如何通过 ARM 模板将 Azure Activity Monitor 连接到 Log Analytics Workspace

Question

如何使用 ARM 模板将 Azure Activity Logs 连接到 Log Analytics 工作区？我可以通过门户连接它：

但我进行了广泛的搜索，但找不到有关如何使用 ARM 模板执行此操作（或者目前是否可行）的文档。

我也试过在 azure 资源管理器中创建连接并查看资源结构（并通过在 powershell 中获取资源），但是在建立连接之前和之后 json 没有区别

更新：

我尝试了一个基于 this documentation 的 arm 模板部署，我是这样应用的：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "resources": [
        {
            "name": "my-loganalytics-workspace-name/AzureActivityLog",
            "type": "Microsoft.OperationalInsights/workspaces/dataSources",
            "apiVersion": "2015-11-01-preview",
            "tags": {},
            "properties": {},
            "kind": "AzureActivityLog"
        }
    ]
}

但是部署没有完成（已经运行 30 分钟）并且有一个模糊的错误：

{
    "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxxxxxxx/resourceGroups/my-resource-group/providers/Microsoft.Resources/deployments/template/operations/A886A53AFF9B2E6C",
    "operationId": "A886A53AFF9B2E6C",
    "properties": {
        "provisioningOperation": "Create",
        "provisioningState": "Running",
        "timestamp": "2019-03-25T13:54:32.2320046Z",
        "duration": "PT21M58.8224235S",
        "trackingId": "47915902-f795-482a-a408-de408cd78a30",
        "serviceRequestId": "8c153090-c33d-4819-b9c4-8226df6a861e",
        "statusCode": "InternalServerError",
        "statusMessage": {
            "Message": "An error has occurred."
        },
        "targetResource": {
            "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxxxxxxx/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-log-analytics-workspace/dataSources/AzureActivityLog",
            "resourceType": "Microsoft.OperationalInsights/workspaces/dataSources",
            "resourceName": "my-log-analytics-workspace/AzureActivityLog"
        }
    }
}

Answer 1

是的，可以按照此处所述使用门户或 PowerShell ->

我使用门户或 PowerShell 创建了它，并且可以使用 PowerShell 获取这些详细信息，如下面的屏幕截图所示，其中 ResourceId 参数显示资源类型 'Microsoft.OperationalInsights/workspaces/dataSources'。

所以很可能它也应该可以通过 ARM 模板方式实现，因为我看到了资源类型 'Microsoft.OperationalInsights/workspaces/dataSources' 的 ARM 模板参考，如此处所示 -> https://docs.microsoft.com/en-us/azure/templates/microsoft.operationalinsights/2015-11-01-preview/workspaces/datasources

希望对您有所帮助！！干杯！！

Answer 2

我找到了一个工作示例模板 here。

所以我的原始模板需要一个不同的名称（必须包含 subscriptionId）和一个 linkedResourceId 在 properties:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "resources": [
        {
            "name": "[concat('my-loganalytics-workspace-name', '/', subscription().subscriptionId)]",
            "type": "Microsoft.OperationalInsights/workspaces/dataSources",
            "apiVersion": "2015-11-01-preview",
            "tags": {},
            "properties": {
                "linkedResourceId": "[concat(subscription().Id, '/providers/microsoft.insights/eventTypes/management')]"
            },
            "kind": "AzureActivityLog"
        }
    ]
}

如何通过 ARM 模板将 Azure Activity Monitor 连接到 Log Analytics Workspace

How to connect Azure Activity Monitor to Log Analytics Workspace via ARM template

azure

arm-template

azure-log-analytics

activity-monitor