如何通过Terraform借助AMA为Azure VM启用Change-Tracking

核心配置方案 #

Change-Tracking的启用依赖Log Analytics工作区的解决方案部署、AMA代理的正确配置，以下是可直接复用的Terraform代码片段，覆盖全部关键步骤：

1. 部署并配置Log Analytics工作区（启用Change-Tracking解决方案） #

resource "azurerm_log_analytics_workspace" "main" {
  name                = "ct-workspace"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  sku                 = "PerGB2018"
}

resource "azurerm_log_analytics_solution" "change_tracking" {
  solution_name         = "ChangeTracking"
  location              = azurerm_log_analytics_workspace.main.location
  resource_group_name   = azurerm_resource_group.main.name
  workspace_resource_id = azurerm_log_analytics_workspace.main.id
  workspace_name        = azurerm_log_analytics_workspace.main.name

  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/ChangeTracking"
  }
}

2. 为VM部署AMA代理（区分Windows/Linux） #

Windows VM的AMA代理配置

resource "azurerm_virtual_machine_extension" "ama_windows" {
  name                 = "AzureMonitorWindowsAgent"
  virtual_machine_id   = azurerm_windows_virtual_machine.main.id
  publisher            = "Microsoft.Azure.Monitor"
  type                 = "AzureMonitorWindowsAgent"
  type_handler_version = "1.13"

  settings = jsonencode({
    "workspaceResourceIds" = [azurerm_log_analytics_workspace.main.id]
  })
}

Linux VM的AMA代理配置

resource "azurerm_virtual_machine_extension" "ama_linux" {
  name                 = "AzureMonitorLinuxAgent"
  virtual_machine_id   = azurerm_linux_virtual_machine.main.id
  publisher            = "Microsoft.Azure.Monitor"
  type                 = "AzureMonitorLinuxAgent"
  type_handler_version = "1.13"

  settings = jsonencode({
    "workspaceResourceIds" = [azurerm_log_analytics_workspace.main.id]
  })
}

3. 将VM纳入Change-Tracking监控范围 #

通过Log Analytics的已保存查询创建计算机组，确保VM被识别为Change-Tracking目标：

resource "azurerm_log_analytics_saved_search" "ct_computers" {
  name                = "ChangeTrackingTargetComputers"
  resource_group_name = azurerm_resource_group.main.name
  workspace_name      = azurerm_log_analytics_workspace.main.name
  category            = "ChangeTracking"
  query               = "Heartbeat | where Computer in ('${azurerm_windows_virtual_machine.main.name}') | distinct Computer"
}

关键注意事项 #

• AMA代理版本需不低于1.10，旧版本可能无法支持Change-Tracking的关联逻辑
• Log Analytics工作区与VM需处于同一区域，或确认所在区域支持跨区域数据同步
• 部署完成后需等待15-30分钟，待代理完成注册和数据初始化，才能在Azure门户查看Change-Tracking数据

内容的提问来源于stack exchange，提问作者AdorableTech