Azure PowerShell Reference

Get-AzLog Command
Azure > Reference > PowerShell > Management Cmdlets > Get-AzLog

Get-AzLog

Retrieves activity logs for Azure resources.

Syntax

Get-AzLog
    [-ResourceId <String>]
    [-ResourceGroup <String>]
    [-ProviderName <String>]
    [-Status <String>]
    [-StartTime <DateTime>]
    [-EndTime <DateTime>]
    [-OperationName <String>]
    [-CorrelationId <String>]
    [-MaxRecordCount <Int32>]
    [-DefaultProfile <IAzureContextContainer>]

Description

The Get-AzLog cmdlet retrieves the activity logs for Azure resources. Activity logs provide insights into operations performed on your Azure resources, including monitoring, troubleshooting, and auditing.

Parameters

-ResourceId
[String]

The ID of the resource for which to retrieve activity logs. This is typically in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}`.

-ResourceGroup
[String]

The name of the resource group for which to retrieve activity logs.

-ProviderName
[String]

The name of the resource provider (e.g., Microsoft.Compute) for which to retrieve activity logs.

-Status
[String]

Filters the logs by status (e.g., Started, Succeeded, Failed).

-StartTime
[DateTime]

Specifies the start time for the log query. Logs generated at or after this time will be returned.

-EndTime
[DateTime]

Specifies the end time for the log query. Logs generated before this time will be returned.

-OperationName
[String]

Filters the logs by operation name (e.g., Microsoft.Compute/virtualMachines/read).

-CorrelationId
[String]

Filters the logs by a correlation ID, which can help trace related operations.

-MaxRecordCount
[Int32]

The maximum number of log records to return.

-DefaultProfile
[IAzureContextContainer]

The credentials, account, tenant, and subscription used for communication with Azure.

Examples

Get all activity logs for a specific subscription

This example retrieves all activity logs for the current subscription within the last 24 hours.

Get-AzLog -StartTime (Get-Date).AddDays(-1)

Get activity logs for a specific resource group

This example retrieves activity logs for the resource group named "MyResourceGroup" within the last 7 days.

Get-AzLog -ResourceGroup "MyResourceGroup" -StartTime (Get-Date).AddDays(-7)

Get activity logs for a specific resource

This example retrieves activity logs for a virtual machine named "MyVM" in the "MyResourceGroup" resource group.

$resourceId = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVM"
Get-AzLog -ResourceId $resourceId -StartTime (Get-Date).AddHours(-2)

Filter logs by operation status

This example retrieves activity logs that resulted in a "Failed" status within the last day.

Get-AzLog -Status "Failed" -StartTime (Get-Date).AddDays(-1)

See Also