Log Analytics MCP Server

日志分析MCP服务器

  

A. 模型上下文协议（MCP） 服务器，使AI代理能够使用KQL（Kusto查询语言）查询Azure日志分析工作区。这将GitHub Copilot、Claude和Azure SRE Agent等AI助手与您的可观察性数据连接起来。

支持本地（stdio）和远程（Streamable HTTP）部署模式。

🎯 用例

• 私有Direct3D可观察性：来自受Private Link保护的工作区的查询日志--当公共查询被阻止时，将此服务器作为受信任的查询代理部署在ExpressRoute中
• 事故调查：在事件期间从VM、容器和Azure资源查询日志
• 交叉资源相关性：在单个自然语言请求中查询多个虚拟机/资源
• 性能分析：分析整个基础架构的CPU、内存、磁盘指标

✨ 特性

📋 先决条件

• Python 3.10+
• Azure命令行界面 已登录(az login)
• 日志分析阅读器 目标工作区中的角色

🚀 快速开始

1.克隆和安装

git clone https://github.com/yourusername/log-analytics-mcp-server.git
cd log-analytics-mcp-server

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .\.venv\Scripts\Activate.ps1

# Install dependencies
pip install -r requirements.txt

2.配置

# Set your Log Analytics workspace ID (the GUID from Azure Portal)
export LOG_ANALYTICS_WORKSPACE_ID="your-workspace-guid"

# Ensure you're logged into Azure
az login

3.测试

# Run the test script
python test_mcp.py

预期产量：

============================================================
LOG ANALYTICS MCP SERVER - VALIDATION TEST
============================================================

[1] MCP Server Info:
    Server name: log-analytics-mcp-server
    Tools registered: 5

[2] Testing list_tables()...
    ✅ SUCCESS - Retrieved table list
    Found 5 tables: ['Syslog', 'Perf', 'Heartbeat', ...]

[3] Testing query_logs()...
    ✅ SUCCESS - Query executed

============================================================
VALIDATION COMPLETE
============================================================

🔌 整合

VS代码/GitHub副本

添加到 .vscode/mcp.json:

{
  "servers": {
    "log-analytics": {
      "type": "stdio",
      "command": "python",
      "args": ["-c", "from server import mcp; mcp.run(transport='stdio')"],
      "cwd": "/path/to/log-analytics-mcp-server",
      "env": {
        "LOG_ANALYTICS_WORKSPACE_ID": "your-workspace-guid"
      }
    }
  }
}

克劳德桌面版

添加到 claude_desktop_config.json:

{
  "mcpServers": {
    "log-analytics": {
      "command": "python",
      "args": ["-c", "from server import mcp; mcp.run(transport='stdio')"],
      "cwd": "/path/to/log-analytics-mcp-server",
      "env": {
        "LOG_ANALYTICS_WORKSPACE_ID": "your-workspace-guid"
      }
    }
  }
}

Azure SRE代理

添加到代理的MCP配置中：

mcp_servers:
  - name: log-analytics
    command: python
    args: ["-c", "from server import mcp; mcp.run(transport='stdio')"]
    cwd: /path/to/log-analytics-mcp-server
    transport: stdio
    environment:
      LOG_ANALYTICS_WORKSPACE_ID: "your-workspace-guid"

📝 示例用法

配置后，您可以询问您的AI助手：

“显示过去一小时我的日志分析工作区中的错误”

“哪些虚拟机正在向我的工作区发送心跳？”

“查询Syslog以查找来自web虚拟机的任何关键错误”

“分析我的数据库服务器的性能指标”

直接使用Python

from server import query_logs, list_tables, check_vm_health

# List available tables
print(list_tables())

# Query for recent errors
result = query_logs(
    query="Syslog | where SeverityLevel == 'err' | take 10",
    timespan="PT1H"  # Last 1 hour
)
print(result)

# Check VM health
print(check_vm_health())

🏗️ 建筑

┌─────────────────────────────────────────────────────────────┐
│                    AI Assistant                              │
│         (GitHub Copilot, Claude, SRE Agent)                 │
│                                                             │
│  "Show me errors from app-vm in the last hour"              │
└─────────────────────┬───────────────────────────────────────┘
                      │ MCP Protocol (JSON-RPC over STDIO)
                      ▼
┌─────────────────────────────────────────────────────────────┐
│              Log Analytics MCP Server                        │
│                                                             │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Tools:                                              │   │
│  │  • query_logs        - Execute KQL queries           │   │
│  │  • list_tables       - Show available tables         │   │
│  │  • get_workspace_info - Workspace metadata           │   │
│  │  • analyze_errors    - Error pattern analysis        │   │
│  │  • check_vm_health   - VM health dashboard           │   │
│  └─────────────────────────────────────────────────────┘   │
│                           │                                 │
│                           │ azure-monitor-query SDK         │
│                           ▼                                 │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Azure Monitor Query Client                          │   │
│  │  (DefaultAzureCredential)                            │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────┬───────────────────────────────────────┘
                      │ Azure Monitor Query API
                      ▼
┌─────────────────────────────────────────────────────────────┐
│              Log Analytics Workspace                         │
│                                                             │
│  Tables: Syslog, Perf, Heartbeat, ContainerLog, Event, etc. │
│                                                             │
│  Data from: VMs, Containers, Azure resources                │
│  (including private VNet resources via Private Link)        │
└─────────────────────────────────────────────────────────────┘

