Activitylog PS - Event initiated by

Question

I created multiple script to identify who started or stopped a Vm using the activity log but unable to get the results - the script just executes without an output

https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit

Get-AzureRmLog -StartTime 2018-10-01T10:30 -EndTime 2018-10-12T11:30
 -ResourceId /subscriptions/S1sub/resourceGroups/SamRG/providers/microsoft.compute/test
 -DetailedOutput -Maxrecord 100 -InformationAction stop     

Get-AzureRmLog -ResourceGroup samitrg -StartTime 2018-10-01T10:30
  -EndTime 2018-10-12T11:30 | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope |
  Export-Csv -Path c:\abc.csv

Get-AzureRmLog -ResourceGroup samitrg -StartTime 2018-10-01T10:30
    -EndTime 2018-10-12T11:30 | Where-Object OperationName -EQ Microsoft.compute/virtualmachines/deallocate/action

Answer 1

Try the command below, add the extra parameters you need, like -StartTime,-EndTime,etc, it will work fine.

Start a VM:

$start = Get-AzureRmLog -ResourceId "<ResourceId>" | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/start/action"} 
$start | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope

Stop a VM:

$stop = Get-AzureRmLog -ResourceId "<ResourceId>" | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"} 
$stop | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization,scope

Answer 2

I found the solution

START

Get-AzureRmLog -ResourceID /subscriptions/<SUBID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName> -StartTime 2018-10-16T21:30 -EndTime 2018-10-16T21:50 -MaxRecord 20 | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/start/action"} | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization | Format-table -wrap -AutoSize -Property level,eventtimestamp,caller,resourcegroupname,ID -groupby Authorization

STOP

Get-AzureRmLog -ResourceID /subscriptions/<SUBID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName> -StartTime 2018-10-16T21:30 -EndTime 2018-10-16T21:45 -MaxRecord 20 | Where-Object { $_.Authorization.Action -eq "Microsoft.Compute/virtualMachines/deallocate/action"} | Select-Object level,eventtimestamp,caller,ID,resourcegroupname,Authorization | Format-table -wrap -AutoSize -Property level,eventtimestamp,caller,resourcegroupname,ID -groupby Authorization  

Hope this helps everyone :)