Azure自动化Runbook跨订阅采集资源图日志至Log Analytics

核心思路 #

通过遍历自动化账户有权访问的所有订阅，针对每个订阅执行Resource Graph查询（或一次性指定多订阅批量查询），汇总结果后统一发送至Log Analytics。推荐直接在Search-AzGraph中指定订阅ID，无需频繁切换上下文，执行效率更高。

调整后的完整代码示例 #

# 1. 配置基础参数
$logAnalyticsWorkspaceId = "你的Log Analytics工作区ID"
$logAnalyticsSharedKey = "你的Log Analytics共享密钥"
$customLogTableName = "你的自定义日志表名"
# 自定义Resource Graph查询语句，可根据需求修改
$query = @"
Resources | where type == 'Microsoft.Compute/virtualMachines' 
| project Name = name, ResourceGroup = resourceGroup, SubscriptionId = subscriptionId, Location = location
"@

# 2. 获取当前自动化账户可访问的所有订阅
$subscriptions = Get-AzSubscription

# 3. 遍历订阅执行查询并收集结果
$allQueryResults = @()
foreach ($sub in $subscriptions) {
    try {
        # 针对单个订阅执行Resource Graph查询
        $subResult = Search-AzGraph -Query $query -Subscription $sub.Id
        if ($subResult) {
            $allQueryResults += $subResult
            Write-Output "已获取订阅[$($sub.Name)]的查询结果，共$($subResult.Count)条记录"
        }
    }
    catch {
        Write-Error "处理订阅[$($sub.Name)]时出错: $_"
        continue
    }
}

# 4. 将汇总结果发送至Log Analytics
if ($allQueryResults.Count -gt 0) {
    # 转换结果为JSON格式
    $jsonPayload = $allQueryResults | ConvertTo-Json -Depth 10

    # 构建Log Analytics请求签名与请求头
    $date = [DateTime]::UtcNow.ToString("r")
    $signature = New-AzOperationalInsightsWorkspaceSharedKeySignature -WorkspaceId $logAnalyticsWorkspaceId -SharedKey $logAnalyticsSharedKey -Date $date -JsonPayload $jsonPayload

    $headers = @{
        "Authorization" = $signature
        "Log-Type"      = $customLogTableName
        "x-ms-date"     = $date
        "time-generated-field" = "" # 若结果中有时间字段，可指定此处（如"createdDateTime"）
    }

    # 发送请求到Log Analytics
    try {
        Invoke-RestMethod -Uri "https://$logAnalyticsWorkspaceId.ods.opinsights.azure.com/api/logs?api-version=2016-04-01" `
            -Method Post `
            -Headers $headers `
            -Body $jsonPayload `
            -ContentType "application/json"
        Write-Output "所有订阅的查询结果已成功发送至Log Analytics"
    }
    catch {
        Write-Error "发送日志到Log Analytics时出错: $_"
    }
}
else {
    Write-Output "未获取到任何订阅的查询结果"
}

关键说明 #

• 权限要求：自动化账户的运行身份（如系统分配托管身份）需拥有所有目标订阅的Reader权限，以及Log Analytics工作区的Log Analytics Contributor或自定义日志写入权限。
• 批量查询优化：若无需逐个订阅处理异常，可直接一次性指定所有订阅ID执行查询，简化代码：

  $subIds = $subscriptions | Select-Object -ExpandProperty Id
  $allResults = Search-AzGraph -Query $query -Subscription $subIds
  

• 异常容错：循环内的try/catch逻辑可避免单个订阅处理失败导致整个Runbook终止。

内容的提问来源于stack exchange，提问作者alaCrity