在 Resource Graph 资源管理器 (Azure Resource Graph) 中查询顾问数据

顾问资源现已加入 Azure Resource Graph，为许多大规模客户方案奠定了顾问建议的基础。 以前，以下场景无法得到大规模执行，但现在可以使用 Azure Resource Graph 实现：

• 对 Azure 门户中的所有订阅执行复杂的查询。
• 按类别类型（如可靠性、性能）和影响类型（高、中、低）汇总的建议。
• 查看特定建议类型的所有建议。
• 按建议类别对受影响的资源进行计数。

Azure Graph 中的顾问资源类型

Resource Graph 中的可用顾问资源类型：

在顾问资源下有 3 种资源类型可供查询。 下面是现在可在 Resource Graph 中查询的资源列表。

• Microsoft.Advisor/configurations
• Microsoft.Advisor/recommendations
• Microsoft.Advisor/suppressions

这些资源类型列在名为“AdvisorResources”的新表下，你也可以在 Azure 门户的 Resource Graph 资源管理器中查询该表。

例子

获取动态成本建议

advisorresources 
| where type =~ 'microsoft.advisor/recommendations' 
| where (properties.category == 'Security' and properties.lastUpdated > ago(60h)) or properties.lastUpdated >= ago(1d) 
| where isempty(properties.tracked) or properties.tracked == false 
| project id, stableId = name, subscriptionId, resourceGroup, properties 
| join kind = leftouter (
    advisorresources
    | where type =~ 'microsoft.advisor/suppressions' 
    | extend tokens = split(id, '/') 
    | extend stableId = iff(array_length(tokens) > 3, tokens[(array_length(tokens) - 3)], '') 
    | extend expirationTimeStamp = todatetime(iff(strcmp(tostring(properties.ttl), '-1') == 0, '9999-12-31', properties.expirationTimeStamp)) 
    | where expirationTimeStamp > now() 
    | project
        suppressionId = tostring(properties.suppressionId),
        stableId,
        expirationTimeStamp)
    on stableId 
| project
    id,
    stableId,
    subscriptionId,
    resourceGroup,
    properties,
    expirationTimeStamp,
    suppressionId
| join kind = leftouter  (
    advisorresources
    | where type =~ 'microsoft.advisor/configurations'
    | where isempty(resourceGroup) == true
    | project
        subscriptionId,
        excludeRecomm = properties.exclude,
        lowCpuThreshold = properties.lowCpuThreshold)
    on subscriptionId
| extend isActive1 = iff(isempty(excludeRecomm), true, tobool(excludeRecomm) == false)
| extend isActive2 = iff((properties.recommendationTypeId in ("e10b1381-5f0a-47ff-8c7b-37bd13d7c974", "94aea435-ef39-493f-a547-8408092c22a7")), iff((isnotempty(lowCpuThreshold) and isnotnull(properties.extendedProperties) and isnotempty(properties.extendedProperties.MaxCpuP95)), todouble(properties.extendedProperties.MaxCpuP95) < todouble(lowCpuThreshold), iff((isnull(properties.extendedProperties) or isempty(properties.extendedProperties.MaxCpuP95) or todouble(properties.extendedProperties.MaxCpuP95) < 100), true, false)), true)
| where isActive1 == true and isActive2 == true
| join kind = leftouter  (
    advisorresources
    | where type =~ 'microsoft.advisor/configurations'
    | where isnotempty(resourceGroup) == true
    | project subscriptionId, resourceGroup, excludeProperty = properties.exclude)
    on subscriptionId, resourceGroup
| extend isActive3 = iff(isempty(excludeProperty), true, tobool(excludeProperty) == false)
| where isActive3 == true
| summarize
    expirationTimeStamp = max(expirationTimeStamp),
    suppressionIds = make_list(suppressionId)
    by id, stableId, subscriptionId, resourceGroup, tostring(properties)
| extend properties = parse_json(properties)
| extend extendedProperties = properties.extendedProperties
| extend properties = parse_json(properties)
| extend recommendationTypeId = tostring(properties.recommendationTypeId)
| extend resourceType = tostring(properties.impactedField)
| extend category = tostring(properties.category)
| extend impact = tolower(tostring(properties.impact))
| extend resourceId = tolower(substring(id, 0, strlen(id) - 81))
| extend description = tostring(properties.shortDescription.solution)
| extend lastUpdate = tostring(properties.lastUpdated)
| extend isRecommendationActive = (isnull(expirationTimeStamp) or isempty(expirationTimeStamp))
| extend extendedProperties = properties.extendedProperties
| extend recommendationSubcategory = tostring(extendedProperties.recommendationSubCategory)
| extend annualSavingsAmount = toreal(extendedProperties.annualSavingsAmount)
| extend savingsCurrency = tostring(extendedProperties.savingsCurrency)
| extend term = tostring(extendedProperties.term)
| extend lookbackPeriod = tostring(extendedProperties.lookbackPeriod)
| where isRecommendationActive == 1
| where category == 'Cost'
| project
    subscriptionId,
    recommendationTypeId,
    recommendationSubcategory,
    resourceType,
    category,
    impact,
    resourceId,
    description,
    lastUpdate,
    annualSavingsAmount,
    savingsCurrency,
    term,
    lookbackPeriod,
    resourceGroup,
    extendedProperties,
    joinID = toupper(resourceId)
| join kind=leftouter (resources | project joinID = toupper(id), tags) on $left.joinID == $right.joinID
| project
    subscriptionId,
    recommendationTypeId,
    recommendationSubcategory,
    resourceType,
    category,
    impact,
    resourceId,
    description,
    lastUpdate,
    annualSavingsAmount,
    savingsCurrency,
    term,
    lookbackPeriod,
    resourceGroup,
    extendedProperties,
    tags

相关文章

• 快速入门：使用 Azure 门户运行 Resource Graph 查询