是否有ARM模板解决方案可为日志分析创建OMS警报

Question

我正在尝试创建一个带有通过ARM模板附加警报的oms工作空间。 我已经创建了OMS工作区，并在警报部分中遵循了以下教程 。 经过一番挣扎之后，为什么我的警报无法部署，我在以下注释中看到了同一教程的命令。

“操作”方案已更改，此外警报在Azure Monitor中：）这是link 。

当我尝试阅读文档并变得更聪明时，我陷入了无休止的参考链接循环中：

教程中提供的链接表示， Beginning May 14, 2018, all alerts in an Azure public cloud instance of Log Analytics workspace began to extend into Azure. 一段时间后，我发现以下链接 。 我以为我终于找到了如何解释新警报的地方。 但这是针对应用程序的见解，而非日志分析。

对于我的问题，还有：是否有人可以帮助我尝试找到新的警报计划的工作方式，或者尝试向正确的方向提供指导。

Answer 1

我不是OMS专家，但这是我们一直在使用的方法：

{
    "apiVersion": "2017-03-15-preview",
    "name": "[concat(variables('namespace'), '/', variables('savedSearches').Search[copyIndex()].Name)]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
    "copy": {
        "name": "SavedSearchCopy",
        "count": "[length(variables('savedSearches').Search)]"
    },
    "dependsOn": [
        "[concat('Microsoft.OperationalInsights/workspaces/', variables('namespace'))]",
        "ActionGroupCopy"
    ],
    "properties": {
        "category": "Alerts",
        "displayName": "[variables('savedSearches').Search[copyIndex()].DisplayName]",
        "query": "[variables('savedSearches').Search[copyIndex()].Query]"
    }
},
{
    "name": "[tolower(concat(variables('namespace'), '/', variables('savedSearches').Search[copyIndex()].Name, '/',  variables('savedSearches').Search[copyIndex()].Schedule.Name))]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches/schedules/",
    "apiVersion": "2017-03-03-preview",
    "copy": {
        "name": "ScheduleCopy",
        "count": "[length(variables('savedSearches').Search)]"
    },
    "dependsOn": [
        "SavedSearchCopy"
    ],
    "properties": {
        "interval": "5",
        "queryTimeSpan": "10",
        "enabled": true
    }
},
{
    "name": "[tolower(concat(variables('namespace'), '/', variables('savedSearches').Search[copyIndex()].Name, '/',  variables('savedSearches').Search[copyIndex()].Schedule.Name, '/', variables('savedSearches').Search[copyIndex()].Alert.Name, '-', if(contains(variables('savedSearches').Search[copyIndex()].Alert, 'MetricsTrigger'), 'Total', 'Consecutive')))]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches/schedules/actions",
    "copy": {
        "name": "ActionCopy",
        "count": "[length(variables('savedSearches').Search)]"
    },
    "apiVersion": "2017-03-15-preview",
    "dependsOn": [
        "SavedSearchCopy"
    ],
    "properties": {
        "Type": "Alert",
        "Name": "[variables('savedSearches').Search[copyIndex()].Alert.Name]",
        "Description": "[variables('savedSearches').Search[copyIndex()].Alert.Description]",
        "Severity": "warning",
        "Threshold": "[variables('savedSearches').Search[copyIndex()].Alert.Threshold]",
        "Throttling": {
            "DurationInMinutes": 60
        },
        "AzNsNotification": {
            "GroupIds": [
                "[resourceId('microsoft.insights/actionGroups', 'xxx')]"
            ]
        }
    }
},
{
    "type": "Microsoft.Insights/actionGroups",
    "apiVersion": "2018-03-01",
    "name": "[variables('actionGroups')[copyIndex()].Name]",
    "copy": {
        "name": "ActionGroupCopy",
        "count": "[length(variables('actionGroups'))]"
    },
    "location": "Global",
    "properties": {
        "groupShortName": "[variables('actionGroups')[copyIndex()].Name]",
        "enabled": true,
        "emailReceivers": [
            {
                "name": "[variables('actionGroups')[copyIndex()].EmailName]",
                "emailAddress": "[variables('actionGroups')[copyIndex()].EmailAddress]"
            }
        ]
    }
},

这是一个示例保存的搜索变量，我们将其用于映射所有内容：

"savedSearches": {
    "Search": [
        {
            "Name": "HighCPU",
            "DisplayName": "CPU Above 90%",
            "Query": "Perf | where CounterName == \"% Processor Time\" and InstanceName ==\"_Total\" | summarize AggregatedValue = avg(CounterValue) by Computer, bin(TimeGenerated, 1m)",
            "Schedule": {
                "Name": "HighCPUSchedule"
            },
            "Alert": {
                "Name": "HighCPUAlert",
                "Description": "Alert for High CPU",
                "Threshold": {
                    "Operator": "gt",
                    "Value": 90,
                    "MetricsTrigger": {
                        "Value": 2,
                        "Operator": "gt",
                        "TriggerCondition": "Consecutive"
                    }
                }
            }
        },
        ...
    ]
}