how to check who shutdown azure vm?

Question

Hi Team,

I've few VM's in Stopped state in my subscription. These VMs are in stopped state for more than 6 months. I need to collect the information, that when these VMs are stopped and which user has initiated the shutdown. There are no logs under "Activity log" for any of the VM.

Can please let me know if there are any other alternatives to find these details. Thanks in advance.

Thanks & Regards,

Kishore

Answer 1

Hi @Kishore-Reddy.Byreddy

Azure only retains activity logs for a limited period 90 days, You can try use CLI from Azure Cloud Shell

First, you need to find the ID of your virtual machine using the following command:

az vm show --name Your_VM_Name --resource-group Your_Resource_Group --query id --output tsv

Replace Your_VM_Name with the name of your virtual machine and Your_Resource_Group with the name of the resource group in which the VM is located.

After you've obtained the ID of the virtual machine, you can use it to query the Azure activity log:

az monitor activity-log list --resource-id Your_VM_Id --output table

Replace Your_VM_Id with the ID you obtained in the previous command.

This will return a list of all activities related to your virtual machine. You can look for entries with the "Operation Name" column set to "Deallocate Virtual Machine" or "Shut Down Virtual Machine". The date and time of the virtual machine shutdown will be in the "Event Timestamp" column.

Get in touch if you need more help with this issue.

--please don't forget to "[Accept the answer]" if the reply is helpful--

Answer 2

Hi Jackson,

Thanks for your reply.

There was no output returned for the second command. Please find the screenshot below. Please let me know If I'm missing something. Thanks.

Answer 3

Please use the offset option to specify the query range.

az monitor activity-log list --resource-id "/subscriptions/<sub-id>/resourceGroups/<rg-id>/providers/Microsoft.Compute/virtualMachines/<vm-name>" --offset 3d

https://learn.microsoft.com/en-us/cli/azure/monitor/activity-log?view=azure-cli-latest#az-monitor-activity-log-list()

--offset
Time offset of the query range, in ##d##h format.

default value: 6h