Azure / Azure/azure-powershell
LAW queries support in PowerShell
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
## Description of the new feature
The client needs a report of all virtual machines deleted from multiple subscriptions for compliance and audit purposes. Currently, various teams are executing large automation scripts that deploy many virtual machines before, sometimes failing. So the application teams manually delete all the deployed Azure resources, including virtual machines, before retrying their automation scripts. This and some other process challenges are resulting in duplicate system names in Active Directory and SCCM.
A virtual machine deletion activity does not capture details like IP address, hostname, VMID, subnet name and other information in the Azure activity log. One needs to retrieve the activity record off its creation to locate these details. However, the underlying API of Get-Azlog has a 90-day limitation. This means that one is unable to query activity logs beyond 90 days using PowerShell. It would be convenient to query the Log Analytics Workspace **data plane** using PowerShell since activity logs can be stored there for a more extended period.
PFB link to the script that works with a 90-day limitation.
[Get-AzVMDeletionActivity](https://www.powershellgallery.com/packages/Get-AzVMDeletionActivity/0.4/Content/Get-AzVMDeletionActivity.ps1)
This report is proving inadequate for VM's that are created before 90 days since one can’t identify the IP, hostname etc of the VM’s during reporting to find which are out of date, which are already deleted and can be cleaned up etc.
## Proposed implementation details
There should be a module to retrieve information from a log analytics workspace natively without having to invoke Kusto queries.
Submitting as discussed with @dcaro @markcowl in reference to #13982
Contributor guide
Assessment
This issue has not been assessed yet.