How to get the report of which Azure VM was rebooted in the past 24 hours?

Question

I have over 1000 VMs running Windows and non-Windows OS in Azure. I need to generate a report of Azure VMs rebooted within the past 24 hours. Is there any way to create such a report with PowerShell or KQL (Kusto Query)? I would like to express my gratitude in advance for your assistance in this matter. Thank you for your anticipated cooperation.

Answer 1

@EnterpriseArchitect Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Please find the code you can try to find the last-reboot information through a PowerShell script:

az login

az account set --subscription "your_subscription_key"

$vms= az vm list --query "[].id" -o tsv

$vms = $vms -split "`n"

foreach ($vm in $vms) {

$endTime = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ" 
$startTime = (Get-Date).AddHours(-24).ToString("yyyy-MM-ddTHH:mm:ssZ")

# Get the last reboot time
$lastReboot = az monitor activity-log list --resource-id $vm --start-time $startTime --end-time $endTime --query "[?operationName.value=='Microsoft.Compute/virtualMachines/restart/action'].eventTimestamp" -o tsv

# Check if the VM has been rebooted in the last 24 hours
if ($lastReboot) {
    Write-Output "$vm rebooted at $lastReboot"
}
}

#Now in this code, we are using az monitor activity-log list #to find the reboot details of the VM. #This is a basic example. You can now play with the script to display this information in a more user-#friendly way.

#If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have #extra questions about this answer, please click "Comment".