Alert on Vm creation (not deletion)

Question

Hello,

I have created an Alert based on the "Create or Update Virtual Machine" OperationName, the problem it also alerts on other Vm related activities as Vm deletion.

Is it possible to create an alert only on Vm creation?

Thank you.

Answer 1

Hi CloudMe,

Yes, it is possible.

If you have enabled sending Azure Activity logs to an Azure Log Analytics workspace then query to check only VM's creation would be something like shown below.

AzureActivity| where (OperationNameValue == "Microsoft.Compute/virtualMachines/write") and (ActivitySubstatusValue == "Created")

Similarly, query to check only VM's deletion would be something like shown below.

AzureActivity| where (OperationNameValue == "Microsoft.Compute/virtualMachines/delete") and (ActivitySubstatusValue == "Accepted") 

Hope this helps!!

Answer 2

Hope this helps!!

Absolutely, Thank you !