Set-AzSqlServerAudit
變更 Azure SQL 伺服器的稽核設定。
Syntax
Set-AzSqlServerAudit
[-AuditActionGroup <AuditActionGroups[]>]
[-PredicateExpression <String>]
[-StorageKeyType <String>]
[-RetentionInDays <UInt32>]
[-BlobStorageTargetState <String>]
[-StorageAccountResourceId <String>]
[-EventHubTargetState <String>]
[-EventHubName <String>]
[-EventHubAuthorizationRuleResourceId <String>]
[-LogAnalyticsTargetState <String>]
[-WorkspaceResourceId <String>]
[-PassThru]
[-UseIdentity <String>]
[-ResourceGroupName] <String>
[-ServerName] <String>
[-AsJob]
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Set-AzSqlServerAudit
[-AuditActionGroup <AuditActionGroups[]>]
[-PredicateExpression <String>]
[-StorageKeyType <String>]
[-RetentionInDays <UInt32>]
[-BlobStorageTargetState <String>]
[-StorageAccountResourceId <String>]
[-EventHubTargetState <String>]
[-EventHubName <String>]
[-EventHubAuthorizationRuleResourceId <String>]
[-LogAnalyticsTargetState <String>]
[-WorkspaceResourceId <String>]
[-PassThru]
[-UseIdentity <String>]
-ServerObject <AzureSqlServerModel>
[-AsJob]
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Description
Set-AzSqlServerAudit Cmdlet 會變更 Azure SQL 伺服器的稽核設定。 若要使用 Cmdlet，請使用 ResourceGroupName 和 ServerName 參數來識別伺服器。 當 Blob 記憶體是稽核記錄的目的地時，請指定 儲存體 AccountResourceId 參數，以判斷稽核記錄的記憶體帳戶，以及定義記憶體密鑰的 儲存體 KeyType 參數。 您也可以設定 RetentionInDays 參數的值來定義稽核記錄的保留期，以定義稽核記錄的期間。
範例
範例 1：啟用 Azure SQL Server 的 Blob 記憶體稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/7fe3301d-31d3-4668-af5e-211a890ba6e3/resourceGroups/resourcegroup01/providers/Microsoft.Storage/storageAccounts/mystorage"範例 2：停用 Azure SQL Server 的 Blob 記憶體稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -BlobStorageTargetState Disabled範例 3：使用 T-SQL 述詞篩選來啟用 Azure SQL 伺服器的 Blob 記憶體稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/7fe3301d-31d3-4668-af5e-211a890ba6e3/resourceGroups/resourcegroup01/providers/Microsoft.Storage/storageAccounts/mystorage" -PredicateExpression "statement <> 'select 1'"範例 4：從 Azure SQL Server 的稽核原則中移除篩選設定
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -PredicateExpression ""範例 5：啟用 Azure SQL Server 的事件中樞稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -EventHubTargetState Enabled -EventHubName "EventHubName" -EventHubAuthorizationRuleResourceId "EventHubAuthorizationRuleResourceId"範例 6：停用 Azure SQL Server 的事件中樞稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -EventHubTargetState Disabled範例 7：啟用 Azure SQL Server 的記錄分析稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -LogAnalyticsTargetState Enabled -WorkspaceResourceId "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2"範例 8：停用 Azure SQL Server 的記錄分析稽核原則
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -LogAnalyticsTargetState Disabled範例 9：透過管線停用 Azure SQL Server 的記錄分析稽核原則
Get-AzSqlServer -ResourceGroupName "ResourceGroup01" -ServerName "Server01" | Set-AzSqlServerAudit -LogAnalyticsTargetState Disabled範例 10：停用將 Azure SQL Server 的稽核記錄傳送至 Blob 記憶體，並將它們傳送至記錄分析。
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -LogAnalyticsTargetState Enabled -WorkspaceResourceId "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2" -BlobStorageTargetState Disabled範例 11：啟用將 Azure SQL Server 的稽核記錄傳送至 Blob 記憶體、事件中樞和記錄分析。
