[英]Activitylog PS - Event initiated by
I created multiple script to identify who started or stopped a Vm using the activity log but unable to get the results - the script just executes without an output 我创建了多个脚本,以使用活动日志来识别谁启动或停止了Vm,但无法获取结果-脚本仅执行而没有输出
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit
Get-AzureRmLog -StartTime 2018-10-01T10:30 -EndTime 2018-10-12T11:30
-ResourceId /subscriptions/S1sub/resourceGroups/SamRG/providers/microsoft.compute/test
-DetailedOutput -Maxrecord 100 -InformationAction stop
Get-AzureRmLog -ResourceGroup samitrg -StartTime 2018-10-01T10:30
-EndTime 2018-10-12T11:30 | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope |
Export-Csv -Path c:\abc.csv
Get-AzureRmLog -ResourceGroup samitrg -StartTime 2018-10-01T10:30
-EndTime 2018-10-12T11:30 | Where-Object OperationName -EQ Microsoft.compute/virtualmachines/deallocate/action
Try the command below, add the extra parameters you need, like -StartTime
, -EndTime
,etc, it will work fine. 尝试以下命令,添加所需的其他参数,例如-StartTime
, -EndTime
等,它将正常工作。
Start a VM: 启动虚拟机:
$start = Get-AzureRmLog -ResourceId "<ResourceId>" | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/start/action"}
$start | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope
Stop a VM: 停止虚拟机:
$stop = Get-AzureRmLog -ResourceId "<ResourceId>" | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"}
$stop | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope
I found the solution 我找到了解决方案
START 开始
Get-AzureRmLog -ResourceID /subscriptions/<SUBID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName> -StartTime 2018-10-16T21:30 -EndTime 2018-10-16T21:50 -MaxRecord 20 | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/start/action"} | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization | Format-table -wrap -AutoSize -Property level,eventtimestamp,caller,resourcegroupname,ID -groupby Authorization
STOP 停
Get-AzureRmLog -ResourceID /subscriptions/<SUBID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName> -StartTime 2018-10-16T21:30 -EndTime 2018-10-16T21:45 -MaxRecord 20 | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"} | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization | Format-table -wrap -AutoSize -Property level,eventtimestamp,caller,resourcegroupname,ID -groupby Authorization
Hope this helps everyone :) 希望这对大家有帮助:)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.