# 构建结构化日志框架
enum LogLevel {
    Debug = 0
    Information = 1
    Warning = 2
    Error = 3
    Critical = 4
}

function New-StructuredLogger {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$LogName,

        [string]$LogDirectory = './logs',

        [LogLevel]$MinimumLevel = [LogLevel]::Information,

        [hashtable]$DefaultContext = @{}
    )

    # 确保日志目录存在
    if (-not (Test-Path $LogDirectory)) {
        New-Item -ItemType Directory -Path $LogDirectory -Force | Out-Null
    }

    $logFile = Join-Path $LogDirectory "$LogName-$(Get-Date -Format 'yyyyMMdd').json"

    # 返回日志记录器对象
    [PSCustomObject]@{
        Name          = $LogName
        LogFile       = $logFile
        MinimumLevel  = $MinimumLevel
        DefaultContext = $DefaultContext
    } | Add-Member -MemberType ScriptMethod -Name 'Write' -Value {
        param(
            [LogLevel]$Level,
            [string]$Message,
            [hashtable]$AdditionalContext = @{},
            [System.Management.Automation.ErrorRecord]$ErrorRecord = $null
        )

        # 级别过滤
        if ($Level -lt $this.MinimumLevel) { return }

        $entry = [ordered]@{
            timestamp  = (Get-Date).ToString('o')
            level      = $Level.ToString()
            logger     = $this.Name
            message    = $Message
            context    = [ordered]@{}
        }

        # 合并默认上下文和附加上下文
        foreach ($key in $this.DefaultContext.Keys) {
            $entry.context[$key] = $this.DefaultContext[$key]
        }
        foreach ($key in $AdditionalContext.Keys) {
            $entry.context[$key] = $AdditionalContext[$key]
        }

        # 异常信息
        if ($ErrorRecord) {
            $entry.exception = @{
                type       = $ErrorRecord.Exception.GetType().FullName
                message    = $ErrorRecord.Exception.Message
                stackTrace = $ErrorRecord.ScriptStackTrace
            }
        }

        $jsonLine = $entry | ConvertTo-Json -Depth 5 -Compress

        # 写入文件
        $jsonLine | Out-File -FilePath $this.LogFile -Append -Encoding utf8

        # 控制台着色输出
        $color = switch ($Level) {
            ([LogLevel]::Debug)       { 'Gray' }
            ([LogLevel]::Information) { 'White' }
            ([LogLevel]::Warning)     { 'Yellow' }
            ([LogLevel]::Error)       { 'Red' }
            ([LogLevel]::Critical)    { 'Magenta' }
            default                   { 'White' }
        }
        Write-Host "[$($Level.ToString().ToUpper())] $Message" -ForegroundColor $color
    } -Force -PassThru
}

# 创建日志记录器实例
$logger = New-StructuredLogger `
    -LogName 'deployment-pipeline' `
    -MinimumLevel ([LogLevel]::Debug) `
    -DefaultContext @{ environment = 'production'; host = $env:COMPUTERNAME }

# 记录不同级别的日志
$logger.Write([LogLevel]::Information, '开始部署流程', @{ version = '2.4.1' })
$logger.Write([LogLevel]::Debug, '加载配置文件', @{ configPath = '/etc/app/config.yaml' })
$logger.Write([LogLevel]::Warning, '检测到内存使用率偏高', @{ memoryUsage = '82%' })

# 模拟一个异常场景
try {
    throw '数据库连接超时'
} catch {
    $logger.Write([LogLevel]::Error, '部署流程中断', @{ step = 'database-migration' }, $_)
}

# 性能指标采集器
function New-MetricsCollector {
    [CmdletBinding()]
    param(
        [string]$ServiceName = 'powershell-script',
        [string]$OutputPath = './metrics'
    )

    if (-not (Test-Path $OutputPath)) {
        New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null
    }

    $metrics = [System.Collections.Concurrent.ConcurrentDictionary[string, PSObject]]::new()

    $collector = [PSCustomObject]@{
        ServiceName = $ServiceName
        StartTime   = Get-Date
        OutputPath  = $OutputPath
    }

    # 计数器：递增统计
    $collector | Add-Member -MemberType ScriptMethod -Name 'Increment' -Value {
        param([string]$MetricName, [int64]$Value = 1, [hashtable]$Tags = @{})

        $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
        $metrics.AddOrUpdate(
            $MetricName,
            { [PSCustomObject]@{ type = 'counter'; value = $Value; tags = $Tags; updatedAt = $now } },
            { param($key, $existing)
              $existing.value += $Value
              $existing.updatedAt = $now
              $existing
            }
        )
    } -Force

    # 计时器：测量执行时长
    $collector | Add-Member -MemberType ScriptMethod -Name 'Measure' -Value {
        param(
            [string]$MetricName,
            [scriptblock]$Action,
            [hashtable]$Tags = @{}
        )

        $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
        $result = & $Action
        $stopwatch.Stop()

        $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
        $metric = [PSCustomObject]@{
            type      = 'timer'
            value     = $stopwatch.ElapsedMilliseconds
            unit      = 'ms'
            tags      = $Tags
            updatedAt = $now
        }
        $metrics[$MetricName] = $metric

        $result
    } -Force

    # 仪表盘：记录当前值
    $collector | Add-Member -MemberType ScriptMethod -Name 'Gauge' -Value {
        param([string]$MetricName, [double]$Value, [string]$Unit = '', [hashtable]$Tags = @{})

