针对来自 VPN 网关的资源日志事件设置警报Set up alerts on resource log events from VPN Gateway

本文介绍如何使用 Azure Monitor Log Analytics 基于来自 Azure VPN 网关的资源日志事件设置警报。This article helps you set up alerts based on resource log events from Azure VPN Gateway using Azure Monitor Log Analytics.

Azure 中提供以下资源日志:The following resource logs are available in Azure:

名称Name 说明Description
GatewayDiagnosticLogGatewayDiagnosticLog 包含网关配置事件、主要更改和维护事件的资源日志Contains resource logs for gateway configuration events, primary changes and maintenance events
TunnelDiagnosticLogTunnelDiagnosticLog 包含隧道状态更改事件。Contains tunnel state change events. 在适用的情况下,隧道连接/断开连接事件将汇总有关状态更改的原因Tunnel connect/disconnect events have a summarized reason for the state change if applicable
RouteDiagnosticLogRouteDiagnosticLog 记录网关上的静态路由和 BGP 事件发生的更改Logs changes to static routes and BGP events that occur on the gateway
IKEDiagnosticLogIKEDiagnosticLog 记录网关上的 IKE 控制消息和事件Logs IKE control messages and events on the gateway
P2SDiagnosticLogP2SDiagnosticLog 记录网关上的点到站点控制消息和事件。Logs point-to-site control messages and events on the gateway. 仅为 IKEv2 连接提供连接源信息Connection source info is provided for IKEv2 connections only

在 Azure 门户中设置警报Set up alerts in the Azure portal

以下示例步骤针对涉及站点到站点 VPN 隧道的断开连接事件创建警报:The following example steps creates an alert for a disconnection event that involves a site-to-site VPN tunnel:

  1. 在 Azure 门户中的“所有服务”下搜索 Log Analytics,然后选择“Log Analytics 工作区”。********In the Azure portal, search for Log Analytics under All services and select Log Analytics workspaces.

    用于转到 Log Analytics 工作区的选项Selections for going to Log Analytics workspaces

  2. 在“Log Analytics”页上选择“创建”。********Select Create on the Log Analytics page.

    包含“创建”按钮的 Log Analytics 页面Log Analytics page with Create button

  3. 选择“新建”并填写详细信息。****Select Create New and fill in the details.

    有关创建 Log Analytics 工作区的详细信息Details for creating a Log Analytics workspace

  4. 在“监视” > “诊断设置”边栏选项卡上找到你的 VPN 网关。 Find your VPN gateway on the Monitor > Diagnostics settings blade.

    用于在“诊断设置”中查找 VPN 网关的选项Selections for finding the VPN gateway in Diagnostic settings

  5. 若要启用诊断,请双击该网关,然后选择“启用诊断”。****To turn on diagnostics, double-click the gateway and then select Turn on diagnostics.

    用于启用诊断的选项Selections for turning on diagnostics

  6. 填写详细信息,并确保选中“发送到 Log Analytics”和“TunnelDiagnosticLog”。********Fill in the details, and ensure that Send to Log Analytics and TunnelDiagnosticLog are selected. 选择在步骤 3 中创建的 Log Analytics 工作区。Choose the Log Analytics Workspace that you created in step 3.

    选中的复选框Selected check boxes

    备注

    初次显示数据可能需要几个小时。It may take a few hours for the data to show up initially.

  7. 转到虚拟网络网关资源的概述,从“监视”选项卡中选择“警报”。 然后创建新的警报规则,或者编辑现有的警报规则。Go to the overview for the virtual network gateway resource and select Alerts from the Monitoring tab. Then create a new alert rule or edit an existing alert rule.

    用于新建警报规则的选项Selections for creating a new alert rule

    点到站点point-to-site

  8. 选择 Log Analytics 工作区和资源。Select the Log Analytics workspace and the resource.

    工作区和资源的选项Selections for workspace and resource

  9. 在“添加条件”下,选择“自定义日志搜索”作为信号逻辑。********Select Custom log search as the signal logic under Add condition.

    自定义日志搜索的选项Selections for a custom log search

  10. 在“搜索查询”文本框中输入以下查询。Enter the following query in the Search query text box. 根据需要替换 <> 和 TimeGenerated 中的值。Replace the values in <> and TimeGenerated as appropriate.

    AzureDiagnostics
    | where Category == "TunnelDiagnosticLog"
    | where _ResourceId == tolower("<RESOURCEID OF GATEWAY>")
    | where TimeGenerated > ago(5m) 
    | where remoteIP_s == "<REMOTE IP OF TUNNEL>"
    | where status_s == "Disconnected"
    | project TimeGenerated, OperationName, instance_s, Resource, ResourceGroup, _ResourceId 
    | sort by TimeGenerated asc
    

    将阈值设置为 0,然后选择“完成”。****Set the threshold value to 0 and select Done.

    输入查询并选择阈值Entering a query and selecting a threshold

  11. 在“创建规则”页上的“操作组”部分下,选择“新建”。************On the Create rule page, select Create New under the ACTION GROUPS section. 填写详细信息,然后选择“确定”。****Fill in the details and select OK.

    新操作组的详细信息Details for a new action group

  12. 在“创建规则”页上,填写“自定义操作”的详细信息,并确保“操作组名称”部分中显示的名称正确。************On the Create rule page, fill in the details for Customize Actions and make sure that the correct name appears in the ACTION GROUP NAME section. 选择“创建警报规则”以创建规则。****Select Create alert rule to create the rule.

