SOLVED

WVD Log Analytics (classic) How to find out if someone deleted a wvd server from host pool

Occasional Contributor

Hi,

 

We've lost one server from the host pool randomly and I'm trying to look up log analytics data to find out _if_ an admin has misclicked delete in the management portal:

 

I've tried different queries:

 

WVDActivityV1_CL
| where Type_s == "Management" and ObjectsDeleted_s != 0
 
Also method_s == "delete" or "remove"
 
also route_s == "delete" or "remove"
 
 
What would be the log information generated with a server delete from pool (in the classic wvd management portal)?
 
I cannot find any documentation on the classic wvd log analytics syntax.
 
 
Best Regards
A T
1 Reply
best response confirmed by ATWVD (Occasional Contributor)
Solution
for Type should be "Management", method should be "Remove". Try to use 'contains' instead of '==' as it may be case sensitive.