kind=inner (resources) on $left.targetResourceId == $right.id"

后续步骤

  • Last updated on