CODEWITHSUNDEEP
azurepowershellazure-data-explorer
achahbar
achahbar

Reputation: 991

Get Azure VM creation date

Is there a possible way to get the VM creation date ?

I've tried the following by now

AzureActivity
| where TimeGenerated > ago(90d)
| where ResourceProvider == "Microsoft.Compute" and OperationName == "Create or Update Virtual Machine"
| project Resource ,Datum = format_datetime(EventSubmissionTimestamp, 'MM') ,Caller
| distinct Datum , Resource , Caller
| order by Datum

This kusto query will read the logs from the VM's connected to it. and get all the Create or update virtual machine operations from a vm and its caller ID.

But this is create and update So it gives me double values every time an VM is being updated.

I tried also in PowerShell

$GetVM = Get-AzureRMVM
Foreach ($vms in $GetVM)
{
$vm = get-azurermvm -name $vms.Name -ResourceGroupName $vms.ResourceGroupName
$log = Get-AzureRmLog -ResourceId $vm.Id -StartTime (Get-Date).AddDays(-90) -WarningAction silentlyContinue 
Write-Output "- Found VM creation at $($log.EventTimestamp) for VM $($log.Id.split("/")[8]) in Resource Group $($log.ResourceGroupName) found in Azure logs"  
}

But Can't seem to find the creation date inside the log files either. Does anyone have a clue if it is possible to find the creation date of a Virtual Machine inside a scripting language , Kusto , Powershell , ...

Upvotes: 2

Views: 28424

Answers (9)

user2785391
user2785391

Reputation: 1

To list all VMs in Azure using the portal (no code needed):

  1. Search for Virtual machines,
  2. Select Manage view,
  3. Add Time created, and
  4. Click Export to CSV.

Upvotes: 0

santosrodriguez
santosrodriguez

Reputation: 21

Run this Azure CLI command in your subscription. It'll list the VMS and their creation dates and time.

az vm list --output json --query "[*].{VM:name, Creation:timeCreated}" -o table

Upvotes: 0

Kosmich
Kosmich

Reputation: 11

Very easy with Az module:

$VM = Get-AzVM -ResourceGroupName RGNAME -Name VMNAME
$VM.TimeCreated

Upvotes: 0

Aditya Malviya
Aditya Malviya

Reputation: 2149

You can use azure cli

use below command

az vm list

This will list json data with fields and you can filter

date = vm['timeCreated']

//"timeCreated": "2022-06-24T14:13:00.326985+00:00",

Upvotes: 4

Ked Mardemootoo
Ked Mardemootoo

Reputation: 1605

I found another way to get it working for me by tweaking your ActivityLog query instead of Powershell. Using the HTTPRequest property seemed to give me what I needed.

AzureActivity
| where TimeGenerated > ago(7d)
| where ResourceProvider contains "Microsoft.Compute" and OperationName == "Create or Update Virtual Machine"
| where HTTPRequest contains "PUT"
| project VMName = Resource, Created_On = format_datetime(EventSubmissionTimestamp,'dd-MM-yyyy-HHtt'), User = Caller
| distinct Created_On, VMName, User
| order by Created_On

In my case, I was trying to get the VMs deleted in the last 7 days. For some reason the time wasn't displaying properly for the query below, hence I had to convert it to my timezone.

AzureActivity
| where TimeGenerated > ago(7d)
| where ResourceProvider == "Microsoft.Compute" and OperationName == "Delete Virtual Machine"
| where HTTPRequest contains "DELETE"
| extend MyTimeZone = EventSubmissionTimestamp + 8h
| project VM_Name = Resource, Deleted_On = format_datetime(MyTimeZone, 'dd-MM-yyyy-HHtt'), User = Caller
| distinct Deleted_On , VM_Name , User
| order by Deleted_On

Upvotes: 0

Sirpa Vivek
Sirpa Vivek

Reputation: 41

The easiest way that worked for me to get the Azure VM creation date was to look at the creation date of the OS Disk

  1. Browse to your VM on Azure Portal
  2. On Left Hand side, click on the blade "Disks"
  3. Under OS Disk section, click on your OS Disk.
  4. In the Overview blade of your OS Disk, you can see Time Created field.

Note: All my Azure VMs were created with the OS Disk and were never changed.

Hope it helps. Cheers.

Upvotes: 4

Edgars Cukanovs
Edgars Cukanovs

Reputation: 1

If you check Deployments in the respective resource group, you will see Last Modified date for each of the deployment in that RG.

Upvotes: 0

silent
silent

Reputation: 16208

There is no direct way to find out the creation date if it's later than 90 days. But here is a nice workaround solution: https://savilltech.com/2018/02/13/checking-the-creation-time-of-an-azure-iaas-vm/

Upvotes: 1

Mohit Verma
Mohit Verma

Reputation: 5294

The portal does show Created for a cloud service in the Dashboard of a Cloud Service, but that is not shown for a specific VM (which you can see with Azure PowerShell with Get-AzureService <cloud service name> | select DateCreated).

When you do a Quick Create of a VM, that will always create a new cloud service, so the time created would be the same for VM and cloud service. But since you can add multiple VMs to a cloud service, you can't always rely on that.

On the VM's Dashboard in the portal, at the bottom if you look at the VHD column, the VHD name includes the date the disk was created as part of the name, though this is only true for VMs created from an image. If the VM was created from a disk, the name could be anything. You can get that OS disk name in Azure PowerShell with Get-AzureVM <cloud service name> <VM name> | Get-AzureOSDisk | select medialink.

Operation Logs under Management Services in the portal lets you search the last 30 days for operations, so if the VM was created in the last month, you can find evidence of the operation there (for example CreateHostedService and CreateDeployment operations).

For Windows VMs created from an image, the timestamp on WaSetup.log and WaSetup.xml in C:\Windows\panther\ reflect when the VM was provisioned.

Hope it helps.

Upvotes: 1

Related Questions