azure - Activitylog PS - 事件发起者

Question

我创建了多个脚本来识别谁使用活动日志启动或停止了虚拟机，但无法获得结果 - 脚本只是在没有输出的情况下执行

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit

Get-AzureRmLog -StartTime 2018-10-01T10:30 -EndTime 2018-10-12T11:30
 -ResourceId /subscriptions/S1sub/resourceGroups/SamRG/providers/microsoft.compute/test
 -DetailedOutput -Maxrecord 100 -InformationAction stop     

Get-AzureRmLog -ResourceGroup samitrg -StartTime 2018-10-01T10:30
  -EndTime 2018-10-12T11:30 | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope |
  Export-Csv -Path c:\abc.csv

Get-AzureRmLog -ResourceGroup samitrg -StartTime 2018-10-01T10:30
    -EndTime 2018-10-12T11:30 | Where-Object OperationName -EQ Microsoft.compute/virtualmachines/deallocate/action

Answer 1

我找到了解决方案

开始

Get-AzureRmLog -ResourceID /subscriptions/<SUBID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName> -StartTime 2018-10-16T21:30 -EndTime 2018-10-16T21:50 -MaxRecord 20 | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/start/action"} | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization | Format-table -wrap -AutoSize -Property level,eventtimestamp,caller,resourcegroupname,ID -groupby Authorization

停止

Get-AzureRmLog -ResourceID /subscriptions/<SUBID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName> -StartTime 2018-10-16T21:30 -EndTime 2018-10-16T21:45 -MaxRecord 20 | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"} | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization | Format-table -wrap -AutoSize -Property level,eventtimestamp,caller,resourcegroupname,ID -groupby Authorization  

希望这对每个人都有帮助:)

Answer 2

试试下面的命令，添加你需要的额外参数，比如-StartTime，-EndTime等，它会正常工作。

启动虚拟机：

$start = Get-AzureRmLog -ResourceId "<ResourceId>" | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/start/action"} 
$start | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope

停止虚拟机：

$stop = Get-AzureRmLog -ResourceId "<ResourceId>" | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"} 
$stop | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope