1. 适用场景官方原文Use appliance fallback logging to collect and send logs to Microsoft when the Azure Local disconnected operations appliance virtual machine (VM) is down. Use this method if standard log collection cant start and you need logs to troubleshoot issues.Appliance VM 起不来或management endpoint 不工作标准 on-demand 收集无法启动时2. 前置官方原文To use the cmdlets in this article, import the appliance logging module.需导入 appliance logging modulePowerShell。⚠️ Before you copy the module files to the target machine, run theUnblock-Filecmdlet on the files by using Windows PowerShell. ⚠️ PowerShell ISE and PowerShell 7 arent supported for log collection commands.Import-Module disconnected operations module folder path -Force3. 核心 cmdletCopy-DiagnosticData官方原文TheCopy-DiagnosticDatacommand is used to copy diagnostic logs from mounted virtual hard disks (VHDs) to a specified folder.作用从已挂载的 VHD 拷贝诊断日志到指定文件夹。此 cmdlet 会关闭 Appliance VM。3.1 参数参数必填说明DiagnosticLogPath✅目标路径包含日志副本 临时挂载的 VHDFilterRoles否按 role 过滤如 IRVM、EOS 等FromDate/ToDate否时间窗默认 当前时间前 4 小时RecoveryKeySetBitLocker否BitLocker 恢复密钥protectorid recoverypassword 对⚠️ 路径必须有足够空间——VHD 会临时挂载到该位置。3.2 RecoveryKeySet 用法部署后立即保存 BitLocker 恢复密钥plan-security.md §3。Fallback 时需要$certPasswordPlainText *** $certPassword ConvertTo-SecureString $certPasswordPlainText -AsPlainText -Force $context Set-DisconnectedOperationsClientContext -ManagementEndpointClientCertificatePath Management Endpoint Client Cert Path -ManagementEndpointClientCertificatePassword $certPassword -ManagementEndpointIpAddress Management Endpoint IP address $recoveryKeys Get-ApplianceBitlockerRecoveryKeys $context $recoveryKeys.recoverykeyset | ConvertTo-JSON c:\recoveryKeySet.json Get-Content c:\recoveryKeySet.json输出形如[ { protectorid: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}, recoverypassword: xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx }, ... ]3.3 构造 RecoveryKeySet 参数按protectoridrecoverypassword配对$recoveryKeySet ( [PSCustomObject]{ protectorid {Protec...} recoverypassword xxxxxx-xxxxxx-... }, ... )4. 完整流程推测 官方建议文档后续完整示例因抓取截断未完整显示但工作流应如下在 Appliance VM down 的节点上Import-Module ApplianceLoggingModule -Force准备 RecoveryKeySet如 §3.2跑Copy-DiagnosticData -DiagnosticLogPath path -FilterRoles roles -FromDate date -ToDate date -RecoveryKeySet keySetcmdlet 自动挂载 VHD、关闭 appliance、解锁 BitLocker、拷贝日志到DiagnosticLogPath\LogsToExport把LogsToExport拷出 → 通过支持流程给 Microsoft5. 官方没明说的事项文档没说Copy-DiagnosticData 是否会自动把 VHD 卸载 appliance 重启——通常会但建议手工验证PowerShell 7 不支持——意味着必须用 Windows PowerShell 5.1默认FilterRoles 没列出可选值列表——必须Get-Help Copy-DiagnosticData -Detailed查文档没说日志输出格式zip/raw/structured文档没说日志是否已经脱敏——按推断 Microsoft 内部处理日志保留 30 天是 on-demand 收集的策略fallback 模式未明示保留周期应该是你本地保存多久就多久