When we need to monitor Azure activities, we use Azure Activity Logs. These logs are automatically created in Azure and cannot be deleted, as they are needed for auditing and diagnostic purposes. We can configure some of these logs to be sent to designated places, such as a Log Analytics workspace, where platform logs can be consolidated into a single location for easy management. In this post, we will focus on retrieving Azure Activity Logs using PowerShell and Kusto queries against Log Analytics workspaces.

Retrieving Activity logs at the resource level ^

In Azure, each resource, resource group, and subscription has a section called "Activity logs" where we can check individual activities. We can use this method to retrieve activity logs that are available for a specific resource. The example below gives us the logs from a subscription, which is limited to 1000 results.

Get-AzActivityLog | select Properties, Caller, Category, EventName, EventTimestamp, Level, Status
Retrieving logs from a specific resource

Retrieving logs from a specific resource

We can also specify a resource group, resourceID, or a specific time window to narrow down the results.

Get-AzActivityLog -ResourceId "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xxxxxxx/providers/Microsoft.xxxxxxx/ "
Get-AzActivityLog -ResourceGroupName RG01
Get-AzActivityLog -StartTime "01/11/2021" -EndTime "02/11/2021"

Although it seems very convenient to use a built-in PowerShell cmdlet to get activity logs easily, it can be difficult to retrieve all logs across multiple subscriptions, iterating through each subscription. Instead, we can simply send all activity logs from all subscriptions to a specific Log Analytics workspace. This way, we can run Kusto queries in PowerShell against the workspace where we have all logs and generate reports much more easily.

Retrieve Activity logs from a Log Analytics workspace ^

To combine all activity logs from different subscriptions in a central Log Analytics workspace, we first need to configure the subscriptions to send their Activity Logs to the workspace. This one-off configuration can be performed through the subscription's Diagnostics settings in Azure Portal.

Activity logs can be configured to send logs to Log Analytics workspaces

Activity logs can be configured to send logs to Log Analytics workspaces

Use the Diagnostics settings at the subscription level to configure sending specific logs to Log Analytics workspaces as well as other destinations, such as storage accounts, event hubs, or other partner solutions.

Specific logs based on their category can be sent to Log Analytics

Specific logs based on their category can be sent to Log Analytics

Once we've configured the subscription to send Activity logs to the Log Analytics workspace, we can retrieve logs from a specific resource, resource group, or subscription. Alternatively, we can use Kusto queries in PowerShell against Log Analytics workspaces to get logs from multiple subscriptions that have been configured to send logs to these workspaces.

Once the subscriptions have been configured, we can get logs from the Log Analytics instance using a combination of a Kusto query and a PowerShell command. The query below returns all Azure activities on virtual machines over the past 10 days.

$logQuery = "
AzureActivity
| where TimeGenerated > ago(10d)
| where _ResourceId contains '/microsoft.compute/virtualmachines/'
"

This command allows us to run the above query using the Invoke-AzOperationalInsightsQuery cmdlet. To execute this command, we need the workspaceId of the Log Analytics workspace to which we want to send the query. For this, run the following command to get the workspaceId.

Get-AzOperationalInsightsWorkspace -ResourceGroupName RGNAME -Name WorkspaceName | select CustomerId
Obtaining WorkspaceId of a log analytics workspace

Obtaining WorkspaceId of a log analytics workspace

Invoke-AzOperationalInsightsQuery -Query $logQuery -WorkspaceId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | select -ExpandProperty results | select subscriptionId,ActivityStatusValue,caller, OperationNameValue, _resourceId | fl *
Listing logs for a compute resource

Listing logs for a compute resource

If needed, you can also export these logs to a CSV file for further analysis.

Invoke-AzOperationalInsightsQuery -Query $logQuery -WorkspaceId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | select -ExpandProperty results | select subscriptionId,ActivityStatusValue,caller, OperationNameValue, _resourceId | export-csv -Delimiter "," -NoTypeInformation -Path "export.csv"

Below are some useful queries that you can use to get related logs.

Subscribe to 4sysops newsletter!

Get all "write" activities performed in the last 90 days ^

$logQuery = "
AzureActivity
| where TimeGenerated > ago(90d)
| where OperationNameValue contains 'write'
"
Getting logs around write actions

Getting logs around write actions

Get all logs from a specific resource group ^

$logQuery = "
AzureActivity
| where ResourceGroup =~ 'latest'
"
Getting logs from a specific resource group

Getting logs from a specific resource group

Get the details of public IP addresses that have been created over the past five days ^

$logQuery = "
AzureActivity
| where TimeGenerated > ago(5d)
| where ResourceProviderValue =~ 'MICROSOFT.NETWORK' and OperationNameValue =~ 'MICROSOFT.NETWORK/PUBLICIPADDRESSES/WRITE' and ActivitySubstatusValue =~ 'Created'
"
Listing logs related to public IP creations

Listing logs related to public IP creations

Retrieve logs from a specific category, such as write, administrative, action, delete, or ResourceHealth ^

$logQuery = "
AzureActivity
| where CategoryValue =~ 'ResourceHealth'
"
Retrieving ResourceHealth operation logs

Retrieving ResourceHealth operation logs

Conclusion ^

Using Log Analytic workspaces for central activity monitoring is very convenient. Querying against a single workspace for all resources across multiple subscriptions is the easiest way to get quicker results in Azure. Making use of Kusto queries along with PowerShell is also a great way to automate activity log management.

0 Comments

Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2021

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account