how to get Azure VM last reboot using azure resource graph

Question

I'm using azure resource graph to create dashboard and need the VM last reboot or Power-Off date. Need your helps please. Thank you

Answer 1

I tried to reproduce the same in my environment:

Graph query:

Resources
| where type == 'microsoft.compute/virtualmachines'
| summarize count() by PowerState = tostring(properties.extended.instanceView.powerState.code)

Checked the powerstate:

Tried below query:

resources
| where type has 'microsoft.compute/virtualmachines/extensions' 
| where name has 'MicrosoftMonitoringAgent' or name has 'AzureMonitorWindowsAgent' 
| extend AzureVM = extract('virtualMachines/(.*)/extensions',1,id), ArcVM = extract('machines/(.*)/extensions',1,id)
|summarize count() by name=tolower(AzureVM), ArcVM=tolower(ArcVM), subscriptionId, resourceGroup,  AgentType=name
| extend hasBoth = iff(count_ > 0, 'Yes', 'No') 
| join 
 ( 
    resources
    | where type =~ 'Microsoft.Compute/virtualMachines'
    | project name, properties.extended.instanceView.powerState.displayStatus,
                    properties.extended.instanceView.powerState.code,
                    created_ = properties.timeCreated
    | order by name desc
 ) on name

where i got created time of azure vm running and deallocation time.

If you want the alert when the vm stpped you can check this: azureportal - Azure alert to notify when a vm is stopped - Stack Overflow

Reference: resource-graph-samples | Microsoft Learn