如何在 Azure 入口網站中探索刪除叢集的人員How to discover who deleted a cluster in Azure portal

如果您工作區中的叢集已消失或已刪除,您可以在 Azure 入口網站的Log Analytics 工作區服務中執行查詢,以識別哪些使用者已刪除該叢集。If a cluster in your workspace has disappeared or been deleted, you can identify which user deleted it by running a query in the Log Analytics workspaces service in the Azure portal.

注意

如果您沒有設定分析工作區,則必須先在 Azure Databricks 中設定診斷記錄,才能繼續進行操作。If you do not have an analytics workspace set up, you must configure Diagnostic Logging in Azure Databricks before you continue.

  1. 在 Azure 入口網站中載入Log Analytics 工作區服務。Load the Log Analytics workspaces service in the Azure portal.

  2. 按一下您的工作區名稱。Click the name of your workspace.

  3. 按一下 [記錄]。Click Logs.

  4. 尋找下列文字:在這裡輸入您的查詢,或按一下其中一個範例查詢來啟動Look for the following text: Type your query here or click one of the example queries to start.

    Azure Log Analytics 工作區Azure Log Analytics workspace

  5. 輸入下列查詢:Enter the following query:

    DatabricksClusters
    | where ActionName == "permanentDelete"
         and Response contains "\"statusCode\":200"
         and RequestParams contains "\"cluster_id\":\"0210-024915-bore731\""  // Add cluster_id filter if cluster id is known
         and TimeGenerated between(datetime("2020-01-25 00:00:00") .. datetime("2020-01-28 00:00:00"))  // Add timestamp (in UTC) filter to narrow down the result.
    | extend id = parse_json(Identity)
    | extend requestParams = parse_json(RequestParams)
    | project UserEmail=id.email,clusterId = requestParams.cluster_id, SourceIPAddress, EventTime=TimeGenerated
    
  6. 視需要編輯cluster_idEdit the cluster_id as required.

  7. 編輯日期時間值,以在特定時間範圍內進行篩選。Edit the datetime values to filter on a specific time range.

  8. 按一下 [執行] 來執行查詢。Click Run to execute the query.

結果(如果有的話)會顯示在 [查詢] 方塊下方。The results (if any) display below the query box.

查詢的結果

如果您仍然無法找到刪除叢集的人員,請使用 Microsoft 支援服務建立支援案例。If you are still unable to find who deleted the cluster, create a support case with Microsoft Support. 提供詳細資料,例如工作區識別碼和事件的時間範圍(包括您的時區)。Provide details such as the workspace id and the time range of the event (including your time zone). Microsoft 支援服務將會檢查對應的後端活動記錄。Microsoft Support will review the corresponding backend activity logs.