        $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
        $metrics[$MetricName] = [PSCustomObject]@{
            type      = 'gauge'
            value     = $Value
            unit      = $Unit
            tags      = $Tags
            updatedAt = $now
        }
    } -Force

    # 导出为 OpenTelemetry 兼容格式
    $collector | Add-Member -MemberType ScriptMethod -Name 'Export' -Value {
        $timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'
        $exportFile = Join-Path $this.OutputPath "$($this.ServiceName)-metrics-$timestamp.json"

        $exportData = @{
            resource = @{
                'service.name' = $this.ServiceName
                'service.version' = '1.0.0'
                'host.name' = $env:COMPUTERNAME
            }
            scopeMetrics = @(
                @{
                    scope = @{ name = 'powershell-metrics' }
                    metrics = @()
                }
            )
            timestamp = (Get-Date).ToString('o')
        }

        foreach ($key in $metrics.Keys) {
            $m = $metrics[$key]
            $metricEntry = [ordered]@{
                name  = $key
                type  = $m.type
                value = $m.value
            }
            if ($m.unit) { $metricEntry.unit = $m.unit }
            if ($m.tags.Count -gt 0) { $metricEntry.tags = $m.tags }
            $exportData.scopeMetrics[0].metrics += $metricEntry
        }

        $exportData | ConvertTo-Json -Depth 5 | Out-File -FilePath $exportFile -Encoding utf8
        Write-Host "指标已导出到：$exportFile"
        Write-Host "共采集 $($metrics.Count) 项指标"
    } -Force

    $collector
}

# 使用示例：采集脚本执行的各项指标
$metrics = New-MetricsCollector -ServiceName 'backup-job'

# 计数器：统计处理的文件数量
1..10 | ForEach-Object { $metrics.Increment('files.processed') }
$metrics.Increment('errors.total', 2)

# 计时器：测量数据库备份耗时
$dbBackupTime = $metrics.Measure('db.backup.duration', {
    Start-Sleep -Milliseconds 150
    'backup completed'
}, @{ database = 'app_db' })

# 计时器：测量文件上传耗时
$metrics.Measure('upload.duration', {
    Start-Sleep -Milliseconds 80
}, @{ destination = 'azure-blob' })

# 仪表盘：记录当前内存使用
$mem = [System.GC]::GetTotalMemory($false)
$metrics.Gauge('memory.usage.bytes', $mem, 'bytes')
$metrics.Gauge('disk.free.percent', 67.3, 'percent', @{ drive = 'C:' })

# 导出所有指标
$metrics.Export()

# 分布式追踪实现
function New-TraceContext {
    [CmdletBinding()]
    param(
        [string]$TraceId = (1..32 | ForEach-Object { '{0:x}' -f (Get-Random -Maximum 16) }) -join '',
        [string]$ParentSpanId = $null
    )

    $spanId = (1..16 | ForEach-Object { '{0:x}' -f (Get-Random -Maximum 16) }) -join ''

    [PSCustomObject]@{
        traceId       = $TraceId
        spanId        = $spanId
        parentSpanId  = $ParentSpanId
        startTime     = [DateTimeOffset]::UtcTime
        attributes    = [ordered]@{}
        events        = [System.Collections.Generic.List[PSObject]]::new()
        status        = 'OK'
    }
}

function New-Tracer {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ServiceName,

        [string]$ExporterPath = './traces'
    )

    if (-not (Test-Path $ExporterPath)) {
        New-Item -ItemType Directory -Path $ExporterPath -Force | Out-Null
    }

    # Span 栈：支持嵌套调用
    $spanStack = [System.Collections.Stack]::new()
    $completedSpans = [System.Collections.Generic.List[PSObject]]::new()

    $tracer = [PSCustomObject]@{
        ServiceName  = $ServiceName
        ExporterPath = $ExporterPath
    }

    # 开始一个新的 Span
    $tracer | Add-Member -MemberType ScriptMethod -Name 'StartSpan' -Value {
        param(
            [string]$Name,
            [hashtable]$Attributes = @{}
        )

        $parentSpanId = if ($spanStack.Count -gt 0) { $spanStack.Peek().spanId } else { $null }
        $traceId = if ($spanStack.Count -gt 0) { $spanStack.Peek().traceId } else { $null }

        $span = New-TraceContext -TraceId $traceId -ParentSpanId $parentSpanId
        $span | Add-Member -MemberType NoteProperty -Name 'name' -Value $Name

        foreach ($key in $Attributes.Keys) {
            $span.attributes[$key] = $Attributes[$key]
        }

        # 注入系统信息
        $span.attributes['service.name'] = $this.ServiceName
        $span.attributes['host.name'] = $env:COMPUTERNAME

        $spanStack.Push($span)
        $span
    } -Force

    # 添加事件到当前 Span
    $tracer | Add-Member -MemberType ScriptMethod -Name 'AddEvent' -Value {
        param([string]$EventName, [hashtable]$Attributes = @{})

        if ($spanStack.Count -eq 0) {
            Write-Warning '没有活跃的 Span，无法添加事件'
            return
        }

        $currentSpan = $spanStack.Peek()
        $currentSpan.events.Add([PSCustomObject]@{
            name       = $EventName
            timestamp  = [DateTimeOffset]::UtcTime.ToString('o')
            attributes = $Attributes
        })
    } -Force

