WVD Log Analytics (classic) How to find out if someone deleted a wvd server from host pool

Copper Contributor



We've lost one server from the host pool randomly and I'm trying to look up log analytics data to find out _if_ an admin has misclicked delete in the management portal:


I've tried different queries:


| where Type_s == "Management" and ObjectsDeleted_s != 0
Also method_s == "delete" or "remove"
also route_s == "delete" or "remove"
What would be the log information generated with a server delete from pool (in the classic wvd management portal)?
I cannot find any documentation on the classic wvd log analytics syntax.
Best Regards
1 Reply
best response confirmed by ATWVD (Copper Contributor)
for Type should be "Management", method should be "Remove". Try to use 'contains' instead of '==' as it may be case sensitive.