日志分析工作区中的 Azure DB 同步日志

Question

我有一个 Azure SQL 数据库同步组，计划每小时运行。题：我可以通过启用诊断设置将此日志发送到日志分析工作区吗？如果是，过滤掉它们的最佳方法是什么？

我可以从 powershell 成功获取日志，但我的最终目标是根据同步日志创建警报。

提前致谢！

Answer 1

如果要将 Azure SQL 数据库同步组发送到日志分析工作区，可以使用 HTTP Data Collector API 实现。

例如

$SubscriptionId = "SubscriptionId" 
$DS_ResourceGroupName = ""
$DS_ServerName =  "" 
$DS_DatabaseName = "" 
$DS_SyncGroupName = "" 


# Replace with your OMS Workspace ID
$CustomerId = "OMSCustomerID"  

# Replace with your OMS Primary Key
$SharedKey = "SharedKey"

# Specify the name of the record type that you'll be creating
$LogType = "DataSyncLog"

# Specify a field with the created time for the records
$TimeStampField = "DateValue"

Connect-AzureRmAccount
select-azurermsubscription -SubscriptionId $SubscriptionId
#get log
$endtime =[System.DateTime]::UtcNow
$StartTime = ""

$Logs = Get-AzureRmSqlSyncGroupLog -ResourceGroupName $DS_ResourceGroupName `
                                                  -ServerName $DS_ServerName `
                                                  -DatabaseName $DS_DatabaseName `
                                                  -SyncGroupName $DS_SyncGroupName `
                                                  -starttime $StartTime `
                                                  -endtime $EndTime;
if ($Logs.Length -gt 0)
{
   foreach ($Log in $Logs)
   {
    $Log | Add-Member -Name "SubscriptionId" -Value $SubscriptionId -MemberType NoteProperty
    $Log | Add-Member -Name "ResourceGroupName" -Value $DS_ResourceGroupName -MemberType NoteProperty
    $Log | Add-Member -Name "ServerName" -Value $DS_ServerName -MemberType NoteProperty
    $Log | Add-Member -Name "HubDatabaseName" -Value $DS_DatabaseName -MemberType NoteProperty
    $Log | Add-Member -Name "SyncGroupName" -Value $DS_SyncGroupName -MemberType NoteProperty 

    #Filter out Successes to Reduce Data Volume to OMS
    #Include the 5 commented out line below to enable the filter
    #For($i=0; $i -lt $Log.Length; $i++ ) {
    #    if($Log[$i].LogLevel -eq "Success") {
    #      $Log[$i] =""      
    #    }
    # }



  }


$json = ConvertTo-JSON $logs



$result = Post-OMSData -customerId $customerId -sharedKey $sharedKey -body ([System.Text.Encoding]::UTF8.GetBytes($json)) -logType $logType
if ($result -eq 200) 
{
    Write-Host "Success"
}
if ($result -ne 200) 
               {
   throw 
@"
    Posting to OMS Failed         
    Runbook Name: DataSyncOMSIntegration         
"@
}
Function Build-Signature ($customerId, $sharedKey, $date, $contentLength, $method, $contentType, $resource)
{
    $xHeaders = "x-ms-date:" + $date
    $stringToHash = $method + "`n" + $contentLength + "`n" + $contentType + "`n" + $xHeaders + "`n" + $resource

    $bytesToHash = [Text.Encoding]::UTF8.GetBytes($stringToHash)
    $keyBytes = [Convert]::FromBase64String($sharedKey)

    $sha256 = New-Object System.Security.Cryptography.HMACSHA256
    $sha256.Key = $keyBytes
    $calculatedHash = $sha256.ComputeHash($bytesToHash)
    $encodedHash = [Convert]::ToBase64String($calculatedHash)
    $authorization = 'SharedKey {0}:{1}' -f $customerId,$encodedHash
    return $authorization
}


# Create the function to create and post the request
Function Post-OMSData($customerId, $sharedKey, $body, $logType)
{
    $method = "POST"
    $contentType = "application/json"
    $resource = "/api/logs"
    $rfc1123date = [DateTime]::UtcNow.ToString("r")
    $contentLength = $body.Length
    $signature = Build-Signature `
        -customerId $customerId `
        -sharedKey $sharedKey `
        -date $rfc1123date `
        -contentLength $contentLength `
        -method $method `
        -contentType $contentType `
        -resource $resource
    $uri = "https://" + $customerId + ".ods.opinsights.azure.com" + $resource + "?api-version=2016-04-01"

    $headers = @{
        "Authorization" = $signature;
        "Log-Type" = $logType;
        "x-ms-date" = $rfc1123date;
        "time-generated-field" = $TimeStampField;
    }

    $response = Invoke-WebRequest -Uri $uri -Method $method -ContentType $contentType -Headers $headers -Body $body -UseBasicParsing
    return $response.StatusCode

}

完成后，您可以在 Azure 日志分析中提醒 vai 日志搜索。详情请参考blog.

日志分析工作区中的 Azure DB 同步日志

Azure DB sync logs in log analytics workspace

azure

azure-sql-database