Azure / Azure/azure-powershell
Get-AzActivityLog - Ad-Hoc Activity logs missing for virtual machine actions.
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
When running Get-AzActivityLog, I noticed that logs are missing which are visible within the portal.
After looking into this, I noticed that all of the logs that are missing from the CMDlet output are all initiated by one of my MSI's (This is attached to one of my Azure Functions). All other activity initiated by users show as expected.
Example command:
```
$startDate = (get-date).AddDays(-90)
Get-AzActivityLog -StartTime $startDate -ResourceId $vm.ID | Select-Object EventTimestamp, OperationName
```
I get an output like this:
```
06/06/2022 17:06:16 Start Virtual Machine
12/05/2022 14:12:59 Create or Update Virtual Machine Extension
12/05/2022 14:08:55 'deployIfNotExists' Policy action.
12/05/2022 14:08:54 'deployIfNotExists' Policy action.
12/05/2022 14:08:54 'deployIfNotExists' Policy action.
```
All of the above results were initiated by users, however when looking at the activity log in the portal, I can see that my MSI has performed actions such as "Start Virtual Machine" and "Deallocate Virtual Machine" but these logs are omitted from the "Get-AzActivityLog" results.
Even when taking the correlation IDs from the portal for some of these missing logs and running the CMDLet with just that I still get no results.
`Get-AzActivityLog -CorrelationId $CorrelationIDHere`
Please excuse me if this is intended behaviour or a configuration issue, but I would have expected to be able to see all activity logs associated with a resource using this CMDlet.
### Issue script & Debug output
```PowerShell
*Sensitive Data Removed*
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 5.1
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
```
### Module versions
```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 3.0.1 Az.Monitor {Get-AzMetricDefinition, Get-AzMetric...
```
### Error output
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.