如何获取订阅内最近运行的Azure Functions日志及函数详细执行信息？

1. 获取所有最近运行的Azure Functions日志 #

• Azure门户查看：
  进入目标Function App的「监测」>「日志」页面，通过时间范围筛选最近记录，也可使用内置查询模板快速定位运行日志。
• Azure CLI命令：
  实时查看日志用az functionapp log tail；查询历史日志用az monitor log-analytics query搭配Kusto语句：

  AppServiceConsoleLogs
  | where ResourceType == "MICROSOFT.WEB/SITES" and Category == "FunctionAppLogs"
  | where TimeGenerated > ago(24h) // 可调整时间范围，比如改为ago(7d)
  | project TimeGenerated, FunctionName, Message, Level
  | order by TimeGenerated desc
  

• Application Insights查询：
  若函数已关联AI，在AI「日志」中运行：

  traces
  | where cloud_RoleName contains "functionapp"
  | where message contains "Executed 'Functions."
  | where timestamp > ago(24h)
  | project timestamp, operation_Name, message, severityLevel
  | order by timestamp desc
  

2. 获取订阅下所有Azure Functions的资源与触发信息 #

需结合资源列表查询和日志分析，覆盖资源属性与运行触发数据：

步骤1：导出函数基本资源信息 #

用Azure CLI批量获取订阅内所有函数的基础属性：

az resource list --resource-type "Microsoft.Web/sites/functions" --query "[].{Name:name, FunctionApp:properties.functionAppName, ResourceGroup:resourceGroup, RuntimeType:properties.scriptType}" --output table

PowerShell版本：

Get-AzResource -ResourceType "Microsoft.Web/sites/functions" | Select-Object Name, ResourceGroupName, @{N='FunctionApp';E={$_.Properties.functionAppName}}, @{N='RuntimeType';E={$_.Properties.scriptType}}

步骤2：获取触发时间、类型及触发源 #

通过Azure Monitor日志的Kusto查询关联资源与触发数据：

FunctionAppLogs
| where TimeGenerated > ago(7d) // 按需调整时间范围
| extend FunctionName = split(OperationName, '.')[1]
| extend TriggerType = extract(@"TriggerType: (\w+)", 1, Message)
| extend TriggerSource = extract(@"TriggerSource: (.*)", 1, Message)
| project TimeGenerated, FunctionName, FunctionAppName, ResourceGroup, TriggerType, TriggerSource
| join kind=inner (
    resources
    | where type == "microsoft.web/sites/functions"
    | project FunctionName=name, FunctionAppName=split(id, '/')[8], ResourceGroup=resourceGroup
) on FunctionName, FunctionAppName, ResourceGroup
| order by TimeGenerated desc

若未启用FunctionAppLogs，可从traces表提取：

traces
| where message contains "was triggered by"
| where timestamp > ago(7d)
| extend FunctionName = split(operation_Name, '.')[1]
| extend FunctionAppName = cloud_RoleName
| extend TriggerDetails = split(message, 'was triggered by ')[1]
| project timestamp, FunctionName, FunctionAppName, ResourceGroup, TriggerDetails

内容的提问来源于stack exchange，提问作者seeess1