CODEWITHSUNDEEP
azureazure-resource-managerazure-resource-group
jjczopek
jjczopek

Reputation: 3379

Who and when deleted an azure resource group

So I have an AKS cluster and it had been connected to log analytics workspace in a different resource group, namely DefaultResourceGroup-NEU. Apparently someone or something deleted that resource group from the subscription and caused AKS to complain about it.

I know resource groups are not recoverable, which is fine - it was a DEV environment. However, I'd like to know if there is an easy way to check who and when deleted that resourece group which took log analytics workspace with it.

Upvotes: 0

Views: 2261

Answers (3)

timothepoznanski
timothepoznanski

Reputation: 1112

I find it easier through Powershell Azure CLI:

$endTime = (Get-Date "2024-11-19T23:59:59Z").ToUniversalTime()

$events = Get-AzActivityLog -StartTime $startTime -EndTime $endTime

$events | Where-Object { $_.OperationName.ToString() -like "*delete*" } | ForEach-Object {
    [PSCustomObject]@{
        Time = $_.EventTimestamp
        Caller = $_.Caller
        ResourceGroupName = $_.ResourceGroupName
        OperationName = $_.OperationName.ToString()
        Status = $_.Status
    }
} | Format-Table -AutoSize

Upvotes: 0

Krzysztof Madej
Krzysztof Madej

Reputation: 40603

You can check this in Log Analytics Workspace by running this query

AzureActivity
| where OperationNameValue contains "delete"
| where ActivityStatusValue == "Success"
| extend Temp = split(_ResourceId,'/')
| extend Deleted_Resource = Temp.[-1]
| extend Deleted_ResourceType = Temp.[-2]
| project TimeGenerated, Caller, CallerIpAddress, Deleted_Resource, Deleted_ResourceType, ResourceGroup
| order by TimeGenerated desc

All credits to George

Upvotes: 0

juunas
juunas

Reputation: 58743

Go to your subscription in Azure Portal, then go to Activity log. It will show a "Delete resource group" operation for the resource group delete.

Upvotes: 2

Related Questions