将 nsg 流日志传输到 azure 中不同订阅中的存储帐户时，powershell 出现 "Bad Request" 错误

Question

我在将 nsg 流日志传输到不同订阅中的存储帐户时收到“错误请求”错误。我的脚本在使用相同订阅的存储帐户时运行良好。

$workspaceResourceId = "/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxx/resourcegroups/rg-log-mgmt-prd-westeurope-01/providers/microsoft.operationalinsights/workspaces/nbsapucscoms"
$workspaceGUID = "xxxxxxxxxxxxxxxxxx"
$workspaceLocation = "westeurope"

$n = Get-AzureRmNetworkSecurityGroup -ResourceGroupName rg-8kmiles-dfi-westeurope-01 -Name apitst-nsg
$NwName = 'NetworkWatcher_' + $n.Location 
$NW = Get-AzureRmNetworkWatcher -ResourceGroupName NetworkWatcherRg -Name $NwName

#enter the storage account details. 
$storageAccount="/subscriptions/xxxxxxxxxxxxxxx/resourceGroups/rg-log-mgmt-prd-westeurope-01/providers/Microsoft.Storage/storageAccounts/nvsswelogmgmt001"

$flowLogStatus=Get-AzureRmNetworkWatcherFlowLogStatus -NetworkWatcher $NW -TargetResourceId $n.Id
if($false -eq $flowLogStatus.Enabled){

    #Configure Version 2 FLow Logs with Traffic Analytics Configured
    Set-AzureRmNetworkWatcherConfigFlowLog -NetworkWatcher $NW -TargetResourceId $n.Id `
        -StorageAccountId $storageAccount -EnableFlowLog $true -EnableTrafficAnalytics `
        -WorkspaceResourceId $workspaceResourceId -WorkspaceGUID $workspaceGUID `
        -WorkspaceLocation $workspaceLocation -EnableRetention $true -RetentionInDays 365 


    #Query Flow Log Status
    $flowLogStatus=Get-AzureRmNetworkWatcherFlowLogStatus -NetworkWatcher $NW -TargetResourceId $n.Id
    write-verbose "$($n.Name) Nsg Flow Log Enabled : $($flowLogStatus.Enabled)" -verbose
}

我得到的错误是这个

    Set-AzureRmNetworkWatcherConfigFlowLog : Operation returned an invalid status 
code 'BadRequest'
At C:\Users\singhniu\Desktop\Pipeline\TestNsgFlowLog.ps1:22 char:5
+     Set-AzureRmNetworkWatcherConfigFlowLog -NetworkWatcher $NW -Targe ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzureRmNetworkWatcherConfig 
   FlowLog], ErrorResponseException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Network.SetAzureNetwork 
   WatcherConfigFlowLogCommand

Answer 1

调试后我才知道我使用的是不支持保留的 V1 存储帐户。为了应用保留策略，我们需要将其升级到 V2。下面是调试后的输出。

    Body:
{
  "error": {
    "code": "UnsupportedStorageAccountVersionWithRetention",
    "message": "Storage /subscriptions/xxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/rg-lo
g-mgmt-prd-westeurope-01/providers/Microsoft.Storage/storageAccounts/nvss is a V1 st
orage account and with retention policy. Only V2 storage account are supported with retention po
licy. Read more -> aka.ms/LogsHelp",
    "details": []
  }
}

将 nsg 流日志传输到 azure 中不同订阅中的存储帐户时，powershell 出现 "Bad Request" 错误

getting "Bad Request" error in powershell while transferring the nsg flow log to the storage account in different subscription in azure

powershell

azure

azure-storage

azure-oms