A basic question about the Activity Log

Occasional Contributor


Can someone please help me with the following question,


when I look at a resource in the Azure portal for example a VM or Public IP Address or Network Interface Card etc. each of these resources has a tab for 'Activity Log' which shows the activities for that given resource.


However I want to understand if behind all of these individual activity logs there is in fact one large activity log for the whole subscription (e.g. one activity log per subscription, or possible tenant), then when looking at a specific resources activity log what you are actually seeing is a 'filtered' list of activities for that given resource only (e.g. a filtered list from this one large activity log for the whole subscription)


is the above correct? e.g. there is in fact only one large activity log (eventing subsystem) and each resources activity log is just a filtered view for that particular resource





1 Reply

you are correct, the log you are seeing has been filtered to the resource you are looking at.
at any level you should be able to change the filtering to the subscription level, resource type etc.


This is an assumption, but i imagine it uses the same log repository as Log Analytics, these logs are available there as well.