🔐 认证

此服务器使用 DefaultAzureCredential 其按顺序尝试这些方法：

1. 环境变量 (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET)
2. Azure命令行界面 (az login)
3. Azure开发者命令行界面 (azd auth login)
4. 托管身份 （在Azure中运行时）
5. Visual Studio Code 凭证
6. Azure PowerShell (Connect-AzAccount)

为了地方发展， az login 是最简单的选择。

📊 常见KQL查询

查找最近的错误

Syslog
| where SeverityLevel in ('err', 'crit', 'alert', 'emerg')
| project TimeGenerated, Computer, Facility, SyslogMessage
| order by TimeGenerated desc
| take 20

检查VM心跳

Heartbeat
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| extend MinutesAgo = datetime_diff('minute', now(), LastHeartbeat)
| order by MinutesAgo desc

性能分析

Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time'
| summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| order by TimeGenerated desc

集装箱日志

ContainerLog
| where LogEntrySource == 'stderr'
| project TimeGenerated, ContainerID, LogEntry
| order by TimeGenerated desc
| take 50

🔧 配置选项

______________________________________________________________________

🌐 远程部署（Azure容器应用程序）

对于Azure SRE代理或其他远程MCP客户端的生产使用，请将此服务器部署到Azure容器应用程序。

先决条件

• Azure CLI已安装并登录(az login)
• Docker（仅用于本地测试）
• Azure订阅

步骤1：创建Azure资源

# Set variables
RESOURCE_GROUP="log-analytics-mcp-rg"
LOCATION="eastus2"
ACR_NAME="yourregistryname"  # Must be globally unique
CONTAINER_APP_NAME="log-analytics-mcp"
WORKSPACE_ID="your-log-analytics-workspace-guid"
API_KEY=$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)

# Create resource group
az group create --name $RESOURCE_GROUP --location $LOCATION

# Create container registry
az acr create --resource-group $RESOURCE_GROUP --name $ACR_NAME --sku Basic --admin-enabled true

# Create container apps environment
az containerapp env create \
  --name "${CONTAINER_APP_NAME}-env" \
  --resource-group $RESOURCE_GROUP \
  --location $LOCATION

步骤2：构建并推送容器映像

# Build image in ACR (from the log-analytics-mcp-server directory)
az acr build --registry $ACR_NAME --image log-analytics-mcp:v1 .

步骤3：部署容器应用程序

# Get ACR credentials
ACR_PASSWORD=$(az acr credential show --name $ACR_NAME --query "passwords[0].value" -o tsv)

# Create container app with managed identity
az containerapp create \
  --name $CONTAINER_APP_NAME \
  --resource-group $RESOURCE_GROUP \
  --environment "${CONTAINER_APP_NAME}-env" \
  --image "${ACR_NAME}.azurecr.io/log-analytics-mcp:v1" \
  --target-port 8000 \
  --ingress external \
  --min-replicas 1 \
  --max-replicas 10 \
  --cpu 0.5 \
  --memory 1.0Gi \
  --registry-server "${ACR_NAME}.azurecr.io" \
  --registry-username $ACR_NAME \
  --registry-password "$ACR_PASSWORD" \
  --env-vars \
    "LOG_ANALYTICS_WORKSPACE_ID=$WORKSPACE_ID" \
    "MCP_API_KEY=$API_KEY" \
  --system-assigned

# Get the container app URL
FQDN=$(az containerapp show --name $CONTAINER_APP_NAME --resource-group $RESOURCE_GROUP --query "properties.configuration.ingress.fqdn" -o tsv)
echo "MCP Server URL: https://${FQDN}/mcp/"
echo "Health Check: https://${FQDN}/health"
echo "API Key: $API_KEY"

步骤4：授予日志分析访问权限

# Get managed identity principal ID
PRINCIPAL_ID=$(az containerapp show --name $CONTAINER_APP_NAME --resource-group $RESOURCE_GROUP --query "identity.principalId" -o tsv)

# Grant Log Analytics Reader role on the workspace
# Replace with your Log Analytics workspace resource ID
LA_RESOURCE_ID="/subscriptions/YOUR_SUB/resourceGroups/YOUR_RG/providers/Microsoft.OperationalInsights/workspaces/YOUR_WORKSPACE"

az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Log Analytics Reader" \
  --scope $LA_RESOURCE_ID

