使用 PowerShell 为 Azure 存储帐户启用诊断设置

Question

我正在尝试编写一个 PowerShell 脚本来启用 Azure 存储帐户的诊断设置并将日志发送到日志分析。对于每个存储帐户，您可以为存储帐户本身、blob、队列、表和文件启用诊断。我需要为所有 5 个启用它并配置为记录读取、写入和删除，然后将这些日志发送到 Log Analytic 工作区。

这是我要启用的设置的快速屏幕截图。

我找到了几个关于如何使用 set-azdiagnosticsetting 启用诊断的示例，但它们似乎不起作用。

Set-AzDiagnosticSetting -ResourceId "Resource01" -Enabled $True

Set-AzDiagnosticSetting：异常类型：ErrorResponseException，消息：Null/Empty，代码：Null，状态代码：Forbidden，原因短语：Forbidden

接下来尝试了一组不同的脚本，创建指标，然后应用设置。这个例子也是从下面的参考链接中获得的。

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $ResourceId -WorkspaceId $WorkspaceId -Setting $metrics
Set-AzDiagnosticSetting -InputObject $setting

我找到的唯一参考是： https://docs.microsoft.com/en-us/powershell/module/az.monitor/set-azdiagnosticsetting?view=azps-6.0.0

https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=PowerShell

任何人有更好的参考或经验吗？？

Answer 1

storage account和每个storage(blob, file, queue, table)有不同的resource id，所以你需要使用循环来为它们设置DiagnosticSettings，只需使用下面的脚本，替换你的值，它在我这边工作得很好。

$ResourceId = "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Storage/storageAccounts/joystoragev2"
$WorkspaceId = "/subscriptions/xxx/resourcegroups/xxx/providers/microsoft.operationalinsights/workspaces/joyana"
$DiagnosticSettingName = "testdia123"

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $ResourceId -WorkspaceId $WorkspaceId -Setting $metric
Set-AzDiagnosticSetting -InputObject $setting

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$readlog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageRead -Enabled
$writelog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageWrite -Enabled
$deletelog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageDelete -Enabled
$Ids = @($ResourceId + "/blobServices/default"
        $ResourceId + "/fileServices/default"
        $ResourceId + "/queueServices/default"
        $ResourceId + "/tableServices/default"
)
$Ids | ForEach-Object {
    $setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $_ -WorkspaceId $WorkspaceId -Setting $metric,$readlog,$writelog,$deletelog
    Set-AzDiagnosticSetting -InputObject $setting
}