    # 结束当前 Span
    $tracer | Add-Member -MemberType ScriptMethod -Name 'EndSpan' -Value {
        param([string]$Status = 'OK')

        if ($spanStack.Count -eq 0) {
            Write-Warning '没有活跃的 Span 可以结束'
            return
        }

        $span = $spanStack.Pop()
        $endTime = [DateTimeOffset]::UtcTime
        $duration = ($endTime - $span.startTime).TotalMilliseconds

        $span.status = $Status

        $completedSpan = [ordered]@{
            traceId      = $span.traceId
            spanId       = $span.spanId
            parentSpanId = $span.parentSpanId
            name         = $span.name
            startTime    = $span.startTime.ToString('o')
            endTime      = $endTime.ToString('o')
            durationMs   = [math]::Round($duration, 2)
            status       = $span.status
            attributes   = $span.attributes
            events       = $span.events.ToArray()
            resource     = [ordered]@{
                'service.name'    = $this.ServiceName
                'service.version' = '1.0.0'
                'telemetry.sdk.name' = 'powershell-custom'
            }
        }

        $completedSpans.Add($completedSpan)
        $completedSpan
    } -Force

    # 导出为 OTLP JSON 格式
    $tracer | Add-Member -MemberType ScriptMethod -Name 'Export' -Value {
        $timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'
        $exportFile = Join-Path $this.ExporterPath "$($this.ServiceName)-trace-$timestamp.json"

        $otlpExport = @{
            resourceSpans = @(
                @{
                    resource = @{
                        attributes = @(
                            @{ key = 'service.name'; value = @{ stringValue = $this.ServiceName } }
                        )
                    }
                    scopeSpans = @(
                        @{
                            scope = @{ name = 'powershell-tracer' }
                            spans = $completedSpans
                        }
                    )
                }
            )
        }

        $otlpExport | ConvertTo-Json -Depth 8 | Out-File -FilePath $exportFile -Encoding utf8
        Write-Host "追踪数据已导出到：$exportFile"
        Write-Host "共记录 $($completedSpans.Count) 个 Span"

        # 输出调用链摘要
        Write-Host "`n--- 调用链摘要 ---"
        foreach ($s in $completedSpans) {
            $indent = if ($s.parentSpanId) { '  ' } else { '' }
            Write-Host "$indent[$($s.status)] $($s.name) - $($s.durationMs)ms"
        }
    } -Force

    $tracer
}

# 模拟一个完整的多层调用链
$tracer = New-Tracer -ServiceName 'deployment-pipeline'

# 根 Span：整个部署流程
$rootSpan = $tracer.StartSpan('deploy.release', @{ version = '2.4.1'; environment = 'production' })

  # 子 Span 1：拉取代码
  $pullSpan = $tracer.StartSpan('git.pull', @{ repository = 'app-service' })
  Start-Sleep -Milliseconds 50
  $tracer.AddEvent('checkout_complete', @{ branch = 'main'; commit = 'a1b2c3d' })
  $tracer.EndSpan()

  # 子 Span 2：运行测试
  $testSpan = $tracer.StartSpan('test.run', @{ framework = 'pytest' })
  $tracer.AddEvent('test_started', @{ totalTests = 142 })
  Start-Sleep -Milliseconds 120

  # 孙 Span：代码覆盖率分析
  $coverageSpan = $tracer.StartSpan('test.coverage', @{ threshold = '80%' })
  Start-Sleep -Milliseconds 30
  $tracer.AddEvent('coverage_calculated', @{ lineCoverage = '87.3%'; branchCoverage = '82.1%' })
  $coverageResult = $tracer.EndSpan()

  $tracer.AddEvent('test_completed', @{ passed = 140; failed = 2 })
  $testResult = $tracer.EndSpan()

  # 子 Span 3：部署到生产
  $deploySpan = $tracer.StartSpan('deploy.push', @{ target = 'k8s-cluster-01' })
  $tracer.AddEvent('rolling_update_started', @{ replicas = 3 })
  Start-Sleep -Milliseconds 80
  $tracer.AddEvent('health_check_passed')
  $deployResult = $tracer.EndSpan()

# 结束根 Span
$tracer.EndSpan()

# 导出追踪数据
$tracer.Export()

function New-AzDashboardTemplate {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$DashboardName,

        [Parameter(Mandatory)]
        [string]$SubscriptionId,

        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [int]$RefreshIntervalSeconds = 300
    )

    $cpuTile = @{
        position = @{ x = 0; y = 0; colSpan = 6; rowSpan = 4 }
        metadata = @{
            type = 'Extension/Microsoft_Azure_Monitoring/PartType/MetricsChartPart'
            inputs = @(
                @{
                    name = 'query'
                    value = @{
                        id = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Compute/virtualMachines"
                        chartType = 0
                        metrics = @(
                            @{ name = 'Percentage CPU'; resourceId = "/subscriptions/$SubscriptionId" }
                        )
                        timespan = @{ duration = 'PT1H' }
                        interval = 'PT5M'
                    }
                }
            )
            settings = @{
                content = @{
                    options = @{
                        chart = @{
                            groupBy = $null
                            topRows = 10
                        }
                    }
                }
            }
        }
    }