步骤5：测试部署

# Test health endpoint
curl "https://${FQDN}/health"

# Test MCP initialization
curl -X POST "https://${FQDN}/mcp/" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

# List available tools
curl -X POST "https://${FQDN}/mcp/" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

远程集成示例

Azure SRE代理

在SRE代理门户中配置：

远程MCP客户端配置

对于任何支持HTTP传输的MCP客户端：

{
  "servers": {
    "log-analytics": {
      "type": "http",
      "url": "https://your-app.azurecontainerapps.io/mcp/",
      "headers": {
        "X-API-Key": "your-api-key"
      }
    }
  }
}

更新部署

# Build new version
az acr build --registry $ACR_NAME --image log-analytics-mcp:v2 .

# Update container app
az containerapp update \
  --name $CONTAINER_APP_NAME \
  --resource-group $RESOURCE_GROUP \
  --image "${ACR_NAME}.azurecr.io/log-analytics-mcp:v2"

______________________________________________________________________

🔒 Direct3D部署（专用链接场景）

当您的日志分析工作区受到Private Link的保护时 publicNetworkAccessForQuery: Disabled，外部查询被阻止。部署此MCP服务器 ViewModel内部 充当受信任的查询代理。

为何这很重要

External Query → Log Analytics  ❌ BLOCKED by Private Link
VNet MCP → Log Analytics        ✅ ALLOWED via Private Endpoint  
SRE Agent → VNet MCP            ✅ HTTPS (Streamable HTTP)

Direct3D集成部署

# Create VNet-integrated Container Apps environment
az containerapp env create \
  --name vnet-test-env \
  --resource-group $RESOURCE_GROUP \
  --location eastus \
  --infrastructure-subnet-resource-id "/subscriptions/.../subnets/infrastructure"

# Create ACR (VNet environments can't pull from public registries)
az acr create --resource-group $RESOURCE_GROUP --name $ACR_NAME --sku Basic

# Build and push image to ACR
az acr build --registry $ACR_NAME --image log-analytics-mcp:latest .

# Deploy with Managed Identity
az containerapp create \
  --name log-analytics-mcp-vnet \
  --resource-group $RESOURCE_GROUP \
  --environment vnet-test-env \
  --image "${ACR_NAME}.azurecr.io/log-analytics-mcp:latest" \
  --target-port 8000 \
  --ingress external \
  --env-vars "LOG_ANALYTICS_WORKSPACE_ID=$WORKSPACE_ID" "MCP_API_KEY=$API_KEY" \
  --system-assigned \
  --registry-server "${ACR_NAME}.azurecr.io"

# Grant Log Analytics Reader role to Container App's Managed Identity
PRINCIPAL_ID=$(az containerapp show --name log-analytics-mcp-vnet --resource-group $RESOURCE_GROUP --query "identity.principalId" -o tsv)
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Log Analytics Reader" \
  --scope "/subscriptions/.../workspaces/$WORKSPACE_NAME"

测试私有链接阻止

# Test from OUTSIDE VNet (should fail if Private Link is properly configured)
curl -X POST "https://log-analytics-mcp-outside.azurecontainerapps.io/mcp/" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-API-Key: $API_KEY" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_tables"},"id":1}'

# Result: InsufficientAccessError - blocked by Private Link ❌

# Test from INSIDE VNet (should succeed)
curl -X POST "https://log-analytics-mcp-vnet.azurecontainerapps.io/mcp/" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-API-Key: $API_KEY" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_tables"},"id":1}'

# Result: SUCCESS ✅ - tables returned

专用链接配置

要完成查询阻止，请配置：

# 1. Create AMPLS with Private Only mode
az monitor private-link-scope create --name my-ampls --resource-group $RESOURCE_GROUP
az monitor private-link-scope update --name my-ampls --resource-group $RESOURCE_GROUP \
  --query-access PrivateOnly

# 2. Disable public query access on workspace
az monitor log-analytics workspace update \
  --resource-group $RESOURCE_GROUP \
  --workspace-name $WORKSPACE_NAME \
  --set properties.publicNetworkAccessForQuery=Disabled

______________________________________________________________________

🧪 发展

运行测试

python test_mcp.py

使用SSE传输运行（用于web集成）

python -c "from server import mcp; mcp.run(transport='sse')"
# Server starts on http://localhost:8000/sse

使用MCP检查员进行测试

npx @modelcontextprotocol/inspector python -c "from server import mcp; mcp.run(transport='stdio')"

📄 许可证

MIT许可证-请参阅 许可证 了解详情。

🤝 贡献

欢迎投稿！请随时提交拉取请求。

📚 相关资源

• 模型上下文协议
• Azure监控查询SDK
• Kusto查询语言（KQL）
• Azure日志分析
• Azure监视器的Azure专用链接