Edit

Activity log in Azure Monitor

Azure Monitor records management operations for your Azure resources through the activity log feature. The activity log records operations like creating a virtual machine, changing a key vault access policy, or Resource Manager deployment errors. These management operations are also called control plane operations. Use the activity log to review or audit this information, or create an alert to be proactively notified when an event occurs.

In contrast to the activity log, Azure resource logs capture data plane operations performed within a resource. For example, these operations include getting a secret from a key vault or making a request to a database. Resource logs aren't collected by default and require configuration with a diagnostic setting.

Tip

If a deployment operation error directs you to this article, see Troubleshoot common Azure deployment errors.

Activity log entries

Azure Monitor collects activity log entries by default with no required configuration. The system generates these entries, and you can't change or delete them. Entries typically result from changes (create, update, and delete operations) or an action being initiated. The activity log doesn't typically capture read operations.

Activity log entries are usually available for analysis and alerting within 3 to 20 minutes of the event occurring. For a description of activity log categories, see Azure activity log event schema.

Retention period

Azure retains activity log events for 90 days and then deletes them. You aren't charged for entries during this time, regardless of volume. For more functionality, such as longer retention, create a diagnostic setting and collect the entries in another location based on your needs. One of the most common reasons to extend the retention period is to preserve resource creator information, which is only available in the activity log.

View and retrieve the activity log

View activity log events for a subscription, resource group, or an individual resource. Use the Azure portal or programmatically query them by using the Activity Log REST API.

The Azure portal provides the Activity log blade from most service menus. Each of these areas also support programmatic access with REST or through specific Azure CLI and Azure PowerShell commands.

Specify a time interval of events to retrieve. To retrieve events by using the REST API, you must include the $filter parameter along with at least an eventTimestamp start value. By default, the activity log retains events for 90 days. Make sure both the start and end of your time range fall within that 90-day window.

Activity log access scenarios

The following sections present common scenarios showing different ways to access and retrieve activity log events through the Azure portal, programmatically using Azure CLI and Azure PowerShell, or with REST calls:

  • Azure portal samples provide extra context around what kind of events to expect in that view.

  • Azure CLI samples highlight the specific commands available through the az monitor activity-log list command.

  • Azure PowerShell samples highlight the specific cmdlets available through the Get-AzActivityLog commandlet.

  • REST API samples show how to retrieve events by using the required $filter parameter with the Activity Log REST API.

    The List activity log events for a resource group sample also demonstrates how to explicitly set a timeout for your client to match the maximum timeout period for the activity log REST API of 75 seconds by using the Prefer header.

    Supported $filter patterns Details
    default subscription with a time range $filter=eventTimestamp ge '{startTime}' and eventTimestamp le '{endTime}'
    resource group $filter=eventTimestamp ge '{startTime}' and eventTimestamp le '{endTime}' and resourceGroupName eq '{resourceGroupName}'
    specific resource $filter=eventTimestamp ge '{startTime}' and eventTimestamp le '{endTime}' and resourceUri eq '{resourceURI}'
    resource provider $filter=eventTimestamp ge '{startTime}' and eventTimestamp le '{endTime}' and resourceProvider eq '{resourceProviderName}'
    correlation ID $filter=eventTimestamp ge '{startTime}' and eventTimestamp le '{endTime}' and correlationId eq '{correlationID}'

List activity log events for a subscription

Subscription level events capture events created directly by resource providers and is the default scope for listing activity log events. Tenant level and management group level events only capture Azure Resource Manager events in those hierarchies. These higher-level scopes do not include events generated directly by resource providers outside of Azure Resource Manager operations.

The following example retrieves activity log events for a subscription during a specific time range.

The menu you open Activity log from determines its initial filter. If you open it from the Monitor menu, the only filter selected by default is the subscription. This is the same as opening it from Subscriptions > select subscription > Activity Log.

Screenshot that shows the activity log.

List activity log events for a resource group

Add resourceGroupName to the $filter to scope Azure Monitor activity log results to a specific resource group.

The menu you open Activity log from determines its initial filter. If you open it from a resource's menu, the filter is set to that resource. Select Add Filter to add more properties to the filter. Here are the other properties you can filter by in the portal:

  • Resource - Items that are part of your Azure solution, such as a database or virtual machine.
  • Resource type – The category to which a resource belongs, such as virtual machines, web apps, or databases.
  • Operation - An action or command, such as create, delete, and write, that affects Azure Resource Manager resources.
  • Event initiated by – Filter events by the identity that initiated the event.
  • Event category – Filter the event types for certain operations.

Return specific activity log properties

Use a parameter to return only specified properties, which reduces the response payload size. For more information, see Activity log schema property descriptions.

The Azure portal doesn't provide a way to limit the properties returned from activity log events directly. To reduce the amount of data viewed, use the Edit columns option in the Activity log blade to select which columns are displayed in the portal view.

List tenant-level activity log events

Tenant-level activity log events typically have limited entries but might include important events such as management group or subscription creation. These events are separate from subscription-level activity log events, but might contain duplicate resource management events.

Querying at this scope uses a different REST API than the subscription-level activity log events API. Azure CLI and Azure PowerShell don't provide dedicated commands.

Go to Monitor > Activity log in the Azure portal. Change the Activity pull down menu and select Directory Activity.

Screenshot showing the Directory Activity option selected in the Activity log blade in the Azure portal.

List management group-level activity log events

Management group-level activity log events capture events scoped to a specific management group, such as policy assignments and management group membership changes.

