WVD Log Analytics (classic) How to find out if someone deleted a wvd server from host pool

[ATWVD]

Hi,

We've lost one server from the host pool randomly and I'm trying to look up log analytics data to find out _if_ an admin has misclicked delete in the management portal:

I've tried different queries:

WVDActivityV1_CL

| where Type_s == "Management" and ObjectsDeleted_s != 0

Also method_s == "delete" or "remove"

also route_s == "delete" or "remove"

What would be the log information generated with a server delete from pool (in the classic wvd management portal)?

I cannot find any documentation on the classic wvd log analytics syntax.

Best Regards

A T

[#2 · Accepted solution]

for Type should be "Management", method should be "Remove". Try to use 'contains' instead of '==' as it may be case sensitive.