    $memTile = @{
        position = @{ x = 6; y = 0; colSpan = 6; rowSpan = 4 }
        metadata = @{
            type = 'Extension/Microsoft_Azure_Monitoring/PartType/MetricsChartPart'
            inputs = @(
                @{
                    name = 'query'
                    value = @{
                        id = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Compute/virtualMachines"
                        chartType = 0
                        metrics = @(
                            @{ name = 'Available Memory Bytes'; resourceId = "/subscriptions/$SubscriptionId" }
                        )
                        timespan = @{ duration = 'PT1H' }
                        interval = 'PT5M'
                    }
                }
            )
        }
    }

    $dashboard = @{
        id       = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Portal/dashboards/$DashboardName"
        name     = $DashboardName
        type     = 'Microsoft.Portal/dashboards'
        location = 'global'
        tags     = @{ createdBy = 'PowerShell-Automation'; createdAt = (Get-Date -Format 'yyyy-MM-dd') }
        properties = @{
            lenses = @{
                '0' = @{
                    order = 0
                    parts = @($cpuTile, $memTile)
                }
            }
            metadata = @{
                model = @{
                    editable = $true
                    timeRange = @{
                        value = @{ relative = @{ duration = 24; timeUnit = 1 } }
                        type = 'MsPortalFx.Composition.Configuration.ValueTypes.TimeRangeType.Relative'
                    }
                    filter = @{
                        value = $null
                        type = 'MsPortalFx.Composition.Configuration.ValueTypes.FilterType.Callout'
                    }
                }
            }
        }
    }

    # 深度设置为 10 层，确保嵌套结构完整输出
    $dashboard | ConvertTo-Json -Depth 10
}

# 生成仪表板 JSON
$json = New-AzDashboardTemplate `
    -DashboardName 'prod-vm-monitor' `
    -SubscriptionId 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' `
    -ResourceGroupName 'rg-production'

$json | Out-File -FilePath './prod-vm-monitor-dashboard.json' -Encoding utf8
Write-Host "仪表板 JSON 已生成，文件大小：$((Get-Item './prod-vm-monitor-dashboard.json').Length) 字节"

# 先确保已登录并选择正确的订阅
# Connect-AzAccount
# Set-AzContext -SubscriptionId 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

$ResourceGroup  = 'rg-production'
$ActionGroupName = 'ag-ops-team'
$AlertRuleName   = 'alert-vm-cpu-high'

# 创建操作组：邮件通知 + Webhook
$emailReceiver = New-AzActionGroupReceiver `
    -Name 'ops-email' `
    -EmailAddress 'ops-team@contoso.com'

$webhookReceiver = New-AzActionGroupReceiver `
    -Name 'incident-webhook' `
    -WebhookUri 'https://hooks.example.com/azure-alerts'

$actionGroup = Set-AzActionGroup `
    -ResourceGroupName $ResourceGroup `
    -Name $ActionGroupName `
    -ShortName 'OpsTeam' `
    -Receiver $emailReceiver, $webhookReceiver

Write-Host "操作组已创建：$($actionGroup.Name)"

# 获取操作组的 ARM ID，告警规则需要引用
$actionGroupId = $actionGroup.Id

# 创建指标告警规则：CPU 使用率超过 85% 持续 5 分钟触发
$targetVm = Get-AzVM -ResourceGroupName $ResourceGroup -Name 'vm-web-01'
$vmResourceId = $targetVm.Id

$criteria = New-AzMetricAlertRuleV2Criteria `
    -MetricName 'Percentage CPU' `
    -TimeAggregation 'Average' `
    -Operator 'GreaterThan' `
    -Threshold 85

$actionGroupObject = New-AzMetricAlertRuleV2ActionGroup `
    -ActionGroupId $actionGroupId

# 设置告警规则的维度过滤（可选）
$dimension = New-AzMetricAlertRuleV2DimensionSelection `
    -DimensionName 'VMName' `
    -ValuesToInclude '*'

$alert = Add-AzMetricAlertRuleV2 `
    -Name $AlertRuleName `
    -ResourceGroupName $ResourceGroup `
    -WindowSize 'PT5M' `
    -Frequency 'PT1M' `
    -TargetResourceId $vmResourceId `
    -Condition $criteria `
    -ActionGroup $actionGroupObject `
    -Severity 2 `
    -Description "VM $($targetVm.Name) CPU 使用率超过 85% 持续 5 分钟"

Write-Host "告警规则已创建：$($alert.Name)"
Write-Host "目标资源：$vmResourceId"
Write-Host "阈值条件：Average Percentage CPU > 85%"
Write-Host "评估窗口：5 分钟，评估频率：1 分钟"

# 定义目标订阅列表和对应的资源配置
$subscriptions = @(
    @{
        SubscriptionId = 'aaaa1111-bbbb-2222-cccc-3333dddd4444'
        Name           = 'production'
        ResourceGroup  = 'rg-production'
        VmPrefix       = 'vm-prod'
        AlertEmail     = 'prod-ops@contoso.com'
    }
    @{
        SubscriptionId = 'eeee5555-ffff-6666-gggg-7777hhhh8888'
        Name           = 'staging'
        ResourceGroup  = 'rg-staging'
        VmPrefix       = 'vm-stg'
        AlertEmail     = 'staging-ops@contoso.com'
    }
    @{
        SubscriptionId = 'iiii9999-jjjj-0000-kkkk-1111llll2222'
        Name           = 'development'
        ResourceGroup  = 'rg-dev'
        VmPrefix       = 'vm-dev'
        AlertEmail     = 'dev-ops@contoso.com'
    }
)

