AZMSRunTimeAuditLogs 表的查询

发布 AMQP 协议的成功连接

(AMQP) 发布高级消息队列协议的运行时成功连接。

AZMSRunTimeAuditLogs
| where Provider =~ "EventHub"
| where Protocol == "AMQP" and Status == "Success"
| project  ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by ActivityName

发布失败的 AAD 日志

发布 AAD 身份验证失败的条目。

AZMSRunTimeAuditLogs 
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| where isnotnull(NamespaceInfo) and isnotnull(AuthKey) and AuthType == "AAD" and Status != "Success" 
| project NamespaceInfo, AuthKey, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, AuthKey, ActivityName

发布失败的 SAS 日志

发布 SAS 身份验证失败的条目。

AZMSRunTimeAuditLogs 
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| where isnotnull(NamespaceInfo) and isnotnull(AuthKey) and AuthType == "SAS" and Status != "Success" 
| project NamespaceInfo, AuthKey, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, AuthKey, ActivityName

发送消息发布失败

发布发送消息事件的运行时失败。

AZMSRunTimeAuditLogs 
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| where isnotnull(NamespaceInfo) and Status != "Success" and ActivityName == "SendMessage"
| project NamespaceInfo, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, ActivityName

命名空间发布失败

发布多个命名空间的运行时故障。

AZMSRunTimeAuditLogs 
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| where isnotnull(NamespaceInfo) and Status != "Success"
| project NamespaceInfo, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, ActivityName

[经典]过去 7 天内的错误

这会列出过去 7 天的所有错误。

AzureDiagnostics
| where ResourceProvider ==\"MICROSOFT.EVENTHUB\"
| where Category == \"OperationalLogs\"
| summarize count() by \"EventName\", _ResourceId

发布 AMQP 协议的成功连接

(AMQP) 发布高级消息队列协议的运行时成功连接。

AZMSRunTimeAuditLogs
| where Provider =~ "ServiceBus" 
| where Protocol == "AMQP" and Status == "Success"
| project  ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by ActivityName

发送消息的发布失败

发布发送消息事件的运行时失败。

AZMSRunTimeAuditLogs
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| where isnotnull(NamespaceInfo) and Status != "Success" and ActivityName == "SendMessage"
| project NamespaceInfo, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, ActivityName

命名空间发布失败

发布多个命名空间的运行时故障。

AZMSRunTimeAuditLogs
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| where isnotnull(NamespaceInfo) and Status != "Success"
| project NamespaceInfo, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, ActivityName

发布失败的 AAD 日志

发布失败的 AAD 授权条目。

AZMSRunTimeAuditLogs
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| where isnotnull(NamespaceInfo) and isnotnull(AuthKey) and AuthType == "AAD" and Status != "Success" 
| project NamespaceInfo, AuthKey, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, AuthKey, ActivityName

发布失败的 SAS 日志

发布 SAS 授权失败的条目。

AZMSRunTimeAuditLogs
| extend NamespaceInfo = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| where isnotnull(NamespaceInfo) and isnotnull(AuthKey) and AuthType == "SAS" and Status != "Success" 
| project NamespaceInfo, AuthKey, ActivityName, Protocol, NetworkType, ClientIp, _ResourceId
| summarize by NamespaceInfo, AuthKey, ActivityName