locked
Determine who deleted the blob on Storage Account RRS feed

  • Question

  • If we have the logging on our storage account, and we delete a blob from the container using some storage explorer tool using the key the only thing that gets logged in $logs blob storage container that the blob was deleted. Where can we find that who deleted particular blob?
    • Edited by varsh83 Thursday, February 5, 2015 6:40 PM
    Thursday, February 5, 2015 6:36 PM

Answers

  • Hi kannu123,
    In  the $ blob storage container, it logs the Requestor Account Name(string)  which means the it logs the account making the request to your blob.
    For anonymous and SAS requests this will be left empty.

    I suggest that you could refer to the link regarding what data can be logged in  logs container:
    http://blogs.msdn.com/b/windowsazurestorage/archive/2011/08/03/windows-azure-storage-logging-using-logs-to-track-storage-requests.aspx

    You could download the latest Azure Storage Explorer ,and view the Content of the blob logs.
    You could find log in format like below:

    1.0;2011-07-28T18:02:40.6271789Z;PutBlob;Success;201;28;21;authenticated;

    sally;sally;blob;"http://sally.blob.core.windows.net/thumbnails/lake.jpg?timeout=30000";"/sally/thumbnails/lake.jpg";fb658ee6-6123-41f5-81e2-4bfdc178fea3;0;201.9.10.20;2009-09-19;438;100;223;0;100;;"66CbMXKirxDeTr82SXBKbg==";"0x8CE1B67AD25AA05";Thursday, 28-Jul-11 18:02:40 GMT;;;;"7/28/2011 6:02:40 PM ab970a57-4a49-45c4-baa9-20b687941e32".

    The first  string "sally" is the account making the request.

    Best Regards,
    Kevin Shen.

    Friday, February 6, 2015 6:53 AM