如何使用 ARM 模板为 Azure 资源创建 Activity 日志诊断设置

Question

我们指的是此文档 here，其中讨论了 使用资源管理器模板在 Azure 中创建诊断设置。

我们已经设法使用 ARM 模板配置资源以及资源日志的诊断设置，但是文档中用于启用 activity logs 诊断设置的片段似乎不起作用，因为模板部署命令（新- azresourcegroupdeployment) returns 错误请求错误。

New-AzResourceGroupDeployment : Resource Microsoft.Insights/diagnosticSettings 'test-vnet' failed with message '{ "Code": "BadRequest", "Message": "" }'

这是模板（修剪了一些代码以避免噪音）

{  
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
   ...
},
"variables": {
    ...
},
"resources": [
    {
        "apiVersion": "2018-08-01",
        "type": "Microsoft.Network/virtualNetworks",
        "name": "[parameters('virtualNetworkName')]",
        "location": "[parameters('resourceLocation')]",
        "properties": {
            "addressSpace": {
                "addressPrefixes": [
                    "[parameters('addressPrefix')]"
                ]
            },
            "subnets": "[parameters('subnets')]",
            "dhcpOptions": {
                "dnsServers": "[parameters('dnsServers')]"
            }
        },
        "resources":
        [
            {
                "type": "Microsoft.Insights/diagnosticSettings",
                "apiVersion": "2017-05-01-preview",
                "name": "[variables('diagnosticsSettingsName')]",
                "dependsOn": [
                    "[parameters('virtualNetworkName')]"
                ],
                "location": "global",
                "properties": 
                 {
                    "storageAccountId": "..valid_id_here",
                    "logs": 
                    [
                        {
                            "category": "Administrative",
                            "enabled": true
                        },
                        {
                            "category": "Security",
                            "enabled": true
                        },
                        {
                            "category": "ServiceHealth",
                            "enabled": true
                        },
                        {
                            "category": "ResourceHealth",
                            "enabled": true
                        }
                    ]
                }
            }
        ]
    }
],
"outputs": {
    ..
}

Answer 1

您所指的创建诊断设置的文档here。

因此，如果您查看本文档中的 Deployment Methods，它表示您可以使用任何有效方法（包括 PowerShell 和 CLI）部署资源管理器模板。 Activity 日志的诊断设置必须使用 az deployment create 用于 CLI 或 New-AzDeployment 用于 PowerShell.

部署到订阅

使用 New-AzDeployment 而不是 New-AzResourceGroupDeployment 来部署 ARM 模板。

希望对您有所帮助！！

Answer 2

此策略适用于我，请注意它是订阅级部署：

{
  "properties": {
    "displayName": "Deploy diagnostic setting profile for Subscription Activity Logs to Log Analytics workspace",
    "description": "Deploys the diagnostic settings for Subscription Activity Logs to stream to a regional Log Analytics workspace when any Subscription which is missing this diagnostic settings is created or updated.",
    "mode": "All",
    "metadata": {
      "version": "1.0.0",
      "category": "audit"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "DeployIfNotExists",
          "Disabled"
        ],
        "defaultValue": "DeployIfNotExists"
      },
      "settingsProfileName": {
        "type": "String",
        "metadata": {
          "displayName": "Settings profile name",
          "description": "The diagnostic settings profile name"
        },
        "defaultValue": "setbypolicy_logAnalytics"
      },
      "logAnalyticsResourceId": {
        "type": "String",
        "metadata": {
          "displayName": "Log Analytics resourceId",
          "description": "Set to full Log Analytics workspace resorceId. If this workspace is outside of the scope of the assignment you must manually grant 'Log Analytics Contributor' permissions (or similar) to the policy assignment's principal ID."
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.Resources/subscriptions"
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "name": "[parameters('settingsProfileName')]",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/workspaceId",
                "equals": "[parameters('logAnalyticsResourceId')]"
              }
            ]
          },
          "deploymentScope": "subscription",
          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/749f88d5-cbae-40b8-bcfc-e573ddc772fa",
            "/providers/microsoft.authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
          ],
          "deployment": {
            "location": "westeurope",
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "settingsProfileName": {
                    "type": "string"
                  },
                  "logAnalyticsResourceId": {
                    "type": "string"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.Insights/diagnosticSettings",
                    "apiVersion": "2017-05-01-preview",
                    "name": "[parameters('settingsProfileName')]",
                    "properties": {
                      "workspaceId": "[parameters('logAnalyticsResourceId')]",
                      "logs": [
                        {
                          "category": "Administrative",
                          "enabled": "true"
                        },
                        {
                          "category": "Alert",
                          "enabled": "true"
                        },
                        {
                          "category": "Autoscale",
                          "enabled": "true"
                        },
                        {
                          "category": "Policy",
                          "enabled": "true"
                        },
                        {
                          "category": "Recommendation",
                          "enabled": "true"
                        },
                        {
                          "category": "ResourceHealth",
                          "enabled": "true"
                        },
                        {
                          "category": "Security",
                          "enabled": "true"
                        },
                        {
                          "category": "ServiceHealth",
                          "enabled": "true"
                        }
                      ]
                    }
                  }
                ],
                "outputs": {}
              },
              "parameters": {
                "settingsProfileName": {
                  "value": "[parameters('settingsProfileName')]"
                },
                "logAnalyticsResourceId": {
                  "value": "[parameters('logAnalyticsResourceId')]"
                }
              }
            }
          }
        }
      }
    }
  }
}

如何使用 ARM 模板为 Azure 资源创建 Activity 日志诊断设置

How to create Activity logs diagnostic setting for Azure resources using ARM template

azure

azure-diagnostics

azure-virtual-network

azure-resource-manager

arm-template