Monitoring not frequently used Azure Fileshares

Question

Hello Team,

I am trying to find a solution for monitoring azure Fileshare. I have huge list of Fileshares in my storage accounts. Over the period of time fileshares are added on daily basis for various purposes, so I am trying to create an alert or any other methods to find which azure fileshares are not actively used for more than 60 days(just for an example). If there are ways to find such fileshares I can delete them and save cost.

I checked REST API and used LogicApp as well which fails with Authentication error as you need Identity based authentication to access individual fileshare.

There is only Lastmodified property in fileshares which is not relevant to find the last access time.
And same goes with Files residing in fileshares. Files properties shows only Lastmodified timestamp and not accessed time. There is change time only in headers.

Could you guys please assist.

Regards,

Answer 1

Riyas,

Thanks for your question. I understand you want to be able to run queries on your azure file shares -- I think the best way to do this is to start logging with Azure Monitor. This way, you will get rich data on your file shares instead of only last modified. To do this, you will need to create a log analytics workspace and then set the diagnostic settings of your storage account / file share to send logs to the workspace. Once your logs are working, you can query last modified with the KQL query builder.

More here: storage-files-monitoring

If this answer helped you, please mark it as accepted so that others with similar issues may also learn from your experience.

Thanks,
Eric

Answer 2

Hello Eric,

Thank you for your reply.
Indeed, I already have diagnostics enabled and logs are sent to log analytics workspace.

The problem I see with expanding StorageFileLogs using KQL is, even for a dummy fileshare created for testing it has some HTTPS operations like 'getfileserviceproperties'.

I am trying to identify fileshare which doesn't have any activities for last 30 days.

Could you please share your thoughts.

Regards,
Riyas

Answer 3

@Riyas Please refer to this similar thread- https://learn.microsoft.com/en-us/answers/questions/595846/index.html

For your requirement , you need to create a custom PowerShell script such that you can check below logs to know if the resource hasn't been in past 30 days.

Activity logs : It gives you insights into subscription-level events including such information as when a resource is modified (created or update or delete.) or when a virtual machine is started. -- We can set up alert on that. However even if you don't see any activity logs within 30 days it doesn't mean that the service itself is not running.

To know in detail you might check on certain metrics/logs . For example , Azure Storage has metrics like Transactions, Ingress, Egress, Requests, etc. You could use that to determine if there is activity in your storage account.

So , You can either (1) check metrics in certain resource, or simply set up metric alert on single resource or (2) Use diagnostic settings to send metrics to log analytics workspace, and do queries manually to check on the usage or (3) Also for some resources we have centralized monitor insights , for example in you search for "Monitor" in portal, on the left blade, which gives you some "insights" feature for specific resources, you can check the usage more conveniently.

Reference :

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-monitoring?tabs=azure-portal#analyzing-metrics

Please let us know if you have any more questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.