求用于在Log Analytics中检测ADF触发器变更的KQL查询语句

基于AzureActivity表的核心查询 #

由于你目前仅AzureActivity表有可用数据，可通过筛选ADF触发器的创建/更新、删除操作来检测变更：

AzureActivity
| where ResourceProviderValue == "MICROSOFT.DATAFACTORY"
| where OperationNameValue in ("Microsoft.DataFactory/factories/triggers/write", "Microsoft.DataFactory/factories/triggers/delete")
| extend TriggerName = tostring(parse_json(Properties).request.resource.split('/')[-1])
| project
    事件时间 = EventTimestamp,
    订阅ID = SubscriptionId,
    资源组 = ResourceGroup,
    数据工厂名称 = Resource,
    触发器名称 = TriggerName,
    操作类型 = case(
        OperationNameValue == "Microsoft.DataFactory/factories/triggers/write", "创建/更新",
        OperationNameValue == "Microsoft.DataFactory/factories/triggers/delete", "删除",
        "未知操作"
    ),
    操作状态 = ActivityStatusValue,
    操作人 = tostring(parse_json(Properties).request.initiatedBy.user.name)
| sort by 事件时间 desc

查询说明 #

• ResourceProviderValue 筛选确保仅处理ADF相关操作
• OperationNameValue 指定触发器的核心变更操作：write 对应创建或更新，delete 对应删除
• 从Properties字段的JSON结构中解析触发器名称，通过拆分资源路径的最后一段获取
• 投影关键字段便于快速查看变更详情

查看触发器详细变更内容（需开启详细日志） #

如果需要获取触发器的具体配置变化，需确保ADF诊断设置中日志级别设为详细，然后使用以下查询解析请求体：

AzureActivity
| where ResourceProviderValue == "MICROSOFT.DATAFACTORY"
| where OperationNameValue in ("Microsoft.DataFactory/factories/triggers/write", "Microsoft.DataFactory/factories/triggers/delete")
| extend RequestBody = parse_json(tostring(parse_json(Properties).request.body))
| extend TriggerName = coalesce(RequestBody.name, tostring(parse_json(Properties).request.resource.split('/')[-1]))
| project
    事件时间 = EventTimestamp,
    订阅ID = SubscriptionId,
    资源组 = ResourceGroup,
    数据工厂名称 = Resource,
    触发器名称 = TriggerName,
    操作类型 = case(
        OperationNameValue == "Microsoft.DataFactory/factories/triggers/write", "创建/更新",
        OperationNameValue == "Microsoft.DataFactory/factories/triggers/delete", "删除",
        "未知操作"
    ),
    操作状态 = ActivityStatusValue,
    操作人 = tostring(parse_json(Properties).request.initiatedBy.user.name),
    触发器配置 = RequestBody.properties
| sort by 事件时间 desc

注意事项 #

• 若AzureActivity中缺少部分操作记录，检查ADF诊断设置是否勾选了Administrative日志类别
• 详细日志级别会增加日志量，需根据实际需求权衡

内容的提问来源于stack exchange，提问作者mac