![\"\"](\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2024\/10\/image-2.png\")
<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\nSetup the Alert <\/p>\n\n\n\n Choose the Subscription <\/p>\n\n\n\n Create a new Resource group and then new Log Analytics Workspace Export the Admin Diagnostics of the Resource group the server sits in to the Log Analytics […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-8350","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/8350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=8350"}],"version-history":[{"count":1,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/8350\/revisions"}],"predecessor-version":[{"id":8355,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/8350\/revisions\/8355"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=8350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=8350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=8350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/figure>\n\n\n\nlet DaysOfLogsToCheck = ago(7days);\nlet MaxUptime = ago(3d); \/\/ If the VM has been up for this long we want to know about it\nAzureActivity\n| where TimeGenerated > DaysOfLogsToCheck\n\/\/ ActivityStatus == \"Succeeded\" makes more sense, but in practice it can be out of order, so \"Started\" is better in the real world\n| where OperationName in (\"Deallocate Virtual Machine\", \"Start Virtual Machine\") and ActivityStatus == \"Started\"\n\/\/ We need to keep only the most recent entry of type 'Deallocate Virtual Machine' or 'Start Virtual Machine'\n| top 1 by TimeGenerated desc\n\/\/ Check if the most recent entry was \"Start Virtual Machine\" and is older than MaxUpTime\n| where OperationName == \"Start Virtual Machine\" and TimeGenerated <= MaxUptime\n| project TimeGenerated, Resource, OperationName, ActivityStatus, ResourceId\n<\/code><\/pre>\n\n\n\n<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"