Set-AzSqlServerAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/7fe3301d-31d3-4668-af5e-211a890ba6e3/resourceGroups/resourcegroup01/providers/Microsoft.Storage/storageAccounts/mystorage" -EventHubTargetState Enabled -EventHubName "EventHubName" -EventHubAuthorizationRuleResourceId "EventHubAuthorizationRuleResourceId" -LogAnalyticsTargetState Enabled -WorkspaceResourceId "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2"參數
-AsJob
在背景執行 Cmdlet
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-AuditActionGroup
建議使用的一組動作群組是下列組合 - 這會稽核針對資料庫執行的所有查詢和預存程式，以及成功和失敗的登入：
“BATCH_COMPLETED_GROUP”，
“SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP”，
“FAILED_DATABASE_AUTHENTICATION_GROUP”
上述組合也是預設設定的集合。 這些群組涵蓋針對資料庫執行的所有 SQL 語句和預存程式，不應與其他群組搭配使用，因為這會導致重複的稽核記錄。
如需詳細資訊，請參閱https://learn.microsoft.com/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions#database-level-audit-action-groups。
| Type: | AuditActionGroups[] |
| Accepted values: | BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP, LEDGER_OPERATION_GROUP, DBCC_GROUP, DATABASE_OWNERSHIP_CHANGE_GROUP, DATABASE_CHANGE_GROUP |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-BlobStorageTargetState
指出 Blob 記憶體是否為稽核記錄的目的地。
| Type: | String |
| Accepted values: | Enabled, Disabled |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Confirm
執行 Cmdlet 之前先提示您確認。
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DefaultProfile
用於與 Azure 通訊的認證、帳戶、租用戶和訂用帳戶。
| Type: | IAzureContextContainer |
| Aliases: | AzContext, AzureRmContext, AzureCredential |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EventHubAuthorizationRuleResourceId
事件中樞授權規則的資源標識碼
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EventHubName
事件中樞的名稱。 如果在提供 EventHubAuthorizationRuleResourceId 時未指定任何專案，則會選取預設事件中樞。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EventHubTargetState
指出事件中樞是否為稽核記錄的目的地。
| Type: | String |
| Accepted values: | Enabled, Disabled |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LogAnalyticsTargetState
指出記錄分析是否為稽核記錄的目的地。
| Type: | String |
| Accepted values: | Enabled, Disabled |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-PassThru
指定是否要在 Cmdlet 執行結束時輸出稽核原則
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-PredicateExpression
用來篩選稽核記錄的 T-SQL 述詞 （WHERE 子句）。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ResourceGroupName
資源群組的名稱。
| Type: | String |
| Position: | 0 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-RetentionInDays
稽核記錄的保留天數。
| Type: | Nullable<T>[UInt32] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ServerName
SQL 伺服器名稱。
| Type: | String |
| Position: | 1 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ServerObject
管理其審核策略的伺服器物件。
| Type: | AzureSqlServerModel |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-StorageAccountResourceId
記憶體帳戶資源標識碼
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-StorageKeyType
指定要使用哪一個記憶體存取金鑰。
| Type: | String |
| Accepted values: | Primary, Secondary |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-UseIdentity
指出是否要使用受控識別。 當您想要在目標記憶體不在防火牆後方時使用受控識別時，這是必要的。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
顯示執行 Cmdlet 後會發生的情況。 未執行 Cmdlet。
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WorkspaceResourceId
您要傳送稽核記錄之 Log Analytics 工作區的工作區識別碼（Log Analytics 工作區的資源識別符）。 範例：/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
輸入
Nullable<T>[[System.UInt32, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]
輸出
意見反應
即將登場：在 2024 年，我們將逐步淘汰 GitHub 問題作為內容的意見反應機制，並將它取代為新的意見反應系統。 如需詳細資訊，請參閱：https://aka.ms/ContentUserFeedback。
提交並檢視相關的意見反應