azure - 使用 PowerShell 启用 Azure 存储帐户的诊断设置

Question

我正在尝试编写一个 PowerShell 脚本来启用 Azure 存储帐户的诊断设置并将日志发送到日志分析。对于每个存储帐户，您可以为存储帐户本身、blob、队列、表和文件启用诊断。我需要为所有 5 个启用它并配置为记录读取、写入和删除，然后将这些日志发送到日志分析工作区。

这是我想要启用的设置的快速屏幕截图。

我找到了几个有关如何使用 set-azdiagnosticsetting 启用诊断的示例，但它们似乎不起作用。

Set-AzDiagnosticSetting -ResourceId "Resource01" -Enabled $True

Set-AzDiagnosticSetting:异常类型:ErrorResponseException，消息:空/空，代码:空，状态代码:禁止，原因短语:禁止

接下来尝试一组不同的脚本，创建指标，然后应用设置。这个例子也是从下面的引用链接中获得的。

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $ResourceId -WorkspaceId $WorkspaceId -Setting $metrics
Set-AzDiagnosticSetting -InputObject $setting

我找到的唯一引用是: https://learn.microsoft.com/en-us/powershell/module/az.monitor/set-azdiagnosticsetting?view=azps-6.0.0

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=PowerShell

任何人有更好的引用资料或经验吗？

Answer 1

存储帐户和每个存储(blob、文件、队列、表)具有不同的资源 id，因此您需要使用循环为它们设置 DiagnosticSettings，只需使用下面的脚本，替换您的值，它在我这边工作得很好。

$ResourceId = "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Storage/storageAccounts/joystoragev2"
$WorkspaceId = "/subscriptions/xxx/resourcegroups/xxx/providers/microsoft.operationalinsights/workspaces/joyana"
$DiagnosticSettingName = "testdia123"

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $ResourceId -WorkspaceId $WorkspaceId -Setting $metric
Set-AzDiagnosticSetting -InputObject $setting

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$readlog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageRead -Enabled
$writelog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageWrite -Enabled
$deletelog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageDelete -Enabled
$Ids = @($ResourceId + "/blobServices/default"
        $ResourceId + "/fileServices/default"
        $ResourceId + "/queueServices/default"
        $ResourceId + "/tableServices/default"
)
$Ids | ForEach-Object {
    $setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $_ -WorkspaceId $WorkspaceId -Setting $metric,$readlog,$writelog,$deletelog
    Set-AzDiagnosticSetting -InputObject $setting
}