    用于创建规则的选项Selections for creating a rule

使用 PowerShell 设置警报Set up alerts by using PowerShell

以下示例步骤针对涉及站点到站点 VPN 隧道的断开连接事件创建警报。The following example steps create an alert for a disconnection event that involves a site-to-site VPN tunnel.

  1. 创建 Log Analytics 工作区:Create a Log Analytics workspace:

    $Location           = 'chinaeast2'
    $ResourceGroupName  = 'TestRG1'
    $Sku                = 'pergb2018'
    $WorkspaceName      = 'LogAnalyticsWS123'
    
    New-AzOperationalInsightsWorkspace -Location $Location -Name $WorkspaceName -Sku $Sku -ResourceGroupName $ResourceGroupName
    
  2. 为 VPN 网关启用诊断:Turn on diagnostics for the VPN gateway:

    $ResourceGroupName  = 'TestRG1'
    $VpnGatewayName     = 'VNet1GW'
    $WorkspaceName      = 'LogAnalyticsWS123'
    
    $VpnGateway         = Get-AzVirtualNetworkGateway -Name $VpnGatewayName -ResourceGroupName $ResourceGroupName
    $Workspace          = Get-AzOperationalInsightsWorkspace -Name $WorkspaceName -ResourceGroupName $ResourceGroupName
    
    Set-AzDiagnosticSetting `
        -Name 'VPN tunnel' `
        -ResourceId $VpnGateway.Id `
        -WorkspaceId $Workspace.ResourceId `
        -Enabled $true `
        -Category 'TunnelDiagnosticLog'
    
  3. 创建操作组。Create an action group.

    此代码将创建一个在触发警报时发送电子邮件通知的操作组:This code creates an action group that sends an e-mail notification when an alert is triggered:

    $ActionGroupName            = 'EmailAdmins'   # Max. 60 characters long
    $ActionGroupShortName       = 'EmailAdmins'   # Max. 12 characters long
    $ActionGroupReceiverName    = 'My receiver Name'
    $EmailAddress               = 'xyz@contoso.com'
    $ResourceGroupName          = 'TestRG1'
    
    $ActionGroupReceiver = New-AzActionGroupReceiver -Name $ActionGroupReceiverName -UseCommonAlertSchema -EmailReceiver -EmailAddress $EmailAddress
    
    Set-AzActionGroup `
       -ResourceGroupName $ResourceGroupName `
       -Name $ActionGroupName `
       -ShortName $ActionGroupShortName `
       -Receiver @($ActionGroupReceiver)
    
  4. 基于自定义日志搜索创建警报规则:Create an alert rule based on a custom log search:

    $ActionGroupName    = 'EmailAdmins'
    $EmailSubject       = 'Redmond VPN tunnel is disconnected'
    $Location           = 'chinaeast2'
    $RemoteIp           = '104.42.209.46'
    $ResourceGroupName  = 'TestRG1'
    $VpnGatewayName     = 'VNet1GW'
    $WorkspaceName      = 'LogAnalyticsWS123'
    
    $VpnGateway         = Get-AzVirtualNetworkGateway -Name $VpnGatewayName -ResourceGroupName $ResourceGroupName
    $Workspace          = Get-AzOperationalInsightsWorkspace -Name $WorkspaceName -ResourceGroupName $ResourceGroupName
    
    $Query = @"
    AzureDiagnostics |
    where Category == "TunnelDiagnosticLog" |
    where TimeGenerated > ago(5m) |
    where _ResourceId == tolower("$($VpnGateway.id)") |
    where remoteIP_s == "$($RemoteIp)" |
    where status_s == "Disconnected" |
    project TimeGenerated, OperationName, instance_s, Resource, ResourceGroup, _ResourceId |
    sort by TimeGenerated asc
    "@
    
    $Source             = New-AzScheduledQueryRuleSource -Query $Query -DataSourceId $Workspace.ResourceId
    $Schedule           = New-AzScheduledQueryRuleSchedule -FrequencyInMinutes 5 -TimeWindowInMinutes 5
    $TriggerCondition   = New-AzScheduledQueryRuleTriggerCondition -ThresholdOperator 'GreaterThan' -Threshold 0
    
    $ActionGroup        = Get-AzActionGroup -ResourceGroupName $ResourceGroupName -Name $ActionGroupName
    $AznsActionGroup    = New-AzScheduledQueryRuleAznsActionGroup -ActionGroup $ActionGroup.Id -EmailSubject $EmailSubject
    $AlertingAction     = New-AzScheduledQueryRuleAlertingAction -AznsAction $AznsActionGroup -Severity '1' -Trigger $TriggerCondition
    
    New-AzScheduledQueryRule `
        -ResourceGroupName $ResourceGroupName `
        -Location $Location `
        -Action $AlertingAction `
        -Enabled $true `
        -Description 'The tunnel between Azure and Redmond with IP address 104.42.209.46 is disconnected' `
        -Schedule $Schedule `
        -Source $Source `
        -Name 'The Azure to Redmond tunnel is disconnected'
    

后续步骤Next steps

若要针对隧道指标配置警报,请参阅针对 VPN 网关指标设置警报To configure alerts on tunnel metrics, see Set up alerts on VPN Gateway metrics.