如何通过Terraform在Azure Log Analytics中为虚拟机、存储账户创建告警？

你当前实现的是资源级指标告警，如果要改为基于Log Analytics的告警，需要使用Terraform的azurerm_monitor_scheduled_query_rules_alert资源，这类告警基于Log Analytics工作区的日志查询结果触发，支持跨资源或指定特定资源的监控场景。

核心区别说明 #

• 资源类型：用azurerm_monitor_scheduled_query_rules_alert替代azurerm_monitor_metric_alert，前者专门用于Log Analytics日志查询告警
• 配置逻辑：通过Kusto查询语句定义监控条件，而非直接指定指标名称和命名空间
• 关联对象：必须绑定Log Analytics工作区ID，同时可通过scopes关联到具体资源（方便门户中关联显示）

存储账户Log Analytics告警示例 #

以下示例针对存储账户的Blob错误日志创建告警，当指定存储账户出现PutBlob错误时触发：

# 引用已存在的Log Analytics工作区
data "azurerm_log_analytics_workspace" "example" {
  name                = "your-log-analytics-workspace-name"
  resource_group_name = azurerm_resource_group.rg.name
}

# 引用目标存储账户
data "azurerm_storage_account" "stro" {
  name                = "straccount18"
  resource_group_name = azurerm_resource_group.rg.name
}

# 创建动作组（用于接收告警通知，可选但推荐）
resource "azurerm_monitor_action_group" "alert_action_group" {
  name                = "storage-alert-action-group"
  resource_group_name = azurerm_resource_group.rg.name
  short_name          = "storage-alert-ag"

  email_receiver {
    name                    = "storage-alert-email"
    email_address           = "your-alert-email@example.com"
    use_common_alert_schema = true
  }
}

# 存储账户Log Analytics日志告警规则
resource "azurerm_monitor_scheduled_query_rules_alert" "storage_error_alert" {
  name                = "storage-blob-error-alert"
  resource_group_name = azurerm_resource_group.rg.name
  location            = data.azurerm_log_analytics_workspace.example.location

  # 绑定Log Analytics工作区
  workspace_id        = data.azurerm_log_analytics_workspace.example.id

  # Kusto查询：筛选指定存储账户的PutBlob错误日志
  query = <<-QUERY
    StorageBlobLogs
    | where OperationName == "PutBlob" and StatusText contains "Error"
    | where AccountName == "${data.azurerm_storage_account.stro.name}"
    | count
  QUERY

  frequency     = "PT5M"    # 每5分钟执行一次查询
  time_window   = "PT5M"    # 查询最近5分钟的日志
  severity      = 2         # 告警级别（0-4，0最高）
  threshold     = 0         # 触发阈值：错误日志数大于0
  operator      = "GreaterThan"

  # 关联到目标存储账户（可选，用于门户中关联资源显示）
  scopes = [data.azurerm_storage_account.stro.id]

  # 绑定动作组，触发告警时发送通知
  action {
    action_group_id = azurerm_monitor_action_group.alert_action_group.id
  }
}

虚拟机Log Analytics告警示例 #

以下示例针对虚拟机的CPU使用率创建告警，当指定VM的CPU平均使用率超过80%时触发：

# 引用目标虚拟机
data "azurerm_linux_virtual_machine" "example_vm" {
  name                = "your-vm-name"
  resource_group_name = azurerm_resource_group.rg.name
}

# 虚拟机CPU使用率Log Analytics告警规则
resource "azurerm_monitor_scheduled_query_rules_alert" "vm_high_cpu_alert" {
  name                = "vm-high-cpu-alert"
  resource_group_name = azurerm_resource_group.rg.name
  location            = data.azurerm_log_analytics_workspace.example.location

  workspace_id        = data.azurerm_log_analytics_workspace.example.id

  # Kusto查询：筛选指定VM的CPU使用率，计算15分钟内平均值
  query = <<-QUERY
    Perf
    | where ObjectName == "Processor" and CounterName == "% Processor Time"
    | where Computer == "${data.azurerm_linux_virtual_machine.example_vm.name}"
    | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
    | where avg_CounterValue > 80
  QUERY

  frequency     = "PT15M"
  time_window   = "PT15M"
  severity      = 1
  threshold     = 0
  operator      = "GreaterThan"

  scopes = [data.azurerm_linux_virtual_machine.example_vm.id]

  action {
    action_group_id = azurerm_monitor_action_group.alert_action_group.id
  }
}

注意事项 #

• 确保目标资源（VM、存储账户）已配置日志收集，将对应日志发送到指定的Log Analytics工作区
• Kusto查询语句可根据实际监控需求调整，比如修改过滤条件、聚合逻辑或时间范围
• 动作组支持多种接收器类型（邮件、短信、Webhook等），可根据需求扩展配置

内容的提问来源于stack exchange，提问作者Nikhil Babu Battula