How to know when my VM started before 90 days ?

Question

Hello,

i would like to know when my VM has been started for the last time (and by who if possible), but this date is more than 90 days ago, so i cannot retrieve it from Event logs.
Is there another way to have this information ?

thanks.

Answer 1

Hello, @RCB !

If you backup your logs either by downloading them or by sending them to a Log Analytics workspace, you can still search through the log activity but by default, Azure logs are deleted after 90 days which would limit your options to what you can run on your VM at the OS level (which may include Get-CimInstance with LastBootUpTime).

How do I check the last boot time of my VM more than 90 days ago?
Activity log events are kept by Azure for 90 days and then they are deleted. You can extend this period by downloading the activity log, sending the log to a Log Analytics workspace, sending the log to Azure Storage, or by using another collection method.

If you did not make a copy of the logs or otherwise back them up and 90 days has passed, then you can still access the OS disk of the VM (which is persistent). Options at this point may be limited but you can try using an OS level command like Get-CimInstance with LastBootUpTime:

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime  

Additional Reading:

• (DevBlogs) PowerTip: Get the Last Boot Time with PowerShell
• Azure Monitor activity log
• Viewing VM Reboot Logs
• Last Reboot time for all VMs