![无法通过 ARM 模板、Powershell 或自动化帐户运行手册创建自定义活动日志警报规则](https://linux22.com/image/763156/%E6%97%A0%E6%B3%95%E9%80%9A%E8%BF%87%20ARM%20%E6%A8%A1%E6%9D%BF%E3%80%81Powershell%20%E6%88%96%E8%87%AA%E5%8A%A8%E5%8C%96%E5%B8%90%E6%88%B7%E8%BF%90%E8%A1%8C%E6%89%8B%E5%86%8C%E5%88%9B%E5%BB%BA%E8%87%AA%E5%AE%9A%E4%B9%89%E6%B4%BB%E5%8A%A8%E6%97%A5%E5%BF%97%E8%AD%A6%E6%8A%A5%E8%A7%84%E5%88%99.png)
我正在尝试创建一个自定义活动日志警报规则,但无论我尝试哪种方法,都会导致如下错误,或者 ARM 模板即使成功也不会创建指定的条件,也无法弄清楚我需要做什么:
PowerShell 代码:
$RG = "Lab"
$location = 'Global'
$alertName = "Test Storage Account Administrative Operations"
$scope = "/subscriptions/[subID]/[RG]/providers/Microsoft.Storage/storageAccounts/staccountname"
$condition1 = New-AzActivityLogAlertCondition -Field 'Category' -Equal 'Administrative'
$condition2 = New-AzActivityLogAlertCondition -Field 'operationName' -Equal 'Microsoft.Storage/storageAccounts/blobServices/containers/write'
$dict = New-Object "System.Collections.Generic.Dictionary``2[System.String,System.String]"
$dict.Add('key1', 'Value1')
$actionGrp1 = New-AzActionGroup -ActionGroupId $actiongroupid -WebhookProperty $dict
set-AzActivityLogAlert -Location $location -Name $alertname -ResourceGroupName $rg -Scope $scope -Action $actionGrp1 -Condition $condition1, $condition2
PowerShell 错误:
WARNING: 10:16:40 - *** The namespace for all the model classes will change from Microsoft.Azure.Management.Monitor.Management.Models to Microsoft.Azure.Management.Monitor.Models in future releases.
WARNING: 10:16:40 - *** The namespace for output classes will be uniform for all classes in future releases to make it independent of modifications in the model classes.
Set-AzActivityLogAlert:
Line |
12 | set-AzActivityLogAlert -Location $location -Name $alertname -Resource …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Exception type: ErrorResponseException, Message: Microsoft.Azure.Management.Monitor.Models.ErrorResponseException: Operation returned an invalid status code 'BadRequest'
at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperations.CreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert, Dictionary`2 customHeaders, CancellationToken cancellationToken)
at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.CreateOrUpdateAsync(IActivityLogAlertsOperations operations, String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert, CancellationToken cancellationToken)
at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.CreateOrUpdate(IActivityLogAlertsOperations operations, String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert)
at Microsoft.Azure.Commands.Insights.ActivityLogAlert.SetAzureRmActivityLogAlertCommand.ProcessRecordInternal()
at Microsoft.Azure.Commands.Insights.MonitorCmdletBase.ExecuteCmdlet(), Code: Null, Status code:Null, Reason phrase: Null
ARM模板代码:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"activityLogAlertName": {
"defaultValue": "Test1",
"type": "String",
"metadata": {
"description": "Unique name (within the Resource Group) for the Activity log alert."
}
},
"activityLogAlertEnabled": {
"defaultValue": true,
"type": "Bool",
"metadata": {
"description": "Indicates whether or not the alert is enabled."
}
},
"actionGroupResourceId": {
"defaultValue": "/subscriptions/[subID]]/resourceGroups/FLab/providers/microsoft.insights/actionGroups/actiongroup2",
"type": "String",
"metadata": {
"description": "Resource Id for the Action group."
}
},
"condition1": {
"defaultValue": "Administrative",
"type": "String",
"metadata": {
"description": "condition value"
}
},
"condition2": {
"defaultValue": "Microsoft.Storage/storageAccounts/blobServices/containers/write",
"type": "String",
"metadata": {
"description": "condition value"
}
},
"condition3": {
"defaultValue": "Microsoft.Storage/storageAccounts/blobServices/containers",
"type": "String",
"metadata": {
"description": "condition value"
}
},
"condition4": {
"defaultValue": "Succeeded",
"type": "String",
"metadata": {
"description": "condition value"
}
},
"condition5": {
"defaultValue": "Created",
"type": "String",
"metadata": {
"description": "condition value"
}
}
},
"resources": [
{
"type": "Microsoft.Insights/activityLogAlerts",
"apiVersion": "2017-04-01",
"name": "[parameters('activityLogAlertName')]",
"location": "Global",
"properties": {
"enabled": "[parameters('activityLogAlertEnabled')]",
"scopes": [
"[subscription().id]"
],
"condition": {
"allOf": [
{
"field": "Category",
"equals": "[parameters('condition1')]"
},
{
"field": "operationName",
"equals": "[parameters('condition2')]"
},
{
"field": "resourceType",
"equals": "[parameters('condition3')]"
},
{
"field": "Status",
"equals": "[parameters('condition4')]"
},
{
"field": "subStatus",
"equals": "[parameters('condition5')]"
}
]
},
"actions": {
"actionGroups": [
{
"actionGroupId": "[parameters('actionGroupResourceId')]"
}
]
}
}
}
]
}
自动化帐户运行手册:
$RG = "Lab"
$location = 'Global'
$alertName = "Test Storage Account Administrative Operations"
$scope = "/subscriptions/[subID]/[RG]/providers/Microsoft.Storage/storageAccounts/staccountname"
$condition1 = New-AzActivityLogAlertCondition -Field 'Category' -Equal 'Administrative'
$condition2 = New-AzActivityLogAlertCondition -Field 'operationName' -Equal 'Microsoft.Storage/storageAccounts/blobServices/containers/write'
$dict = New-Object "System.Collections.Generic.Dictionary``2[System.String,System.String]"
$dict.Add('key1', 'Value1')
$actionGrp1 = New-AzActionGroup -ActionGroupId $actiongroupid -WebhookProperty $dict
set-AzActivityLogAlert -Location $location -Name $alertname -ResourceGroupName $rg -Scope $scope -Action $actionGrp1 -Condition $condition1, $condition2
自动化帐户错误:
10:27:45 AM - *** The namespace for all the model classes will change from
Microsoft.Azure.Management.Monitor.Management.Models to Microsoft.Azure.Management.Monitor.Models in future releases.
