{"id":8350,"date":"2024-10-09T03:23:12","date_gmt":"2024-10-09T03:23:12","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=8350"},"modified":"2024-10-09T03:23:14","modified_gmt":"2024-10-09T03:23:14","slug":"how-to-use-azure-monitor-to-alert-for-when-an-azure-vm-has-been-left-on-for-x-days","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/how-to-use-azure-monitor-to-alert-for-when-an-azure-vm-has-been-left-on-for-x-days","title":{"rendered":"How to Use Azure Monitor to alert for when an Azure VM has been left on for X Days"},"content":{"rendered":"\n

Create a new Resource group and then new Log Analytics Workspace <\/p>\n\n\n\n

Export the Admin Diagnostics of the Resource group the server sits in to the Log Analytics Workspace you created<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n

Setup the Alert <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Choose the Subscription <\/p>\n\n\n\n

let DaysOfLogsToCheck = ago(7days);\nlet MaxUptime = ago(3d); \/\/ If the VM has been up for this long we want to know about it\nAzureActivity\n| where TimeGenerated > DaysOfLogsToCheck\n\/\/ ActivityStatus == \"Succeeded\" makes more sense, but in practice it can be out of order, so \"Started\" is better in the real world\n| where OperationName in (\"Deallocate Virtual Machine\", \"Start Virtual Machine\") and ActivityStatus == \"Started\"\n\/\/ We need to keep only the most recent entry of type 'Deallocate Virtual Machine' or 'Start Virtual Machine'\n| top 1 by TimeGenerated desc\n\/\/ Check if the most recent entry was \"Start Virtual Machine\" and is older than MaxUpTime\n| where OperationName == \"Start Virtual Machine\" and TimeGenerated <= MaxUptime\n| project TimeGenerated, Resource, OperationName, ActivityStatus, ResourceId\n<\/code><\/pre>\n\n\n\n
\"\"<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"
Create a new Resource group and then new Log Analytics Workspace Export the Admin Diagnostics of the Resource group the server sits in to the Log Analytics […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-8350","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t