azure - azure 中的事件日志和审核日志之间的区别？

Question

我们正在为我们的 azure 资源设计诊断设置，我对这两个术语感到困惑。根据文档:

事件日志Azure Monitor 事件日志是 Azure 中的平台日志，可提供对订阅级别事件的深入了解。事件日志包括资源修改时间或虚拟机启动时间等信息。

审核日志 - 记录客户与数据或服务设置的交互的所有资源日志。

Answer 1

Azure 平台提供 different types of logging 。您有事件日志:

Provides insight into the operations on each Azure resource in the subscription from the outside (the management plane) in addition to updates on Service Health events. Use the Activity log to determine the what, who, and when for any write operations (PUT, POST, DELETE) taken on the resources in your subscription. There's a single activity log for each Azure subscription.

还有资源日志:

Provides insight into the operations on each Azure resource in the subscription from the outside (the management plane) in addition to updates on Service Health events. Use the Activity log to determine the what, who, and when for any write operations (PUT, POST, DELETE) taken on the resources in your subscription. There's a single activity log for each Azure subscription.

此外，还有 Azure AD 日志

Contain the history of sign-in activity and audit trail of changes made in Azure AD for a particular tenant.

事件日志、资源日志和 azure AD 日志类型的一部分是审核日志。某些资源具有资源日志的专用日志类别，指示从审核角度来看感兴趣的条目。有关完整列表，请参阅 the docs 。例如，Azure Data Lake Analytics 资源具有 specific "Audit" log category .

总而言之，您可以说事件日志和资源日志包含许多日志，其中一部分是审核日志。它们可用于审核谁在给定特定资源的情况下执行了哪些操作。