CODEWITHSUNDEEP
azureazure-log-analytics
Sumesh
Sumesh

Reputation: 163

Track Resource deletion from Azure ActivityLog in LogAnalytics

I am trying to alert/visualize Resource changes like creation/deletion of Azure resources using Log Analytics/OMS. I am able to find new deployments using:

AzureActivity 
| where ActivityStatus  == 'Succeeded' and OperationNameValue contains  'Microsoft.Resources/deployments/write'

and VM start/stop also is traceable.

However, i do not see any logs when a VM is deleted from a resource group. I checked in the resource group Activity logs too, however such an important event doesnt seem to be tracked properly. Only thing I find is the deletion of shutdown schedules as part of VM deletion, however this isnt a reliable indicator.

How can I track resource deletions using Log Analytics?

Upvotes: 0

Views: 3923

Answers (1)

Ivan Glasenberg
Ivan Glasenberg

Reputation: 29995

You can set up an alert when the vm is deleted in log analytics.

Nav to azure portal, your log analytics -> in the left blade, select Alerts -> New alert rule-> in the new page, select your vm as resource -> then in the condition, add an condition: Delete Virtual Machine.

enter image description here

Upvotes: 1

Related Questions