Get-AzLog

Get-AzLog
    [-CorrelationId] <String>
    [-StartTime <DateTime>]
    [-EndTime <DateTime>]
    [-Status <String>]
    [-Caller <String>]
    [-DetailedOutput]
    [-MaxRecord <Int32>]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

Get-AzLog
    [-ResourceId] <String>
    [-StartTime <DateTime>]
    [-EndTime <DateTime>]
    [-Status <String>]
    [-Caller <String>]
    [-DetailedOutput]
    [-MaxRecord <Int32>]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

Get-AzLog
    [-ResourceGroupName] <String>
    [-StartTime <DateTime>]
    [-EndTime <DateTime>]
    [-Status <String>]
    [-Caller <String>]
    [-DetailedOutput]
    [-MaxRecord <Int32>]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

Get-AzLog
    [-ResourceProvider] <String>
    [-StartTime <DateTime>]
    [-EndTime <DateTime>]
    [-Status <String>]
    [-Caller <String>]
    [-DetailedOutput]
    [-MaxRecord <Int32>]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

Get-AzLog
    [-StartTime <DateTime>]
    [-EndTime <DateTime>]
    [-Status <String>]
    [-Caller <String>]
    [-DetailedOutput]
    [-MaxRecord <Int32>]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

The Get-AzLog cmdlet retrieve Activity Log events. The events can be associated with the current subscription ID, correlation ID, resource group, resource ID, or resource provider.

PS C:\>Get-AzLog

This command lists at most 1000 events associated with the user's subscription ID that took place 7 days from the current date/time.

PS C:\>Get-AzLog -MaxRecord 100

This command lists at most 100 events associated with the user's subscription ID that took place 7 days from the current date/time.

PS C:\>Get-AzLog -StartTime 2017-06-01T10:30

This command lists at most 1000 events associated with the user's subscription ID that took place on or after 2017-06-01T10:30 local time if that date/time is not older than 90 days from the current date/time.

PS C:\>Get-AzLog -StartTime 2017-04-01T10:30 -EndTime 2017-04-14T11:30

This command lists at most 1000 of the events associated with the user's subscription ID that took place on or after 2017-04-01T10:30 local time, and before 2017-04-14T11:30 local time if the whole date/time range is not older than 90 days from the current date/time, i.e.: the retention period.

PS C:\>Get-AzLog -CorrelationId "aaaa0000-bb11-2222-33cc-444444dddddd"

This command lists at most 1000 events associated with the specified correlation ID that took place 7 days from the current date/time. NOTE: this is usually only one event.

PS C:\>Get-AzLog -CorrelationId "aaaa0000-bb11-2222-33cc-444444dddddd" -MaxRecord 100

This command lists at most 100 events associated with the specified correlation ID that took place 7 days from the current date/time. NOTE: this is usually only one event.

PS C:\>Get-AzLog -CorrelationId "aaaa0000-bb11-2222-33cc-444444dddddd" -StartTime 2017-05-22T04:30:00

This command lists at most 1000 events associated with the specified correlation ID that took place on or after 2017-05-22T04:30:00 local time if the start time is not older than 90 days from the current date/time. NOTE: this is usually only one event.

PS C:\>Get-AzLog -CorrelationId "aaaa0000-bb11-2222-33cc-444444dddddd" -StartTime 2017-04-15T04:30:00 -EndTime 2017-04-25T12:30:00

This command lists at most 1000 events associated with the specified correlation ID that took place on or after 2017-04-15T04:30 local time, but before 2017-04-25T12:30 local time if the whole date/time range is not older than 90 days from the current date/time, i.e.: the retention period.

PS C:\>Get-AzLog -ResourceGroupName "Contoso-Web-CentralUS"

This command lists at most 1000 the events associated with the specified resource group that took place 7 days from the current date/time.

PS C:\>Get-AzLog -ResourceGroup "Contoso-Web-CentralUS" -MaxRecord 100

This command lists at most 100 events associated with the specified resource group that took place 7 days from the current date/time.

PS C:\>Get-AzLog -ResourceGroup "Contoso-Web-CentralUS" -StartTime 2017-05-22T04:30:00

This command lists at most 1000 events associated with the specified resource group that took place on or after 2017-05-22T04:30:00 local time if the start time is not older than 90 days from the current date/time.

PS C:\>Get-AzLog -ResourceGroup "Contoso-Web-CentralUS" -StartTime 2017-04-15T04:30 -EndTime 2017-04-25T12:30

This command lists at most 1000 events associated with the specified resource group that took place on or after 2017-04-15T04:30 local time, but before 2017-04-25T12:30 local time if the whole date/time range is not older than 90 days from the current date/time, i.e.: the retention period.

PS C:\>Get-AzLog -ResourceId "/subscriptions/a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1/ResourceGroups/Contoso-Web-CentralUS/providers/Microsoft.Web/ServerFarms/Contoso1"

This command lists at most 1000 events associated with the specified resource ID that took place 7 days from the current date/time.

PS C:\>Get-AzLog -ResourceId "/subscriptions/a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1/ResourceGroups/Contoso-Web-CentralUS/providers/Microsoft.Web/ServerFarms/Contoso1" -MaxRecord 100

This command lists at most 100 events associated with the specified resource ID that took place 7 days from the current date/time.

PS C:\>Get-AzLog -ResourceId "/subscriptions/a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1/ResourceGroups/Contoso-Web-CentralUS/providers/Microsoft.Web/ServerFarms/Contoso1" -StartTime 2017-05-22T04:30

This command lists at most 1000 events associated with the specified resource ID that took place on or after 2017-05-22T04:30:00 local time if the start time is not older than 90 days from the current date/time.

PS C:\>Get-AzLog -ResourceId "/subscriptions/a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1/ResourceGroups/Contoso-Web-CentralUS/providers/Microsoft.Web/ServerFarms/Contoso1" -StartTime 2017-04-15T04:30 -EndTime 2017-04-25T12:30

This command lists at most 1000 events associated with the specified resource ID that took place on or after 2017-04-15T04:30 local time, but before 2017-04-25T12:30 local time if the whole date/time range is not older than 90 days from the current date/time, i.e.: the retention period.

PS C:\>Get-AzLog -ResourceProvider "Microsoft.Web"

This command lists at most 1000 events associated with the specified resource provider that took place 7 days from the current date/time.

PS C:\>Get-AzLog -ResourceProvider "Microsoft.Web" -MaxRecord 100

This command lists at most 100 events associated with the specified resource provider that took place 7 days from the current date/time.

PS C:\>Get-AzLog -ResourceProvider "Microsoft.Web" -StartTime 2017-05-22T04:30

This command lists at most 1000 events associated with the specified resource provider that took place on or after 2017-05-22T04:30:00 local time if the start time is not older than 90 days from the current date/time.

PS C:\>Get-AzLog -ResourceProvider "Microsoft.Web" -StartTime 2017-04-15T04:30 -EndTime 2017-04-25T12:30

This command lists at most 1000 events associated with the specified resource provider that took place on or after 2017-04-15T04:30 local time, but before 2017-04-25T12:30 local time if the whole date/time range is not older than 90 days from the current date/time, i.e.: the retention period.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.