Note

  • The following examples use the 2017-03-01-preview API version, which is required for management group-level activity log queries.

To view management group-level activity log events in the Azure portal, go to Management groups > select a management group > Activity log.

Screenshot showing the Activity log blade for a management group in the Azure portal.

The following table describes the parameters used in the preceding examples.

Variable Example value Purpose
host management.azure.com Implicit ARM endpoint
subscriptionId aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e User input
resourceGroupName myResourceGroup User input
managementGroupId myManagementGroup User input
apiVersion • 2015-04-01
• 2017-03-01-preview (for management group-level)		 Reference

View change history

For some events, you can view the change history, which shows what changes happened during that event time. Select an event from the activity log that you want to look at more deeply. Select the Change history tab to view any changes on the resource up to 30 minutes before and after the time of the operation.

Screenshot that shows the Change history list for an event.

If any changes are associated with the event, the portal shows you a selectable list of changes. Selecting a change opens the Change history page. This page displays the changes to the resource.

The following example shows that the VM changed sizes. The page displays the VM size before the change and after the change. To learn more about change history, see Get resource changes.

Screenshot that shows the Change history page showing differences.

Activity log insights

Activity log insights is an Azure Monitor workbook that provides a set of dashboards that monitor the changes to resources and resource groups in a subscription. The dashboards also present data about which users or services performed activities in the subscription and the activities' status.

To enable activity log insights, export the activity log to a Log Analytics workspace as described in Export activity log. This process sends events to the AzureActivity table, which activity log insights uses.

Screenshot that shows activity log insights dashboards.

You can open activity log insights at the subscription or resource level. For the subscription, select Activity Logs Insights from the Workbooks section of the Monitor menu.

Screenshot that shows how to locate and open the Activity Logs Insights workbook on a scale level.

For an individual resource, select Activity Logs Insights from the Workbooks section of the resource's menu.

Screenshot that shows how to locate and open the Activity Logs Insights workbook on a resource level.

Export activity log

Create a diagnostic setting to send activity log entries to other destinations for extra retention time and functionality.

Diagram showing collection of activity logs, resource logs, and platform metrics.

In the Azure portal, select Activity log on the Azure Monitor menu and then select Export Activity Logs. For more information and other methods for creating diagnostic settings, see Diagnostic settings in Azure Monitor. Make sure you disable any legacy configuration for the activity log.

Screenshot that shows the Azure Monitor menu with Activity log selected and Export activity logs highlighted in the Monitor-Activity log menu bar.

The following sections provide details on each configurable destination for resource logs.

Note

The legacy method of exporting the activity log is log profiles. See Legacy collection methods.

Send the activity log to a Log Analytics workspace for the following functionality:

There are no data ingestion charges for activity logs. Retention charges for activity logs apply only to the period extended past the default retention period of 90 days. You can increase the retention period to up to 12 years.

Activity log data in a Log Analytics workspace is stored in a table called AzureActivity. The structure of this table varies depending on the category of the log entry.

For example, to view a count of activity log records for each category, use the following query:

AzureActivity
| summarize count() by CategoryValue

To retrieve all records in the administrative category, use the following query:

AzureActivity
| where CategoryValue == "Administrative"

Important

In some scenarios, values in fields of AzureActivity might have different case from otherwise equivalent values. When querying data in AzureActivity, use case-insensitive operators for string comparisons, or use a scalar function to force a field to a uniform casing before any comparisons. For example, use the tolower() function on a field to force it to always be lowercase or the =~ operator when performing a string comparison.

Export management group activity logs

When you create a diagnostic setting for a management group, it exports Azure Monitor activity log events for that management group in addition to all management groups under it in the hierarchy. If multiple management groups in the hierarchy have diagnostic settings, you receive duplicate events. You only need a diagnostic setting on the highest level management group to capture all events for the hierarchy.

The management group also collects many of the same events as any subscriptions under it. If the subscription and management group both have diagnostic settings, you receive duplicate events. Azure Resource Manager includes a hierarchy property when writing events, but it's not a required field. Resource providers outside Azure Resource Manager don't populate it, so their events don't propagate up the hierarchy. Because of this, getting duplicate events is better than missing events.

For example, if you have MG1 which contains MG2 which contains Subscription1, a diagnostic setting on MG1 captures all activity log events for MG1, MG2, and many of the events collected by a diagnostic setting on Subscription1. In this case, no diagnostic setting is needed on MG2 since it would just collect duplicate events.

If you have duplicate events, combine them by using a query that uses a hash of all fields to identify unique records. The following example Kusto query shows a sample for logs collected in a Log Analytics workspace:

AzureActivity
| extend Hash = hash(dynamic_to_json(pack_all()))
| summarize arg_max(TimeGenerated, *) by Hash

Export the activity log to a file

Select Download as CSV to export the activity log to a CSV file in the Azure portal.

Screenshot that shows the Download as CSV button in the Azure portal activity log.

Important

Exporting a large number of log entries can take a long time. To improve performance, reduce the time range of the export. In the Azure portal, set the Timespan setting.

Identify resource creation

Use the activity log to find out when the system created a resource and who created it. The activity log is the only place that stores the creator of a resource. Because the activity log only retains data for 90 days by default, you must export the logs to a location that allows you to extend the retention period, like a Log Analytics workspace. Then find the creator of a resource by querying the AzureActivity table. The data is retained for the duration you specified in the retention period for this table.

Related content

  • Last updated on