$deployResults = [System.Collections.Generic.List[PSObject]]::new()

foreach ($sub in $subscriptions) {
    Write-Host "`n--- 正在处理订阅：$($sub.Name) ---" -ForegroundColor Cyan

    # 切换到目标订阅
    $context = Set-AzContext -SubscriptionId $sub.SubscriptionId
    Write-Host "  已切换到订阅：$($context.Subscription.Name)"

    # 生成仪表板 JSON
    $dashboardName = "$($sub.Name)-standard-dashboard"
    $dashboardJson = New-AzDashboardTemplate `
        -DashboardName $dashboardName `
        -SubscriptionId $sub.SubscriptionId `
        -ResourceGroupName $sub.ResourceGroup

    # 将 JSON 部署为 Azure 仪表板
    $tempFile = New-TemporaryFile
    $dashboardJson | Out-File -FilePath $tempFile.FullName -Encoding utf8

    # 使用 REST API 部署仪表板
    $token = (Get-AzAccessToken).Token
    $uri = "https://management.azure.com/subscriptions/$($sub.SubscriptionId)/resourceGroups/$($sub.ResourceGroup)/providers/Microsoft.Portal/dashboards/$dashboardName`?api-version=2020-09-01-preview"

    $headers = @{
        Authorization = "Bearer $token"
        'Content-Type' = 'application/json'
    }

    $response = Invoke-RestMethod -Uri $uri -Method Put -Headers $headers -Body $dashboardJson
    Write-Host "  仪表板已部署：$dashboardName"

    # 为该订阅创建操作组和告警规则
    $agName = "ag-$($sub.Name)-ops"
    $emailReceiver = New-AzActionGroupReceiver -Name 'team-email' -EmailAddress $sub.AlertEmail
    $actionGroup = Set-AzActionGroup `
        -ResourceGroupName $sub.ResourceGroup `
        -Name $agName `
        -ShortName "$($sub.Name)Ops" `
        -Receiver $emailReceiver

    Write-Host "  操作组已创建：$agName"

    # 记录部署结果
    $deployResults.Add([PSCustomObject]@{
        Subscription = $sub.Name
        Dashboard    = $dashboardName
        ActionGroup  = $agName
        Status       = 'Deployed'
        DeployTime   = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    })
}

# 输出部署汇总
Write-Host "`n========== 部署汇总 ==========" -ForegroundColor Yellow
$deployResults | Format-Table -AutoSize

function New-AzMetricAlertRule {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [Parameter(Mandatory)]
        [string]$TargetResourceId,

        [Parameter(Mandatory)]
        [string]$AlertName,

        [Parameter(Mandatory)]
        [string]$MetricName,

        [Parameter(Mandatory)]
        [double]$Threshold,

        [Parameter()]
        [string]$Operator = 'GreaterThan',

        [Parameter()]
        [string]$TimeAggregation = 'Average',

        [Parameter()]
        [string]$WindowSize = 'PT5M',

        [Parameter()]
        [string]$EvaluationFrequency = 'PT1M',

        [Parameter()]
        [string]$Severity = '2'
    )

    $condition = New-AzMetricAlertRuleV2Criteria `
        -MetricName $MetricName `
        -TimeAggregation $TimeAggregation `
        -Operator $Operator `
        -Threshold $Threshold

    $params = @{
        ResourceGroupName     = $ResourceGroupName
        Name                  = $AlertName
        TargetResourceId      = $TargetResourceId
        Criterion             = $condition
        WindowSize            = $WindowSize
        EvaluationFrequency   = $EvaluationFrequency
        Severity              = $Severity
        AutoMitigate          = $true
    }

    if ($PSCmdlet.ShouldProcess($AlertName, '创建指标告警规则')) {
        Add-AzMetricAlertRuleV2 @params
    }
}

# 定义标准告警模板
$alertTemplates = @(
    @{
        Name       = 'cpu-high'
        Metric     = 'Percentage CPU'
        Threshold  = 85
        Window     = 'PT5M'
        Severity   = '2'
    }
    @{
        Name       = 'memory-high'
        Metric     = 'Available Memory Bytes'
        Threshold  = 1073741824  # 1 GB
        Window     = 'PT5M'
        Severity   = '2'
    }
    @{
        Name       = 'disk-read-latency'
        Metric     = 'Average Read Latency'
        Threshold  = 30  # 毫秒
        Window     = 'PT10M'
        Severity   = '3'
    }
)

# 获取目标资源并批量创建告警
$vms = Get-AzVM -ResourceGroupName 'prod-rg'
foreach ($vm in $vms) {
    $resourceId = $vm.Id
    foreach ($template in $alertTemplates) {
        New-AzMetricAlertRule `
            -ResourceGroupName 'prod-rg' `
            -TargetResourceId $resourceId `
            -AlertName "$($vm.Name)-$($template.Name)" `
            -MetricName $template.Metric `
            -Threshold $template.Threshold `
            -WindowSize $template.Window `
            -Severity $template.Severity
    }
    Write-Host "已为 VM [$($vm.Name)] 创建 $($alertTemplates.Count) 条告警规则"
}

function New-AzLogAlertWithActionGroup {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [Parameter(Mandatory)]
        [string]$AlertName,

