Linux虚拟机规模集Log Analytics配置失效排查求助

你的Terraform配置里有几个关键问题，导致VMSS的Log Analytics配置没生效、页面仍提示需要启用，下面是具体问题和修正方案：

问题1：DCR名称包含空格，违反Azure资源命名规范 #

你定义的DCR名称是"my ame"，Azure资源名称不允许包含空格，这会导致资源识别异常，直接改成合法名称比如"my-dcr-name"即可。

问题2：Linux VMSS误用Windows性能计数器 #

你在performance_counter中使用的"\\\\VmInsights\\\\DetailedMetrics"是Windows平台的VM Insights计数器格式，Linux系统完全不识别，需要替换为Linux对应的性能指标。

问题3：未确保VMSS实例应用最新配置 #

添加Azure Monitor Agent（AMA）扩展和DCR关联后，VMSS的现有实例不会自动加载新配置，需要触发滚动更新让所有实例应用最新设置。

修正后的完整代码 #

###############
# Log analytics
###############

resource "azurerm_virtual_machine_scale_set_extension" "AzureMonitorLinuxAgent" {
  name                         = "AzureMonitorLinuxAgent"
  publisher                    = "Microsoft.Azure.Monitor"
  type                         = "AzureMonitorLinuxAgent"
  type_handler_version         = "1.10"
  auto_upgrade_minor_version   = true
  virtual_machine_scale_set_id = azurerm_linux_virtual_machine_scale_set.vmss.id

  # 触发VMSS所有实例更新，确保扩展生效
  provisioner "local-exec" {
    command = "az vmss update-instances --ids ${azurerm_linux_virtual_machine_scale_set.vmss.id} --instance-ids '*'"
  }

  depends_on = [
    azurerm_linux_virtual_machine_scale_set.vmss
  ]
}

resource "azurerm_monitor_data_collection_rule" "example" {
  name                = "my-dcr-name" # 修正名称，移除空格
  resource_group_name = var.resource_group_name
  location            = var.location

  destinations {
    log_analytics {
      workspace_resource_id = var.log_analytics_workspace_log_id
      name                  = "destination-log"
    }

    azure_monitor_metrics {
      name = "test-destination-metrics"
    }
  }

  data_flow {
    destinations = ["destination-log"]
    streams      = ["Microsoft-InsightsMetrics", "Microsoft-Syslog"] # 移除Linux不支持的Microsoft-Event流
  }

  data_sources {
    # Linux VM常用性能计数器示例，可根据需求调整
    performance_counter {
      streams                       = ["Microsoft-InsightsMetrics"]
      sampling_frequency_in_seconds = 60
      counter_specifiers            = [
        "LogicalDisk|% Used Space",
        "Memory|% Used Memory",
        "Processor|% Processor Time"
      ]
      name                          = "LinuxVMInsightsPerfCounters"
    }

    syslog {
      facility_names = ["auth", "authpriv", "cron", "daemon", "kern", "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7", "lpr", "mail", "news", "syslog", "user", "uucp"]
      log_levels     = ["emerg", "alert", "crit", "err", "warning", "notice", "info", "debug"]
      name           = "test-datasource-syslog"
    }
  }
}

# 关联DCR到VMSS，确保依赖扩展先部署
resource "azurerm_monitor_data_collection_rule_association" "dcra" {
  name                    = "example1-dcra"
  target_resource_id      = azurerm_linux_virtual_machine_scale_set.vmss.id
  data_collection_rule_id = azurerm_monitor_data_collection_rule.example.id
  description             = "example"

  depends_on = [
    azurerm_virtual_machine_scale_set_extension.AzureMonitorLinuxAgent
  ]
}

验证步骤 #

1. 检查扩展状态：登录Azure门户，进入VMSS的「扩展」页面，确认AzureMonitorLinuxAgent状态为「成功」。
2. 确认数据流入：等待15-30分钟后，在Log Analytics工作区中查询Syslog或InsightsMetrics表，查看是否有数据正常流入。
3. 检查DCR关联：在VMSS的「监控」->「数据收集规则」中，确认关联的DCR状态正常。

内容的提问来源于stack exchange，提问作者Nerd in Training