Query Details
Log Analytic Workspace Deletions
Query
//Deletion of a workspace could lead to a loss of logging - though the queryable workspace may be deleted meaning you'll have no way to run this query AzureActivity | where OperationNameValue == "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/DELETE" | where ActivityStatusValue <> "Start" //so we only see successes or failures, feel free to remove
Explanation
This query is designed to identify and display records of deletion activities for Azure workspaces. Here's a simple breakdown of what it does:
-
Data Source: It uses the
AzureActivitytable, which contains logs of various activities within Azure. -
Filter by Operation: It filters the data to only include activities where the operation name is "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/DELETE". This means it specifically looks for events related to the deletion of Azure workspaces.
-
Exclude Start Status: It further filters the results to exclude activities with a status of "Start". This means it only shows activities that have either succeeded or failed, excluding those that are just beginning.
In summary, this query helps you monitor and review the success or failure of workspace deletion operations in Azure, excluding any operations that are just starting.
Details
Jay Kerai
Released: January 2, 2025
Tables
Keywords
Operators