        [Parameter(Mandatory)]
        [string]$Query,

        [Parameter(Mandatory)]
        [string]$WorkspaceId,

        [Parameter(Mandatory)]
        [string]$ActionGroupId,

        [Parameter()]
        [int]$ThresholdValue = 0,

        [Parameter()]
        [string]$Operator = 'GreaterThan',

        [Parameter()]
        [string]$TimeRange = 'PT1H',

        [Parameter()]
        [string]$EvaluationFrequency = 'PT30M',

        [Parameter()]
        [string]$Severity = '2'
    )

    # 创建日志查询计划
    $schedule = New-AzScheduledQueryRuleScheduleObject `
        -FrequencyInMinutes ([int]$EvaluationFrequency.TrimStart('PT','M')) `
        -TimeWindowInMinutes ([int]$TimeRange.TrimStart('PT','H') * 60)

    # 创建评估条件
    $condition = New-AzScheduledQueryRuleConditionObject `
        -Query $Query `
        -TimeAggregationMethod 'Count' `
        -Operator $Operator `
        -Threshold $ThresholdValue

    # 创建告警规则并关联动作组
    $params = @{
        ResourceGroupName = $ResourceGroupName
        Name              = $AlertName
        Scopes            = @($WorkspaceId)
        Severity          = $Severity
        Enabled           = $true
        EvaluationSchedule = $schedule
        ConditionAllOf     = $condition
        ActionGroupId      = $ActionGroupId
    }

    New-AzScheduledQueryRule @params
}

# 创建动作组（邮件 + Webhook 通知）
$actionEmail = @{
    Name         = 'notify-ops-team'
    EmailAddress = 'ops-team@contoso.com'
}
$actionWebhook = @{
    Name       = 'trigger-incident-system'
    ServiceUri = 'https://hooks.incident.contoso.com/api/alert'
}

$actionGroup = Set-AzActionGroup `
    -ResourceGroupName 'monitoring-rg' `
    -Name 'ops-oncall-action-group' `
    -EmailReceiver $actionEmail `
    -WebhookReceiver $actionWebhook

# 检测 HTTP 5xx 错误激增的日志告警
$errorQuery = @"
let threshold = 50;
AppRequests
| where TimeGenerated > ago(1h)
| where ResultCode startswith '5'
| summarize ErrorCount = count() by bin(TimeGenerated, 5m)
| where ErrorCount > threshold
| order by TimeGenerated desc
"@

New-AzLogAlertWithActionGroup `
    -ResourceGroupName 'monitoring-rg' `
    -AlertName 'http-5xx-spike-detection' `
    -Query $errorQuery `
    -WorkspaceId '/subscriptions/xxxx/resourceGroups/monitoring-rg/providers/Microsoft.OperationalInsights/workspaces/prod-la' `
    -ActionGroupId $actionGroup.Id `
    -ThresholdValue 0 `
    -Operator 'GreaterThan' `
    -TimeRange 'PT1H' `
    -EvaluationFrequency 'PT15M' `
    -Severity '1'

Write-Host "日志告警规则已创建，动作组 ID: $($actionGroup.Id)"

function Get-AzAlertHealthReport {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [Parameter()]
        [datetime]$Since = (Get-Date).AddDays(-7)
    )

    # 查询近期的告警历史
    $alerts = Get-AzAlert -ResourceGroupName $ResourceGroupName `
        -TimeRange "Custom" `
        -StartTime $Since `
        -EndTime (Get-Date)

    $summary = $alerts | Group-Object Severity | ForEach-Object {
        [PSCustomObject]@{
            Severity = switch ($_.Name) {
                'Sev0' { 'Critical'; break }
                'Sev1' { 'Error'; break }
                'Sev2' { 'Warning'; break }
                'Sev3' { 'Informational'; break }
                default { $_.Name }
            }
            Count    = $_.Count
        }
    }

    # 获取所有告警规则并检查合规性
    $rules = Get-AzMetricAlertRuleV2 -ResourceGroupName $ResourceGroupName
    $compliantRules = $rules | Where-Object {
        $_.Criteria.AllOf.Count -gt 0 -and
        $_.WindowSize -match '^PT[0-9]+M$' -and
        $_.Actions.Count -gt 0
    }

    [PSCustomObject]@{
        Period              = "$($Since.ToString('yyyy-MM-dd')) ~ $((Get-Date).ToString('yyyy-MM-dd'))"
        TotalAlerts         = $alerts.Count
        SeverityBreakdown   = $summary
        TotalRules          = $rules.Count
        CompliantRules      = $compliantRules.Count
        ComplianceRate      = if ($rules.Count -gt 0) {
            [math]::Round($compliantRules.Count / $rules.Count * 100, 1)
        } else { 0 }
    }
}

# 批量静默告警（用于计划维护窗口）
function Disable-AzAlertRulesForMaintenance {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [Parameter(Mandatory)]
        [string[]]$ResourceGroupNames,

        [Parameter()]
        [string]$Reason = '计划维护窗口'
    )

    $disabledRules = @()

    foreach ($rg in $ResourceGroupNames) {
        $rules = Get-AzMetricAlertRuleV2 -ResourceGroupName $rg
        foreach ($rule in $rules) {
            if ($PSCmdlet.ShouldProcess($rule.Name, "禁用告警规则（$Reason）")) {
                Update-AzMetricAlertRuleV2 `
                    -ResourceGroupName $rg `
                    -Name $rule.Name `
                    -Enabled $false
                $disabledRules += $rule.Name
            }
        }
    }

