ConfigurationChange
View changes to in-guest configuration data such as Files Software Registry Keys Windows Services and Linux Daemons
Table attributes
| Attribute | Value |
|---|---|
| Resource types | microsoft.compute/virtualmachines, microsoft.conenctedvmwarevsphere/virtualmachines, microsoft.azurestackhci/virtualmachines, microsoft.scvmm/virtualmachines, microsoft.compute/virtualmachinescalesets |
| Categories | IT & Management Tools |
| Solutions | ChangeTracking |
| Basic log | No |
| Ingestion-time transformation | Yes |
| Sample Queries | Yes |
Columns
| Column | Type | Description |
|---|---|---|
| Acls | string | The Access-Control List specifies which users or system processes are granted access to objects |
| Attributes | string | |
| _BilledSize | real | The record size in bytes |
| ChangeCategory | string | The type of change that occurred: Added Removed Modified |
| Computer | string | |
| ConfigChangeType | string | Type of configuration item that changed: Files Software WindowsServices Registry Daemons |
| Current | string | Current value |
| DateCreated | datetime | Date that the item was created |
| DateModified | datetime | Date that the item was last modified |
| FieldsChanged | string | Fields that were changed as part of the change record |
| FileContentChecksum | string | Checksum of the file content |
| FileSystemPath | string | File system path for the changed file |
| Hive | string | Registry hive for the changed registry key |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| LastSnapshotAge | long | Age of the last snapshot |
| Location | string | |
| ManagementGroupName | string | Name of a resource's assigned management group |
| Name | string | |
| Previous | string | Previous value |
| PreviousAcls | string | Previous Acl value |
| PreviousAttributes | string | Previous attributes value |
| PreviousDateCreated | datetime | Previous date created time |
| PreviousDateModified | datetime | Previous date modified time |
| PreviousFileContentChecksum | string | Previous file content checksum value |
| PreviousSize | long | Previous file size |
| PreviousValueData | string | Previous registry value data |
| PreviousValueType | string | Previous registry value type |
| Publisher | string | Software publisher name |
| RegistryKey | string | Registry key name |
| _ResourceId | string | A unique identifier for the resource that the record is associated with |
| Size | long | Current size of the changed file |
| SoftwareDescription | string | Description of the software |
| SoftwareName | string | Name of the software |
| SoftwareType | string | Type of the software: Application Package Update |
| SourceComputerId | string | |
| SourceSystem | string | The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| _SubscriptionId | string | A unique identifier for the subscription that the record is associated with |
| SvcAccount | string | User account that is associated with the service executable explicitly to provide a security context for the service |
| SvcChangeType | string | Service property that was changed |
| SvcController | string | Parent process for the daemon |
| SvcDisplayName | string | Human-frinedly name for the service |
| SvcName | string | Name of the service |
| SvcPath | string | The file path to the executable for the service |
| SvcPreviousAccount | string | Previous user account that was associated with the sevice executable |
| SvcPreviousController | string | Previous parent process for the daemon |
| SvcPreviousPath | string | Previous file path to the executable for the service |
| SvcPreviousRunlevels | string | Previous modes used by the daemon for system operation |
| SvcPreviousStartupType | string | Previous startup behavior of the service |
| SvcPreviousState | string | Previous state of the service |
| SvcRunlevels | string | Modes used by the daemon for system operation |
| SvcStartupType | string | Startup behavior of the service |
| SvcState | string | Current state of the service |
| TimeGenerated | datetime | Date and time the record was created. |
| Type | string | The name of the table |
| ValueData | string | Data contained in the value and registry key being tracked |
| ValueName | string | Name of the value for the registry key being tracked |
| ValueType | string | Type of the value for the registry key being tracked |
| VMUUID | string |