1

Is there any way to get Azure VM reboot and shutdown logs into Azure Log Analytics Workspace?

I already mapped syslog and daemon & Kern log into Azure Log Analytics Workspace but I couldn't get any log message related to VM Reboot and shutdown even though I rebooted the VM.

Anyone have an idea to accomplish this requirement?

Anbarasu Subramaniyan
  • 173
  • 1
  • 3
  • 15

1 Answers1

0

Assuming you perform a reboot from the Azure portal, Azure PowerShell AZ CLI, or the API, then an event will be generated in the Azure Activity Log. You can send activity logs to a Log Analytics workspace. Instructions for configuring the integration between activity logs and log analytics can be found here

djpm
  • 1
  • 3
  • Actually I need to capture from VM's command line reboot and auto-reboot events due to updates. Is there any way to get those logs? – Anbarasu Subramaniyan Nov 18 '19 at 10:44
  • They should appear on the System logs of the VM/OS itself. Assuming you're running a Linux VM the specific log file could vary depending on distribution – djpm Nov 18 '19 at 11:58