    Write-Host "已禁用 $($disabledRules.Count) 条告警规则。原因：$Reason"
    Write-Host "维护完成后请运行 Enable-AzAlertRulesForMaintenance 重新启用。"

    return $disabledRules
}

# 生成健康报告
$report = Get-AzAlertHealthReport -ResourceGroupName 'prod-rg'
$report | Format-List

Write-Host "`n--- 告警严重级别分布 ---"
$report.SeverityBreakdown | Format-Table -AutoSize

# 安装 Az 监控相关模块
Install-Module -Name Az.Accounts, Az.Monitor, Az.Resources -Force -Scope CurrentUser

# 连接 Azure 账户
Connect-AzAccount

# 获取当前订阅信息
$context = Get-AzContext
$subscriptionId = $context.Subscription.Id
Write-Host ("当前订阅: {0} ({1})" -f $context.Subscription.Name, $subscriptionId)

# 查询目标资源组中的虚拟机
$resourceGroupName = "rg-production"
$vms = Get-AzVM -ResourceGroupName $resourceGroupName

Write-Host "`n===== 资源组中的虚拟机 =====" -ForegroundColor Cyan
foreach ($vm in $vms) {
    $status = (Get-AzVM -ResourceGroupName $resourceGroupName -Name $vm.Name -Status).Statuses[1].DisplayStatus
    Write-Host ("  {0,-30} {1}" -f $vm.Name, $status)
}

# 选取第一台虚拟机的资源 ID 作为后续示例
$targetResourceId = $vms[0].Id
Write-Host ("`n目标资源 ID: {0}" -f $targetResourceId)

# 定义告警规则参数
$alertRuleName = "cpu-high-vm-web-01"
$alertDescription = "虚拟机 CPU 使用率连续 5 分钟超过 85%，可能影响应用性能"
$windowSize = "PT5M"
$evaluationFrequency = "PT1M"
$threshold = 85
$operator = "GreaterThan"
$aggregation = "Average"
$severity = 2

# 获取目标虚拟机的资源 ID
$targetVm = Get-AzVM -ResourceGroupName $resourceGroupName -Name "vm-web-01"

# 创建告警条件
$condition = New-AzMetricAlertRuleV2Criteria `
    -MetricName "Percentage CPU" `
    -TimeAggregation $aggregation `
    -Operator $operator `
    -Threshold $threshold

# 创建告警规则
$alertRule = New-AzMetricAlertRuleV2 `
    -Name $alertRuleName `
    -ResourceGroupName $resourceGroupName `
    -WindowSize $windowSize `
    -Frequency $evaluationFrequency `
    -TargetResourceId $targetVm.Id `
    -Condition $condition `
    -Severity $severity `
    -Description $alertDescription `
    -Enabled

if ($alertRule) {
    Write-Host "指标告警规则创建成功!" -ForegroundColor Green
    Write-Host ("  规则名称: {0}" -f $alertRule.Name)
    Write-Host ("  目标资源: {0}" -f $targetVm.Name)
    Write-Host ("  监控指标: Percentage CPU")
    Write-Host ("  聚合方式: {0}" -f $aggregation)
    Write-Host ("  阈值: {0} {1}" -f $operator, $threshold)
    Write-Host ("  检测窗口: {0}" -f $windowSize)
    Write-Host ("  评估频率: {0}" -f $evaluationFrequency)
    Write-Host ("  严重级别: Sev{0}" -f $severity)
}

# 创建邮件接收人
$emailReceiver = New-AzActionGroupReceiver `
    -Name "ops-team-email" `
    -EmailAddress "ops-team@example.com"

# 创建 Webhook 接收（可对接企业 IM、事件管理平台）
$webhookReceiver = New-AzActionGroupReceiver `
    -Name "incident-webhook" `
    -WebhookUri "https://hooks.example.com/azure-alerts/incident"

# 创建操作组
$actionGroupName = "ag-production-critical"
$actionGroupShortName = "prod-crit"

$actionGroup = Set-AzActionGroup `
    -Name $actionGroupName `
    -ResourceGroupName $resourceGroupName `
    -ShortName $actionGroupShortName `
    -Receiver $emailReceiver, $webhookReceiver

if ($actionGroup) {
    Write-Host "操作组创建成功!" -ForegroundColor Green
    Write-Host ("  操作组名称: {0}" -f $actionGroup.Name)
    Write-Host ("  短名称: {0}" -f $actionGroup.ShortName)
    Write-Host ("  接收人数量: {0}" -f $actionGroup.Receivers.Count)
    Write-Host "`n  接收人详情:" -ForegroundColor Cyan
    foreach ($receiver in $actionGroup.Receivers) {
        Write-Host ("    - {0}: {1}" -f $receiver.Name, $receiver.EmailAddress)
    }
}

# 将操作组关联到告警规则
$actionGroupId = (Get-AzActionGroup -ResourceGroupName $resourceGroupName -Name $actionGroupName).Id

# 创建动作引用
$action = New-AzAlertRuleAction -ActionGroupId $actionGroupId

Write-Host "`n操作组已就绪，可关联到告警规则。" -ForegroundColor Green
Write-Host ("  Action Group ID: {0}" -f $actionGroupId)

