Azure / Azure/azure-powershell

Get-AzActivityLog - Ad-Hoc Activity logs missing for virtual machine actions.

Open
#18,784 3 comments 0 reactions 1 assignee Claimed by @dingmeng-xue View on GitHub
act-observability-squad bug customer-reported Monitor - ActivityLogs needs-team-attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

When running Get-AzActivityLog, I noticed that logs are missing which are visible within the portal.

After looking into this, I noticed that all of the logs that are missing from the CMDlet output are all initiated by one of my MSI's (This is attached to one of my Azure Functions). All other activity initiated by users show as expected.

Example command:
```
$startDate = (get-date).AddDays(-90)

Get-AzActivityLog -StartTime $startDate -ResourceId $vm.ID | Select-Object EventTimestamp, OperationName
```

I get an output like this:
```
06/06/2022 17:06:16 Start Virtual Machine
12/05/2022 14:12:59 Create or Update Virtual Machine Extension
12/05/2022 14:08:55 'deployIfNotExists' Policy action.
12/05/2022 14:08:54 'deployIfNotExists' Policy action.
12/05/2022 14:08:54 'deployIfNotExists' Policy action.
```

All of the above results were initiated by users, however when looking at the activity log in the portal, I can see that my MSI has performed actions such as "Start Virtual Machine" and "Deallocate Virtual Machine" but these logs are omitted from the "Get-AzActivityLog" results.

Even when taking the correlation IDs from the portal for some of these missing logs and running the CMDLet with just that I still get no results.

`Get-AzActivityLog -CorrelationId $CorrelationIDHere`

Please excuse me if this is intended behaviour or a configuration issue, but I would have expected to be able to see all activity logs associated with a resource using this CMDlet.

### Issue script & Debug output

```PowerShell
*Sensitive Data Removed*
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
```

### Module versions

```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 3.0.1 Az.Monitor {Get-AzMetricDefinition, Get-AzMetric...
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.