如何通过自动化批量为Azure VM启用Change Tracking？

针对500+台Windows VM批量启用Change Tracking，以下是经过验证的自动化方案：

PowerShell 批量脚本 #

适用于已有Azure PowerShell模块的场景，可直接批量处理所有符合条件的VM：

# 配置核心参数
$logAnalyticsWorkspaceId = "/subscriptions/[你的订阅ID]/resourceGroups/[资源组名]/providers/Microsoft.OperationalInsights/workspaces/[工作区名]"
$targetSubscription = "[你的订阅ID]"

# 切换至目标订阅
Set-AzContext -Subscription $targetSubscription

# 获取所有Windows虚拟机（可按需添加资源组过滤）
$windowsVms = Get-AzVM -Status | Where-Object { $_.StorageProfile.OsDisk.OsType -eq "Windows" }

foreach ($vm in $windowsVms) {
    Write-Host "正在处理VM: $($vm.Name)"
    try {
        # 启用Change Tracking扩展
        Enable-AzVMExtension -ResourceGroupName $vm.ResourceGroupName `
            -VMName $vm.Name `
            -Name "ChangeTracking" `
            -Publisher "Microsoft.EnterpriseCloud.Monitoring" `
            -Type "ChangeTracking" `
            -TypeHandlerVersion "1.0" `
            -Settings @{"workspaceResourceId" = $logAnalyticsWorkspaceId}
        
        # 将VM关联到Log Analytics工作区
        New-AzOperationalInsightsWorkspaceDataSource -ResourceGroupName $vm.ResourceGroupName `
            -WorkspaceName "[工作区名]" `
            -Name $vm.Name `
            -DataSourceType "AzureVm" `
            -Properties @{"ResourceId" = $vm.Id}
        
        Write-Host "VM $($vm.Name) 启用成功`n"
    }
    catch {
        Write-Error "VM $($vm.Name) 启用失败: $_`n"
    }
}

脚本补充说明 #

• 提前确保VM已安装Log Analytics代理（若未安装，可在循环中添加Enable-AzVMExtension安装MicrosoftMonitoringAgent扩展的逻辑）
• 大规模操作建议添加分批延迟，比如每处理10台暂停30秒，避免触发Azure API限流

Azure CLI 批量脚本 #

适合偏好CLI的场景，语法更简洁：

# 配置参数
LOG_ANALYTICS_WORKSPACE="/subscriptions/[订阅ID]/resourceGroups/[资源组]/providers/Microsoft.OperationalInsights/workspaces/[工作区名]"
SUBSCRIPTION_ID="[订阅ID]"

# 切换订阅
az account set --subscription $SUBSCRIPTION_ID

# 获取所有Windows VM的ID列表
VM_IDS=$(az vm list --query "[?storageProfile.osDisk.osType=='Windows'].id" -o tsv)

for vm_id in $VM_IDS; do
    vm_name=$(echo $vm_id | awk -F '/' '{print $9}')
    resource_group=$(echo $vm_id | awk -F '/' '{print $5}')
    echo "正在处理VM: $vm_name"
    
    # 启用Change Tracking扩展
    az vm extension set \
        --resource-group $resource_group \
        --vm-name $vm_name \
        --name ChangeTracking \
        --publisher Microsoft.EnterpriseCloud.Monitoring \
        --settings "{\"workspaceResourceId\": \"$LOG_ANALYTICS_WORKSPACE\"}"
    
    # 关联VM到工作区
    az monitor log-analytics workspace data-source create \
        --resource-group $resource_group \
        --workspace-name "[工作区名]" \
        --name $vm_name \
        --type AzureVm \
        --properties "{\"ResourceId\": \"$vm_id\"}"
    
    echo "VM $vm_name 处理完成`n"
done

Terraform 批量配置 #

若你的VM通过Terraform管理，可通过for_each批量配置扩展：

variable "log_analytics_workspace_id" {
  type        = string
  description = "目标Log Analytics工作区资源ID"
}

variable "target_windows_vms" {
  type = list(object({
    name          = string
    resource_group = string
  }))
  description = "需要启用Change Tracking的VM列表"
}

# 批量添加Change Tracking扩展
resource "azurerm_virtual_machine_extension" "change_tracking" {
  for_each = { for vm in var.target_windows_vms : vm.name => vm }

  name                 = "ChangeTracking"
  virtual_machine_id   = "/subscriptions/[订阅ID]/resourceGroups/${each.value.resource_group}/providers/Microsoft.Compute/virtualMachines/${each.value.name}"
  publisher            = "Microsoft.EnterpriseCloud.Monitoring"
  type                 = "ChangeTracking"
  type_handler_version = "1.0"

  settings = jsonencode({
    workspaceResourceId = var.log_analytics_workspace_id
  })
}

# 批量关联VM到Log Analytics工作区
resource "azurerm_log_analytics_workspace_data_source" "vm_association" {
  for_each = { for vm in var.target_windows_vms : vm.name => vm }

  name                = each.value.name
  resource_group_name = each.value.resource_group
  workspace_name      = "[工作区名]"
  type                = "AzureVm"

  properties = jsonencode({
    ResourceId = "/subscriptions/[订阅ID]/resourceGroups/${each.value.resource_group}/providers/Microsoft.Compute/virtualMachines/${each.value.name}"
  })
}

通用注意事项 #

• 执行操作的账号需具备虚拟机参与者和Log Analytics参与者权限
• 批量操作前先选取1-2台VM做测试，验证配置正确性
• 若VM处于隔离网络，需确保能访问Azure Monitor相关服务端点

内容的提问来源于stack exchange，提问作者Ron