继续上文的话题，上文中我们查询了Azure中VM的创建记录，这样我们就可以清晰了解到都有哪些用户创建了VM，现在我们来把需求扩展下，如果我们想看到某个用户的操作记录，那应该怎么来做呢？这其实也是个常见的需求，如果有特定的审计要求的话，可能还会用一些第三方产品来做这个事，如果像现在只是想简单看下记录，那么我们其实直接用PowerShell脚本就能实现了
下边来看下代码的内容，其实是很简单的
param (
[parameter(Mandatory = $false)]
[Int]$MaxRecords = 100000,
[parameter(Mandatory = $true)]
[string]$User
)
function Write-DateTimeMessage {
param (
[parameter(Mandatory = $false)]
[switch]$Warning,
[parameter(Mandatory = $true)]
[string]$Message,
[parameter(Mandatory = $false)]
[string]$ForegroundColor
)
if ($Warning) {
Write-Warning ($(Get-Date -UFormat '%Y/%m/%d %H:%M:%S') + " * " + $Message)
}
else {
if ($ForegroundColor) {
Write-Host ($(Get-Date -UFormat '%Y/%m/%d %H:%M:%S') + " * " + $Message) -ForegroundColor $ForegroundColor
}
else {
Write-Host ($(Get-Date -UFormat '%Y/%m/%d %H:%M:%S') + " * " + $Message)
}
}
}
[pscustomobject[]]$UserObjects = $null
$Subscriptions = Get-AzureRmSubscription
foreach ($subscription in $Subscriptions) {
" "
"Querying Subscription:"
$SubscriptionID = $Subscription.Id
$SubscriptionName = $Subscription.Name
Select-AzureRmSubscription -SubscriptionId $SubscriptionID -InformationAction SilentlyContinue
Write-DateTimeMessage -Message "Retrieving logs, please wait..."
$logs = Get-AzureRmLog -ResourceProvider Microsoft.Compute -StartTime (Get-Date).AddDays(-90) -Maxrecord $MaxRecords
foreach ($log in $logs) {
if ($log.caller -eq $User) {
$UserObject = New-Object -TypeName psobject
$UserObject | Add-Member -MemberType NoteProperty -Name SubscriptionName -Value $SubscriptionName
$UserObject | Add-Member -MemberType NoteProperty -Name SubscriptionID -Value $SubscriptionID
$UserObject | Add-Member -MemberType NoteProperty -Name ResourceGroup -Value $log.ResourceGroupName
$UserObject | Add-Member -MemberType NoteProperty -Name Caller -Value $log.caller
$UserObject | Add-Member -MemberType NoteProperty -Name Operation -Value $log.OperationName.Value
$UserObject | Add-Member -MemberType NoteProperty -Name ResourceId -Value $log.ResourceId
$UserObject | Add-Member -MemberType NoteProperty -Name Time -Value $log.EventTimestamp
$UserObjects += $UserObject
}
}
}
$OutputPath = Join-Path -Path ([Environment]::GetFolderPath("Desktop")) -ChildPath ("AzureUserAction-" + $(Get-Date -Format "yyyyMMdd-HHmmss") + ".csv")
if ($null -ne $UserObjects) {
$UserObjects | Export-Csv -NoTypeInformation -LiteralPath $OutputPath
Write-DateTimeMessage -Message "Please check $OutputPath" -Warning
}
else {
Write-DateTimeMessage "Didn't get information, please check" -warning
}
我们来尝试着运行一下脚本Get-AzureUserActionLog.ps1 -User "[email protected]", -User的作用是我们可以根据这个参数筛选出来特定的用户
脚本执行完成后，可以在桌面上看到一个csv文件，里边会记录查询出来log
扫描二维码关注公众号，回复：
8710446 查看本文章
最后，还是要提醒一点，因为Azure后台的限制，这只能查询到最近90天之内的log