# 查询资源组中所有指标告警规则
$alertRules = Get-AzMetricAlertRuleV2 -ResourceGroupName $resourceGroupName

Write-Host "===== 告警规则清单 =====" -ForegroundColor Cyan
Write-Host ("资源组: {0}" -f $resourceGroupName)
Write-Host ("规则总数: {0}" -f $alertRules.Count)
Write-Host ""

# 构建告警规则报告
$reportData = foreach ($rule in $alertRules) {
    $targetResources = @()
    foreach ($scope in $rule.Scopes) {
        $parts = $scope -split "/"
        $resourceName = $parts[-1]
        $targetResources += $resourceName
    }

    $criteria = $rule.Criteria
    $metricName = if ($criteria.AllOf) { $criteria.AllOf[0].MetricName } else { "N/A" }
    $thresholdValue = if ($criteria.AllOf) { $criteria.AllOf[0].Threshold } else { "N/A" }
    $operatorValue = if ($criteria.AllOf) { $criteria.AllOf[0].OperatorProperty } else { "N/A" }

    [PSCustomObject]@{
        规则名称   = $rule.Name
        严重级别   = "Sev{0}" -f $rule.Severity
        启用状态   = if ($rule.Enabled) { "已启用" } else { "已禁用" }
        监控指标   = $metricName
        阈值条件   = "{0} {1}" -f $operatorValue, $thresholdValue
        检测窗口   = $rule.WindowSize
        目标资源   = ($targetResources -join ", ")
        操作组     = if ($rule.Actions.Count -gt 0) { "已配置 ({0} 个)" -f $rule.Actions.Count } else { "未配置" }
    }
}

# 按严重级别排序并输出
$sortedReport = $reportData | Sort-Object 严重级别, 规则名称

foreach ($item in $sortedReport) {
    Write-Host "---" -ForegroundColor Gray
    Write-Host ("  规则名称: {0}" -f $item.规则名称)
    Write-Host ("  严重级别: {0}" -f $item.严重级别)
    Write-Host ("  启用状态: {0}" -f $item.启用状态)
    Write-Host ("  监控指标: {0}" -f $item.监控指标)
    Write-Host ("  阈值条件: {0}" -f $item.阈值条件)
    Write-Host ("  检测窗口: {0}" -f $item.检测窗口)
    Write-Host ("  目标资源: {0}" -f $item.目标资源)
    Write-Host ("  操作组:   {0}" -f $item.操作组)
}

# 导出 CSV 报告
$reportPath = Join-Path $env:TEMP "AlertRules-Report-{0:yyyyMMdd}.csv" -f (Get-Date)
$sortedReport | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
Write-Host ("`n报告已导出: {0}" -f $reportPath) -ForegroundColor Green

# 检查未配置操作组的规则
$noActionRules = $reportData | Where-Object { $_.操作组 -eq "未配置" }
if ($noActionRules) {
    Write-Host "`n[警告] 以下告警规则未配置操作组，触发后不会发送通知:" -ForegroundColor Yellow
    foreach ($rule in $noActionRules) {
        Write-Host ("  - {0}" -f $rule.规则名称) -ForegroundColor Yellow
    }
}

# 定义日志告警参数
$logAlertName = "anomalous-signin-detection"
$logAlertDescription = "检测 1 小时内同一账户从不同地区登录的行为，可能表示凭据泄露"
$workspaceResourceId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.OperationalInsights/workspaces/law-production"

# 构建 KQL 查询
$kqlQuery = @"
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType == 0
| summarize LoginCount = count(), DistinctLocations = dcount(Location),
    Locations = make_set(Location, 10) by UserPrincipalName
| where DistinctLocations > 2
| project TimeGenerated = now(), UserPrincipalName, LoginCount, DistinctLocations, Locations
| order by DistinctLocations desc
"@

# 创建日志查询告警的条件
$schedule = New-AzScheduledQueryRuleScheduleObject `
    -FrequencyInMinutes 15 `
    -TimeWindowInMinutes 60

$conditionObject = New-AzScheduledQueryRuleConditionObject `
    -Query $kqlQuery `
    -TimeWindow (New-TimeSpan -Minutes 60)

# 创建日志告警规则
$logAlert = New-AzScheduledQueryRule `
    -Name $logAlertName `
    -ResourceGroupName $resourceGroupName `
    -Location "eastus" `
    -DisplayName "异常登录行为检测" `
    -Description $logAlertDescription `
    -Severity 2 `
    -Enabled `
    -Schedule $schedule `
    -Condition $conditionObject `
    -Scope $workspaceResourceId

if ($logAlert) {
    Write-Host "日志查询告警规则创建成功!" -ForegroundColor Green
    Write-Host ("  规则名称: {0}" -f $logAlert.Name)
    Write-Host ("  显示名称: {0}" -f $logAlert.DisplayName)
    Write-Host ("  严重级别: Sev{0}" -f $logAlert.Severity)
    Write-Host ("  查询频率: 每 {0} 分钟" -f $schedule.FrequencyInMinutes)
    Write-Host ("  查询窗口: {0} 分钟" -f $schedule.TimeWindowInMinutes)
    Write-Host ("  目标工作区: {0}" -f ($workspaceResourceId -split "/")[-1])
}