10:27:45 AM - *** The namespace for output classes will be uniform for all classes in future releases to make it
independent of modifications in the model classes.
set-AzActivityLogAlert : Exception type: MissingMethodException, Message: System.MissingMethodException: Method not
found: 'System.String
Microsoft.WindowsAzure.Commands.Utilities.Common.GeneralUtilities.GetLog(System.Net.Http.HttpRequestMessage)'.
at Microsoft.Azure.Commands.ResourceManager.Common.ServiceClientTracingInterceptor.SendRequest(String invocationId,
HttpRequestMessage request)
at Microsoft.Rest.ServiceClientTracing.SendRequest(String invocationId, HttpRequestMessage request)
at
Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperations.<CreateOrUpdateWithHttpMessagesAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.<CreateOrUpdateAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at
Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.CreateOrUpdate(IActivityLogAlertsOperations
operations, String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert)
at Microsoft.Azure.Commands.Insights.ActivityLogAlert.SetAzureRmActivityLogAlertCommand.ProcessRecordInternal()
at Microsoft.Azure.Commands.Insights.MonitorCmdletBase.ExecuteCmdlet(), Code: Null, Status code:Null, Reason phrase:
Null
At line:24 char:1
+ set-AzActivityLogAlert -Location $location -Name $alertname -Resource ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Set-AzActivityLogAlert], PSInvalidOperationException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Insights.ActivityLogAlert.SetAzureRmActivityLogAlertCommand
参考:
set-azactivitylogalert 方法 -
https://docs.microsoft.com/en-us/powershell/module/az.monitor/set-azactivitylogalert?view=azps-5.4.0
ARM 模板方法 -
任何帮助都将非常有帮助!
答案1
好的,我设法弄清楚如何创建此规则,唯一有效的选项是 JSON 模板部署,我的示例如下:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"activityLogAlertName": {
"defaultValue": "Test rule name",
"type": "String",
"metadata": {
"description": "Unique name (within the Resource Group) for the Activity log alert."
}
},
"activityLogAlertEnabled": {
"defaultValue": true,
"type": "Bool",
"metadata": {
"description": "Indicates whether or not the alert is enabled."
}
},
"actionGroupResourceId": {
"defaultValue": "/subscriptions/{SUBID}/resourceGroups/{RG}/providers/microsoft.insights/actionGroups/actiongroup1",
"type": "String",
"metadata": {
"description": "Resource Id for the Action group."
}
},
"Category": {
"defaultValue": "Administrative",
"type": "String",
"metadata": {
"description": "category value"
}
},
"Level": {
"defaultValue": "Informational",
"type": "String",
"metadata": {
"description": "level value"
}
},
"operationName": {
"defaultValue": "Microsoft.Storage/storageAccounts/blobServices/containers/write",
"type": "String",
"metadata": {
"description": "operationName value"
}
},
"Status": {
"defaultValue": "Succeeded",
"type": "String",
"metadata": {
"description": "Status value"
}
},
"subStatus": {
"defaultValue": "Created",
"type": "String",
"metadata": {
"description": "subStatus value"
}
},
"resourceType": {
"defaultValue": "Microsoft.Storage/storageAccounts/blobServices/containers",
"type": "String",
"metadata": {
"description": "resourceType value"
}
}
},
"resources": [
{
"type": "Microsoft.Insights/activityLogAlerts",
"apiVersion": "2017-04-01",
"name": "[parameters('activityLogAlertName')]",
"location": "Global",
"properties": {
"enabled": "[parameters('activityLogAlertEnabled')]",
"scopes": [
"/subscriptions/{SUBID}/resourceGroups/{RG}/providers/Microsoft.Storage/storageAccounts/STAccountName"
],
"condition": {
"allOf": [
{
"field": "Category",
"equals": "[parameters('Category')]"
},
{
"field": "Level",
"equals": "[parameters('Level')]"
},
{
"field": "operationName",
"equals": "[parameters('operationName')]"
},
{
"field": "Status",
"equals": "[parameters('Status')]"
},
{
"field": "subStatus",
"equals": "[parameters('subStatus')]"
}
]
},
"actions": {
"actionGroups": [
{
"actionGroupId": "[parameters('actionGroupResourceId')]"
}
]
}
}
}
]
}