Monday, August 6, 2018

#Azure and #LogAnalytics: Audit current workspaces

In my last post, I mentioned that I have been helping a customer consolidate their workspaces and shared a script that can be used to bulk move workspaces from one subscription to another. Before you can move the workspaces, you will need to know what solutions have been added to each workspace, as some solutions cannot be moved. These solutions will need to be removed before moving the workspace, and then added back afterwards.

This script in its current form will:

  • Connect to the subscription specified
  • Retrieve all the workspaces in the subscription
  • Retrieve the enabled solutions in the workspace
  • Write a log file containing the subscription name, workspace name, solution name, along with the pricing tier of the workspace.

Disclaimer: This script has been tested in a lab environment only. It is highly recommended that you test the script in a lab environment and adapt for your environment before using in production.

Update the bits in yellow as appropriate for your environment.

###########################################################################

#

# Get-LogAnalytics-Workspaces.ps1

#

#

# This script will retrieve all the workspaces in a specific subscription along with solution info

#

#

###########################################################################

# Variables

$Subscription = "Name of subscription you want to query"

# We are going to create a log file for this process.

# These variables determine the log file name and location

$ReportDate = Get-Date -format "yyyy-M-dd"

$rnd = Get-Random -minimum 1 -maximum 1000

$ReportLocation = "C:\Temp"

$ReportName = "$ReportDate-$rnd-Azure-LogAnalyticsWorkspace-Solutions-$Subscription.csv"

$SavetoFile = "$ReportLocation\$ReportName"

# Create the folder if it doesn't exist

If (!(Test-Path $ReportLocation)){

New-Item -ItemType directory -Path $ReportLocation

}

# Delete any previous versions of the report for in case

If (Test-Path $SavetoFile){

Remove-Item $SavetoFile

}

# Open the content

$body = @()

$body += "Subscription,WorkspaceName,ResourceGroup,PricingTier,SolutionsEnabled"

# Connect to the subscription

Set-AzureRmContext -Subscription $Subscription

# Retrieve all the work spaces

$workspaces = Get-AzureRmOperationalInsightsWorkspace

# Step through the workspaces

foreach ($workspace in $workspaces)

{

$workspacename = $workspace.Name

$wsrg = $workspace.ResourceGroupName

$sku = $workspace.Sku

write-host $workspacename

# Retrieve the enabled solutions for the workspace

$solutions = (Get-AzureRmOperationalInsightsIntelligencePacks -ResourceGroupName $wsrg -WorkspaceName $workspacename).Where({$_.Enabled -eq $true})

foreach ($solution in $solutions)

{

$sname = $solution.Name

write-host $sname

$body += "$Subscription,$workspacename,$wsrg,$sku,$sname"

}

}

# Write the log file

$body >> $SavetoFile

No comments:

Related Posts with Thumbnails