使用 PowerShell 为 Azure 存储帐户启用诊断设置

Question

我正在尝试编写 PowerShell 脚本以启用 Azure 存储帐户的诊断设置并将日志发送到日志分析。对于每个存储帐户，您可以为存储帐户本身、blob、队列、表和文件启用诊断。我需要为所有 5 个启用它并配置日志读取、写入和删除，然后将这些日志发送到日志分析工作区。

这是我要启用的设置的快速屏幕截图。

我找到了几个关于如何使用 set-azdiagnosticsetting 启用诊断的示例，但它们似乎不起作用。

Set-AzDiagnosticSetting -ResourceId "Resource01" -Enabled $True

Set-AzDiagnosticSetting：异常类型：ErrorResponseException，消息：Null/Empty，代码：Null，状态代码：Forbidden，原因短语：Forbidden

接下来尝试了一组不同的脚本，创建指标，然后应用设置。这个例子也是从下面的参考链接中获得的。

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $ResourceId -WorkspaceId $WorkspaceId -Setting $metrics
Set-AzDiagnosticSetting -InputObject $setting

我找到的唯一参考是： https://docs.microsoft.com/en-us/powershell/module/az.monitor/set-azdiagnosticsetting?view=azps-6.0.0

https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=PowerShell

有没有人有更好的参考资料或这样做的经验？？

Answer 1

存储帐户和每个存储（blob、文件、队列、表）具有不同的资源ID，因此您需要使用循环为它们设置DiagnosticsSettings，只需使用下面的脚本，替换您的值即可在我这边工作正常。

$ResourceId = "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Storage/storageAccounts/joystoragev2"
$WorkspaceId = "/subscriptions/xxx/resourcegroups/xxx/providers/microsoft.operationalinsights/workspaces/joyana"
$DiagnosticSettingName = "testdia123"

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $ResourceId -WorkspaceId $WorkspaceId -Setting $metric
Set-AzDiagnosticSetting -InputObject $setting

$metric = New-AzDiagnosticDetailSetting -Metric -RetentionEnabled -Category AllMetrics -Enabled
$readlog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageRead -Enabled
$writelog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageWrite -Enabled
$deletelog = New-AzDiagnosticDetailSetting -Log -RetentionEnabled -Category StorageDelete -Enabled
$Ids = @($ResourceId + "/blobServices/default"
        $ResourceId + "/fileServices/default"
        $ResourceId + "/queueServices/default"
        $ResourceId + "/tableServices/default"
)
$Ids | ForEach-Object {
    $setting = New-AzDiagnosticSetting -Name $DiagnosticSettingName -ResourceId $_ -WorkspaceId $WorkspaceId -Setting $metric,$readlog,$writelog,$deletelog
    Set-AzDiagnosticSetting -InputObject $setting
}